PT-2026-46362

Unauthenticated Local File Inclusion in Granola = 1.13 versions...

PT-2026-46343

Unauthenticated PHP Object Injection in Plumbing = 1.6 versions...

PT-2026-46326

Name of the Vulnerable Software and Affected Versions Raider Spirit versions prior to 1.1.3 Description An unauthenticated Local File Inclusion LFI exists, which allows an attacker to include and read local files on the server without requiring authentication. Recommendations Update to a version...

CVE-2026-10860: Incorrect Authorization

A logic error in the MISP CRUD component delete handler allowed validation failures to be bypassed when requests used the HTTP DELETE method. Due to missing parentheses in the delete condition, the expression was evaluated as $validationError === null && POST || DELETE, meaning a DELETE request...

PT-2026-46369

Unauthenticated Local File Inclusion in Choreo = 1.6 versions...

PT-2026-46347

Subscriber Broken Access Control in Genemy = 1.6.6 versions...

PT-2026-46341

Unauthenticated Local File Inclusion in Food Drop = 1.3 versions...

PT-2026-46358

Unauthenticated Local File Inclusion in Top Dog = 1.0.5 versions...

JoomSky Joomla com_jsjobs: Path traversal vulnerability

JoomSky Joomla comjsjobs is a recruitment and job management component provided by JoomSky Inc. Version 1.2.6 of JoomSky Joomla comjsjobs contains a path traversal vulnerability. This vulnerability arises from improper handling of custom user field parameters, which may allow authenticated...

PT-2026-46334

Unauthenticated Local File Inclusion in Ingenioso = 1.14.0 versions...

PT-2026-46335

Unauthenticated Local File Inclusion in CopyPress = 1.4.5 versions...

PT-2026-46338

Unauthenticated Local File Inclusion in Deliciosa = 1.10.0 versions...

PT-2026-46191

Name of the Vulnerable Software and Affected Versions OpenShift Pipelines operator affected versions not specified Description A flaw in the OpenShift Pipelines operator occurs because the tekton-scheduler-rolebinding ClusterRoleBinding grants the system:authenticated group write access to Kueue...

PT-2026-46374

Unauthenticated Local File Inclusion in Orpheus = 1.3 versions...

PT-2026-46387

Name of the Vulnerable Software and Affected Versions WP Meta Sort Posts versions prior to 1.0 Description The WP Meta Sort Posts plugin for WordPress is subject to Cross-Site Request Forgery CSRF, a type of attack where an unauthorized user tricks a victim into performing actions they did not...

PT-2026-46382

Unauthenticated Privilege Escalation in Support Ticket Management System = 1.9 versions...

PT-2026-46377

Unauthenticated Local File Inclusion in Etude = 1.6 versions...

CVE-2026-42318

GLPI is a free asset and IT management software package. Starting in version 9.5.0 and prior to versions 10.0.25 and 11.0.7, low privilege users with access to planning can delete any object in GLPI. Upgrade to 11.0.7 or 10.0.25 to receive a patch. As a workaround, disable delete rights for User'...

CVE-2026-42318

GLPI is a free asset and IT management software package. Starting in version 9.5.0 and prior to versions 10.0.25 and 11.0.7, low privilege users with access to planning can delete any object in GLPI. Upgrade to 11.0.7 or 10.0.25 to receive a patch. As a workaround, disable delete rights for User'...

CVE-2026-42318

GLPI is a free asset and IT management software package. Starting in version 9.5.0 and prior to versions 10.0.25 and 11.0.7, low privilege users with access to planning can delete any object in GLPI. Upgrade to 11.0.7 or 10.0.25 to receive a patch. As a workaround, disable delete rights for User'...