PT-2026-49434

Unauthenticated SQL Injection in wpForo Forum = 3.0.4 versions...

PT-2026-49422

Unauthenticated Broken Authentication in ReviewX = 2.3.6 versions...

PT-2026-49358

Unauthenticated PHP Object Injection in Broadcast Live Video 7.1.3 versions...

PT-2026-49392

Unauthenticated Cross Site Scripting XSS in Paid Member Subscriptions = 2.17.3 versions...

PT-2026-49394

Subscriber Insecure Direct Object References IDOR in EventPrime = 4.3.0.0 versions...

PT-2026-49377

Name of the Vulnerable Software and Affected Versions ShortPixel Image Optimizer versions prior to 6.4.4 Description PHP Object Injection occurs in the software. This issue allows an attacker to inject malicious objects into the application, which can lead to unauthorized code execution or other...

ROS-20260615-73-0042

The vulnerability of the persistentcachereadentryv3 function in the RDP client FreeRDP is related to buffer overflow in dynamic memory. Exploiting this vulnerability could allow an attacker to compromise the integrity and accessibility of protected information...

python311-tornado6-6.5.7-1.1 on GA media (moderate)

python311-tornado6-6.5.7-1.1 on GA media Announcement ID: openSUSE-SU-2026:11027-1 Rating: moderate Cross-References: CVE-2026-49853 CVE-2026-49854 CVE-2026-49855 Affected Products: openSUSE Tumbleweed An update that solves 3 vulnerabilities can now be installed. Description: These are all securi...

CVE-2026-50869

An issue in the api/plugin.php component of Bludit v3.19.0 allows attackers to execute a directory traversal via supplying a crafted request...

PT-2026-49479

Unauthenticated Cross Site Scripting XSS in MW WP Form = 5.1.3 versions...

PT-2026-49442

Unauthenticated Broken Access Control in Classified Listing = 5.3.8 versions...

PT-2026-49467

Unauthenticated Other Vulnerability Type in WpEvently = 5.3.3 versions...

PT-2026-49449

Unauthenticated Cross Site Scripting XSS in Classified Listing = 5.3.8 versions...

PT-2026-49351

Unauthenticated Cross Site Scripting XSS in Okay Toolkit = 2.3 versions...

PT-2026-49407

Unauthenticated Cross Site Scripting XSS in Notification for Telegram = 3.5 versions...

PT-2026-49518

Unauthenticated SQL Injection in eCommerce Product Catalog = 3.5.5 versions...

PT-2026-49488

Unauthenticated Broken Access Control in WPC Product Bundles for WooCommerce = 8.5.3 versions...

PT-2026-49441

Unauthenticated SQL Injection in GD Rating System = 3.6.2 versions...

PT-2026-49445

Subscriber Broken Access Control in Classified Listing = 5.3.9 versions...

PT-2026-49288

Name of the Vulnerable Software and Affected Versions OpenSIPS Control Panel versions prior to 9.3.3 Description A Time-Based Blind SQL Injection in the alias management module allows authenticated attackers to execute arbitrary SQL commands. This occurs via the 'table' GET parameter in the 'alia...