CVE-2026-103422: Improper Neutralization of Input During Web Page Generation

The AnyComment plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'email' parameter in versions up to, and including, 0.3.6. This is due to insufficient input sanitization on the public /wp-json/anycomment/v1/subscribe REST endpoint and missing output escaping in...

CVE-2026-103367: Improper Control of Filename for Include/Require Statement in PHP Program

The ShopMagic – email automation for WordPress plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.9.0 via the 'billingaddress.firstname' parameter parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary .php...

CVE-2026-104110: Exposure of Sensitive Information to an Unauthorized Actor

FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.24.0, FileRise Pro /api/pro/portals/get.php returns a configured client portal's full internal record to an unauthenticated caller who knows or guesses the portal slug. The response...

PT-2026-114210

InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.0, InvoiceShelf public customer invoice, estimate, and payment routes use an EmailLog token's numeric mailable id without verifying mailable typ...

CVE-2026-103358: Improper Control of Generation of Code

Improper Control of Generation of Code 'Code Injection' vulnerability in VillaTheme Email Template Customizer for WooCommerce email-template-customizer-for-woo allows Code Injection.This issue affects Email Template Customizer for WooCommerce: from n/a through 1.3.4...

VulnCheck KEV: CVE-2026-76519

Cisco Secure Email Gateway contains a relative path traversal vulnerability that could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating system...

CVE-2026-104108: Improper Authentication

FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.23.0, FileRise maps an authenticated OIDC identity to a local account using mutable preferredusername or email claims and does not require emailverified for email-based naming. An...

PT-2026-113737

Name of the Vulnerable Software and Affected Versions Cisco Secure Email Gateway versions prior to 15.5.5-014 Cisco Secure Email Gateway version 16.0 Cisco Secure Email Gateway versions prior to 16.5.0-780 Description A relative path traversal issue exists in the Advanced Malware Protection AMP...

PT-2026-116225

Уязвимость модуля Advanced Malware Protection AMP средства защиты Cisco Secure Email Gateway связана с неверным ограничением имени пути к каталогу. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, получить доступ на запись произвольных файлов и выполнить произвольные...

CVE-2026-96904: Exposure of Sensitive Information to an Unauthorized Actor

The AWP Classifieds WordPress plugin before 4.4.9 does not verify that a request is authorised to view a listing when a payment transaction is referenced, allowing unauthenticated attackers to bypass the ownership check on the ad submission page and read the private contact email stored on any...

PT-2026-114168

Name of the Vulnerable Software and Affected Versions Parse Server versions prior to 8.6.97 Parse Server versions 9.0.0 through 9.10.2-alpha.5 Description Improper error handling occurs when sending verification or password reset emails, which can lead to the server process exiting. An attacker...

CVE-2026-76519: Relative Path Traversal

A vulnerability in the Advanced Malware Protection AMP feature of Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating system. This vulnerability is due to improper handling of email attachments when the file reputation...

PT-2026-113946

Zulip is an open-source team collaboration tool. In Zulip Server versions through 12.1, GenericOpenIdConnectBackend matches the identity provider email claim to an active account's delivery email without rejecting an explicitly false email verified claim. If a configured identity provider returns...

CVE-2026-90989: Exposure of Sensitive Information to an Unauthorized Actor

The Tainacan WordPress plugin before 1.4.0 does not restrict its reports REST endpoints to users with a management capability, allowing any authenticated subscriber to read the email addresses of the repository's staff...

PT-2026-113707

The ShopMagic – email automation for WordPress plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.9.0 via the 'billing address.first name' parameter parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary .ph...

PT-2026-113699

The AWP Classifieds WordPress plugin before 4.4.9 does not verify that a request is authorised to view a listing when a payment transaction is referenced, allowing unauthenticated attackers to bypass the ownership check on the ad submission page and read the private contact email stored on any...

PT-2026-113954

Improper Control of Generation of Code 'Code Injection' vulnerability in VillaTheme Email Template Customizer for WooCommerce email-template-customizer-for-woo allows Code Injection.This issue affects Email Template Customizer for WooCommerce: from n/a through 1.3.4...

Cisco Secure Email Gateway Relative Path Traversal Vulnerability

Cisco Secure Email Gateway contains a relative path traversal vulnerability that could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating system...

Weak Password Recovery Mechanism for Forgotten Password

Overview Affected versions of this package are vulnerable to Weak Password Recovery Mechanism for Forgotten Password in the password reset and confirmation process. An attacker can gain unauthorized access to user accounts or intercept sensitive information by exploiting the ability to send...

Weak Password Recovery Mechanism for Forgotten Password

Overview Microsoft.AspNetCore.App.Runtime.linux-musl-arm is a package providing a default set of APIs for building an ASP.NET Core application. Contains assets used for self-contained deployments. Affected versions of this package are vulnerable to Weak Password Recovery Mechanism for Forgotten...