PT-2026-90526

Name of the Vulnerable Software and Affected Versions The product name cannot be determined. affected versions not specified Description The administrative password is hashed using a weak, fast algorithm for the credential store of one authentication path. Additionally, the file containing this...

PT-2026-96358

In the Linux kernel, the following vulnerability has been resolved: zram: fix out-of-bounds access in writeback store Patch series "zram: fix stale scan bounds after reinitialization". Both writeback store and read block state derive their table scan bounds from zram-disksize before acquiring dev...

PT-2026-96498

In the Linux kernel, the following vulnerability has been resolved: platform/x86: hp-bioscfg: fix heap OOB read in sk store and kek store sk store and kek store strip a trailing newline from the sysfs write before allocating the key buffer: length = count; if buflength - 1 == ' ' length--; bioscf...

PT-2026-90518

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description When a specific authentication mode is configured, the reverse proxy forwards requests for a bundled third-party administrative interface directly to that...

CVE-2026-90446: Server-Side Request Forgery (SSRF)

An application programming interface endpoint accepts a user-supplied value and interpolates it directly into the path of a backend request to the underlying search and analytics data store, without restricting its contents. This allows an authenticated attacker to substitute an arbitrary backend...

Linux Distros Unpatched Vulnerability : CVE-2026-88046

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.1, rclone core does not reject...

oss-oopssec-store v2.20.0

OSS - OopsSec Store Security training for the apps you actually ship. 36 challenges across web, API, authentication, business logic, cryptography, supply chain, AI agents and MCP. Break a deliberately vulnerable e-commerce app built on Next.js, React, TypeScript and Prisma. Find the bugs. Exploit...

Improper Authentication

Spring Security is vulnerable to Improper Authentication. The vulnerability is due to user verification state not being properly maintained with a distributed HTTP session store, allowing an attacker to bypass WebAuthn user verification...

CVE-2026-19436

The Ultimate Gift Cards for WooCommerce WordPress plugin before 3.2.10 does not reconcile the value of the gift card coupon it issues against the amount actually collected at checkout, allowing unauthenticated users to obtain store credit worth more than they paid...

EUVD-2026-75260

The Ultimate Gift Cards for WooCommerce WordPress plugin before 3.2.10 does not reconcile the value of the gift card coupon it issues against the amount actually collected at checkout, allowing unauthenticated users to obtain store credit worth more than they paid...

CVE-2026-19436

The Ultimate Gift Cards for WooCommerce WordPress plugin (versions before 3.2.10 ) contains a vulnerability where it fails to reconcile the issued gift card coupon value against the actual amount collected at checkout. This flaw allows unauthenticated users to perform a Gift Card Value Inflation ...

PT-2026-89288

The Ultimate Gift Cards for WooCommerce WordPress plugin before 3.2.10 does not reconcile the value of the gift card coupon it issues against the amount actually collected at checkout, allowing unauthenticated users to obtain store credit worth more than they paid...

CVE-2026-19436: Improper Access Control

The Ultimate Gift Cards for WooCommerce WordPress plugin before 3.2.10 does not reconcile the value of the gift card coupon it issues against the amount actually collected at checkout, allowing unauthenticated users to obtain store credit worth more than they paid...

Unchecked Return Value

Overview snipe/snipe-it is an asset management system built on Laravel. Affected versions of this package are vulnerable to Unchecked Return Value in the store process. An attacker can cause acceptance records to be finalized without supporting evidence files by completing an acceptance while the...

WordPress Shopping Cart & eCommerce Store plugin <= 5.9.3 - Authenticated (Store Manager+) Privilege Escalation to ec_ajax_save_page_default_options AJAX Action vulnerability

Authenticated Store Manager+ Privilege Escalation to ecajaxsavepagedefaultoptions AJAX Action vulnerability discovered by Wordfence PRISM in WordPress Plugin WP EasyCart versions = 5.9.3...

EUVD-2026-74600

The WP EasyCart plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 5.9.3. This is due to the ecajaxsavepagedefaultoptions AJAX handler iterating over every $POST key and passing it directly into updateoption without any allowlist, while gating the handler...

CVE-2026-17553 Shopping Cart & eCommerce Store <= 5.9.3 - Authenticated (Store Manager+) Privilege Escalation to ec_ajax_save_page_default_options AJAX Action

The WP EasyCart plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 5.9.3. This is due to the ecajaxsavepagedefaultoptions AJAX handler iterating over every $POST key and passing it directly into updateoption without any allowlist, while gating the handler...

CVE-2026-17553

The WP EasyCart plugin for WordPress is vulnerable to privilege escalation in versions up to and including 5.9.3 . The ec_ajax_save_page_default_options() AJAX handler iterates over every $_POST key and passes it directly into update_option() without an allowlist. Access is gated on the manage_op...

PT-2026-88789

The WP EasyCart plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 5.9.3. This is due to the ec ajax save page default options AJAX handler iterating over every $ POST key and passing it directly into update option without any allowlist, while gating the...

Kibana 9.4.x < 9.4.6 / 9.5.x < 9.5.1 Incorrect Authorization (ESA-2026-122)

The version of Kibana installed on the remote host is 9.4.x prior to 9.4.6, or 9.5.x prior to 9.5.1. It is, therefore, affected by a vulnerability as referenced in the ESA-2026-122 advisory. - Incorrect Authorization CWE-863 in Kibana can lead to unauthorized modification of data via Accessing...