PT-2026-94388

Name of the Vulnerable Software and Affected Versions pgAdmin 4 versions prior to 9.18 Description The save file endpoint in the File Manager, used by the Query Tool and ERD, contains a race condition. While the system validates the requested path using the check access permission function, it...

PT-2026-94192

Name of the Vulnerable Software and Affected Versions Checkout Field Manager Checkout Manager for WooCommerce WordPress versions prior to 7.9.7 Description An issue exists where the software fails to properly validate the ownership of an attachment before deletion. This allows any authenticated...

PT-2026-94267

Contributor SQL Injection in Product Feed Manager = 7.12.0 versions...

PT-2026-94275

Shop manager SQL Injection in WP-Lister Lite for eBay = 3.8.11 versions...

PT-2026-95004

Name of the Vulnerable Software and Affected Versions mport versions prior to 2.7.8 Description The MidnightBSD Package Manager fails to consistently reject bundle filenames that are empty or contain dots, dot-dot sequences, or slashes within the libmport/fetch.c file. This occurs because the is...

PT-2026-94182

Name of the Vulnerable Software and Affected Versions Event Booking Manager for WooCommerce versions prior to 5.6.0 Description Insufficient access restrictions in the payment gateway configuration allow users with Contributor-level permissions or higher to view sensitive credentials. This includ...

PT-2026-95017

Name of the Vulnerable Software and Affected Versions mport versions prior to 2.7.8 Description In the MidnightBSD Package Manager, directory assets handled as ASSET DIR or ASSET DIR OWNER MODE in the libmport/bundle read install pkg.c file utilize path-based mport mkdirp, ownership, and permissi...

PT-2026-94175

Name of the Vulnerable Software and Affected Versions Event Booking Manager for WooCommerce versions prior to 5.3.8 Description The plugin fails to perform ownership or authorization checks before rendering booking confirmation details. This allows unauthenticated attackers to retrieve personal...

PT-2026-94193

Name of the Vulnerable Software and Affected Versions Checkout Field Manager Checkout Manager for WooCommerce WordPress versions prior to 7.9.7 Description An issue exists where the software fails to properly validate the ownership of an attachment before deletion. This allows any authenticated...

PT-2026-94362

Name of the Vulnerable Software and Affected Versions Dell SmartFabric Manager versions prior to 2.2.1 Description Insufficient Verification of Data Authenticity allows a low privileged attacker with remote access to potentially achieve elevation of privileges. Recommendations Update Dell...

CVE-2026-66580: Improper Neutralization of Special Elements used in an SQL Command

Contributor SQL Injection in Product Feed Manager = 7.12.0 versions...

PT-2026-94303

Unauthenticated Cross Site Scripting XSS in WP Inventory Manager = 2.5.4 versions...

PT-2026-95014

Name of the Vulnerable Software and Affected Versions mport versions prior to 2.7.8 Description The MidnightBSD Package Manager fails to perform a preflight check for non-directory assets that already exist on the disk during package installation. The logic within libmport/check preconditions.c,...

PT-2026-94363

Dell SmartFabric Manager, versions prior to 2.2.1, contains an Improper Handling of Insufficient Permissions or Privileges vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure...

CVE-2026-54576: Improper Link Resolution Before File Access

mport is the MidnightBSD Package Manager. Prior to 2.7.8, doactualinstall in libmport/bundlereadinstallpkg.c used path-based lstat, chown, stat, and chmod operations while installing package files. A local attacker with write access to a target directory could replace a checked file with a symlin...

CVE-2026-91008: Authorization Bypass Through User-Controlled Key

The Event Booking Manager for WooCommerce WordPress plugin before 5.3.8 does not perform an ownership or authorization check before rendering booking confirmation details, allowing unauthenticated attackers to retrieve registered attendees' personal information full name, email address, phone...

PT-2026-95001

Name of the Vulnerable Software and Affected Versions SolarWinds Access Rights Manager versions prior to 2026.2.1.7 Description An unauthenticated remote code execution issue exists due to a hardcoded shared HMAC secret included in the installer that is identical across all deployments. The gRPC...

PT-2026-94866

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A race condition exists during the teardown of Display Manager DM I2C adapters. Because these adapters may remain visible to userspace while the teardown process is active, a concurrent...

PT-2026-94582

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the Network File System NFS implementation where the client fails to record a delegation granted by the server during an OPEN reply. Specifically, the nfs inode set...

CVE-2026-84397

Adobe Experience Manager is affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the...