CVE-2026-53541: Improper Input Validation

OliveTin gives access to predefined shell commands from a web interface. The filterToDefinedArgumentsOnly function in the executor is intended to discard any arguments not explicitly defined in the action's configuration. However, prior to commit ebffd9f040f791208aee1db2e5a8aecd1e3e603d, a specia...

CVE-2026-77234: Incorrect Authorization

Improper input validation in FreeRTOS-Kernel before 11.3.1 might allow an unprivileged task on MPU-enabled ports to execute code in privileged kernel context. To remediate this issue, users should upgrade to version 11.3.1 or later...

CVE-2026-77710: Improper Input Validation

A vulnerability in misp-stix could allow a crafted STIX document to influence security-sensitive MISP attribute metadata during import. The STIX import logic automatically selected between the internal MISP parser and the external STIX parser based on metadata contained in the STIX document itsel...

CVE-2026-77391: Cross-Site Request Forgery (CSRF)

A security flaw has been discovered in SourceCodester Dynamic Input Field Generator Using HTML, CSS, and PHP 1.0. This affects an unknown function. The manipulation results in cross-site request forgery. The attack can be launched remotely. The exploit has been released to the public and may be...

PT-2026-79451

Improper input validation in the dashboards-observability plugin in OpenSearch Dashboards allows a remote authenticated user with write permissions to OpenSearch Dashboards saved objects to execute arbitrary JavaScript in the context of other users' browser sessions by uploading a saved asset wit...

PT-2026-79438

Joomla Extension - j2commerce.com - Stored XSS in Guest checkout in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 - J2Commerce 4.1.5 is vulnerable to Stored Cross-Site Scripting XSS through the guest checkout billing address fields. An unauthenticated attacker exploits a filter bypass in Joomla...

PT-2026-79380

Joomla Extension - yootheme.com - Unauthenticated stored XSS via user-controlled fields in Zoo 4.1.66 - User supplied input in comments and user supplied field elements weren't escaped, leading to a stored XSS vector...

PT-2026-79456

Name of the Vulnerable Software and Affected Versions Phalcon versions prior to 5.16.0 Description The resolveFilter function in phalcon/Mvc/View/Engine/Volt/Compiler.zep constructs the join filter by inserting raw separator and array token values into generated PHP without using the expression...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-102072)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-102072 advisory. In the Linux kernel, the following vulnerability has been resolved: libceph: replace BUGON with bounds check for map-maxosd OSD indexes come from untrusted network...

PT-2026-79303

Name of the Vulnerable Software and Affected Versions Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin versions prior to 5.0.14 Description The plugin fails to validate a client-supplied payment amount against the vendor's actual outstanding balance during the...

PT-2026-79315

Name of the Vulnerable Software and Affected Versions Apache CloudStack versions 4.20.0.0 through 4.20.3.0 Apache CloudStack versions 4.21.0.0 through 4.22.1.0 Description An OS Command Injection issue exists in the NAS backup provider plugin. The 'addBackupRepository' and 'updateBackupRepository...

PT-2026-80269

Summary The value of graphql.maxTake can be bypassed by providing a negative input. This can be used to exceed the developer's intended graphql.maxTake value, allowing queries to return results in excess of the graphql.maxTake value set. Impact This affects any project relying on graphql.maxTake ...

CVE-2026-71494: Insufficiently Protected Credentials

Infracost provides cloud cost intelligence for engineers, AI coding agents, and CI/CD. Prior to 0.10.45, internal/hcl/remotevariablesloader.go and related Terraform Cloud, remote-plan, and Terragrunt registry request paths can attach a configured Terraform Cloud or registry token to a destination...

PT-2026-79416

Name of the Vulnerable Software and Affected Versions FreeRTOS-Kernel versions prior to 11.3.1 Description Improper input validation may allow an unprivileged task on MPU-enabled ports to execute code in privileged kernel context. MPU Memory Protection Unit is a hardware component that monitors...

PT-2026-79409

Name of the Vulnerable Software and Affected Versions UAC Unix-like Artifacts Collector versions prior to 3.3.0 Description A command injection issue exists in the command collector function. The software substitutes command output lines directly into command strings using sed without proper...

PT-2026-79366

Name of the Vulnerable Software and Affected Versions Eventin WordPress plugin versions prior to 4.1.21 Description Insufficient validation of user-supplied webhook URLs stored on events and a failure to verify event ownership allow users with contributor-level access and above to trigger blind...

PT-2026-79293

The WPForms Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Single Line Text and Paragraph Text Field Values in all versions up to, and including, 2.0.0.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

CVE-2026-77392: Improper Neutralization of Special Elements used in an SQL Command

A weakness has been identified in SourceCodester Dynamic Input Field Generator Using HTML, CSS, and PHP 1.0. This impacts the function saveUser of the file /public/submit.php. This manipulation of the argument Researcher causes sql injection. The attack may be initiated remotely. The exploit has...

CVE-2026-65645: Improper Input Validation

Rocket.Chat in versions before 8.8.0, 8.7.1, 8.6.2, 8.5.3, 8.4.6. 8.3.8, 8.2.8, 8.1.8, and 7.10.15, the Meteor DDP methods getThreadsList and getThreadMessages accept rid / tmid as raw, untyped parameters with no schema validation. A MongoDB operator object e.g. "$gt": "4" can be substituted for ...

CVE-2026-16520: Improper Input Validation

Improper input validation and Exposure of sensitive information through data queries vulnerability in Genians Genian NAC V4.0, Genians Genian NAC V5.0, and Genians Genian ZTNA V6.0 allows SQL Injection and Authentication Bypass. This issue affects Genian NAC V4.0: from 4.0.0 before 4.0.175Revisio...