CVE-2026-16592

The WP Directory Kit WordPress plugin, versions through 1.5.7 , is vulnerable to an authorization bypass in one of its shortcodes . Because the plugin fails to verify authorization or listing visibility, users with a role as low as Contributor can disclose non-public listing content . This includ...

CVE-2026-85657 Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors <= 4.15.0 - Authenticated (Author+) Stored Cross-Site Scripting via 'profile_fields_user_email_value_prefix' Parameter

The Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘profilefieldsuseremailvalueprefix’ parameter in all versions up to, and including, 4.15.0 due to insufficient input sanitization...

CVE-2026-88742

Bacularis 1.0.0 - 6.5.0 is vulnerable to Stored cross-site scripting XSS in the client address field...

CVE-2026-88742

Bacularis 1.0.0 - 6.5.0 is vulnerable to Stored cross-site scripting XSS in the client address field...

CVE-2026-88742

Bacularis versions 1.0.0 through 6.5.0 are vulnerable to Stored cross-site scripting (XSS) . The vulnerability exists within the client address field , where improper neutralization of input during web page generation allows for script injection. Exploitation details are not provided in the docum...

EUVD-2026-79298

Bacularis 1.0.0 - 6.5.0 is vulnerable to Stored cross-site scripting XSS in the client address field...

CVE-2026-83092: Improper Access Control

Vulnerability in the Oracle Field Service product of Oracle E-Business Suite component: Internal Operations. Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Field Service...

PT-2026-92663

Name of the Vulnerable Software and Affected Versions Oracle Field Service of Oracle E-Business Suite versions 12.2.3 through 12.2.15 Description An issue exists in the Internal Operations component of the Oracle Field Service product. A low privileged attacker with network access via HTTP can...

Linux Distros Unpatched Vulnerability : CVE-2026-86818

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - fast-uri is a dependency-free RFC 3986 URI parser for Node.js, used by Fastify and ajv, that added a mailto scheme parser in version 4.1.3. In versions 4.1.3 an...

PT-2026-92100

Name of the Vulnerable Software and Affected Versions gitoxide gix-transport versions prior to 0.59.2 Description The software fails to filter control characters in git-daemon connect requests. This allows attackers to inject NUL, CR, or LF bytes through specially crafted git URLs. Such injection...

CVE-2026-83198: URL Redirection to Untrusted Site

Vulnerability in the Oracle Field Service product of Oracle E-Business Suite component: Internal Operations. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Field Service...

CVE-2026-88742: Improper Neutralization of Input During Web Page Generation

Bacularis 1.0.0 - 6.5.0 is vulnerable to Stored cross-site scripting XSS in the client address field...

CVE-2026-83140: Improper Access Control

Vulnerability in the Oracle Field Service product of Oracle E-Business Suite component: Internal Operations. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Field Service...

CVE-2026-83141: Improper Access Control

Vulnerability in the Oracle Field Service product of Oracle E-Business Suite component: Internal Operations. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Field Service...

PT-2026-92616

Name of the Vulnerable Software and Affected Versions Oracle Field Service versions 12.2.3 through 12.2.15 Description A flaw in the Internal Operations component allows a low privileged attacker with network access via HTTP to compromise the system. Successful exploitation can lead to unauthoriz...

PT-2026-92721

Vulnerability in the Oracle Field Service product of Oracle E-Business Suite component: Internal Operations. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Field Service...

CVE-2026-83091: Improper Access Control

Vulnerability in the Oracle Field Service product of Oracle E-Business Suite component: Internal Operations. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Field Service...

PT-2026-92128

Concrete CMS 9.5.2 and below is vulnerable to stored DOM-based Cross-site Scripting XSS via the Gallery block's per-image Caption field because the bundled Magnific Popup lightbox script concrete/js/features/imagery/frontend.js re-parses the attribute-decoded caption as HTML through jQuery's...

PT-2026-92615

Name of the Vulnerable Software and Affected Versions Oracle Field Service versions 12.2.3 through 12.2.15 Description An issue exists in the Internal Operations component of the Oracle Field Service product within Oracle E-Business Suite. A low privileged attacker with network access via HTTP ca...

PT-2026-92664

Name of the Vulnerable Software and Affected Versions Oracle Field Service versions 12.2.3 through 12.2.15 Description A flaw in the Internal Operations component allows a low privileged attacker with network access via HTTP to compromise the system. This issue can lead to unauthorized access to...