CVE-2026-10726: Improper Certificate Validation

Cato Windows SDP Client before version 6.12.6 contains an arbitrary file disclosure vulnerability. A low-privileged local user can cause the Windows service, running as Local System, to read and disclose arbitrary local files due to improper file path validation and missing TLS certificate...

CVE-2026-96886: Exposure of Sensitive Information to an Unauthorized Actor

The Course Booking System WordPress plugin before 7.0.9 does not restrict access to its booking export, allowing unauthenticated users to download the name, email address and billing address of every customer who has booked a course...

CVE-2026-102913: Improper Neutralization of Special Elements used in an SQL Command

A security flaw has been discovered in SourceCodester Car Driving School Management System 1.0. Impacted is an unknown function of the file /classes/Master.php?f=saveenrollment. The manipulation results in sql injection. The attack can be executed remotely. The exploit has been released to the...

CVE-2026-102912: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was identified in SourceCodester Online Leave Management System 1.0. This issue affects some unknown processing of the file /admin/?page=reports. The manipulation of the argument datestart/dateend leads to sql injection. Remote exploitation of the attack is possible. The exploit i...

CVE-2026-102910: Improper Neutralization of Special Elements used in an SQL Command

A security flaw has been discovered in SourceCodester Online Reviewer Management System 1.0. The affected element is an unknown function of the file /reviewer0/admins/assessments/examproper/exam-delete.php. The manipulation of the argument testid results in sql injection. The attack can be launch...

CVE-2026-102909: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was identified in SourceCodester Online Reviewer Management System 1.0. Impacted is an unknown function of the file /reviewer0/admins/assessments/examproper/btnfunctions.php. The manipulation of the argument accesscode leads to sql injection. The attack can be initiated remotely...

CVE-2026-102908: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was determined in SourceCodester Online Reviewer Management System 1.0. This issue affects some unknown processing of the file /reviewer0/admins/assessments/examproper/questions-view.php. Executing a manipulation of the argument ID can lead to sql injection. It is possible to laun...

CVE-2026-103056: Improper Neutralization of Special Elements used in an OS Command

AiSOC versions 7.2.0 before 12.0.0 contain a command injection vulnerability in the actions service that builds CrowdStrike Real Time Response command strings by interpolating unescaped action parameters in crowdstrikertr.py and endpoint.py. Authenticated users can inject single quotes into...

CVE-2026-103587: Improper Neutralization of Input During Web Page Generation

QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in the back-office Hotel Reservation System Book Now search, where dateto and idroomtype parameters are copied into template variables without validation. Attackers can craft a malicious link containing JavaScript paylo...

PT-2026-103329

A vulnerability was found in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. This issue affects the function mysqli query of the file admin/delete1.php of the component Unauthenticated Action Script. Performing a manipulation of the argument ID results ...

PT-2026-103124

Name of the Vulnerable Software and Affected Versions Cato Networks SDP Client for Windows versions prior to 6.12.6 Description A local privilege escalation issue exists due to improper validation of a client-supplied Security Identifier SID over a local Inter-Process Communication IPC named pipe...

PT-2026-103047

The Course Booking System WordPress plugin before 7.0.9 does not restrict access to its booking export, allowing unauthenticated users to download the name, email address and billing address of every customer who has booked a course...

PT-2026-103348

🚨 CVE-2026-103231 A vulnerability was identified in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. The affected element is the function mysqli query of the file User/cancel.php of the component Order Cancellation. The manipulation of the argument ID...

PT-2026-103014

A security flaw has been discovered in SourceCodester Online Reviewer Management System 1.0. The affected element is an unknown function of the file /reviewer 0/admins/assessments/examproper/exam-delete.php. The manipulation of the argument test id results in sql injection. The attack can be...

PT-2026-103018

A vulnerability was identified in SourceCodester Online Leave Management System 1.0. This issue affects some unknown processing of the file /admin/?page=reports. The manipulation of the argument date start/date end leads to sql injection. Remote exploitation of the attack is possible. The exploit...

PT-2026-103009

A vulnerability was identified in SourceCodester Online Reviewer Management System 1.0. Impacted is an unknown function of the file /reviewer 0/admins/assessments/examproper/btn functions.php. The manipulation of the argument access code leads to sql injection. The attack can be initiated remotel...

PT-2026-103019

A security flaw has been discovered in SourceCodester Car Driving School Management System 1.0. Impacted is an unknown function of the file /classes/Master.php?f=save enrollment. The manipulation results in sql injection. The attack can be executed remotely. The exploit has been released to the...

PT-2026-103008

A vulnerability was determined in SourceCodester Online Reviewer Management System 1.0. This issue affects some unknown processing of the file /reviewer 0/admins/assessments/examproper/questions-view.php. Executing a manipulation of the argument ID can lead to sql injection. It is possible to...

PT-2026-103553

Name of the Vulnerable Software and Affected Versions Kiteworks affected versions not specified Description A privilege escalation issue exists in clustered deployments where an attacker with existing code execution on one node can execute operating system commands with elevated privileges on...

PT-2026-103565

Name of the Vulnerable Software and Affected Versions Kiteworks Core affected versions not specified Description An administrative import function fails to verify if the requesting administrator has the necessary permissions to create the privileged integration credential being imported. This...