PT-2026-63860

Unauthenticated Broken Access Control in WPDM – Premium Packages = 6.2.0 versions...

PT-2026-63884

Administrator SQL Injection in Uncanny Automator = 7.3.2 versions...

TencentOS Server 2: pam (TSSA-2025:1033)

The version of Tencent Linux installed on the remote TencentOS Server 2 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2025:1033 advisory. Package updates are available for TencentOS Server 2 that fix the following vulnerabilities:...

Oracle Linux 10 : .NET / 8.0 (ELSA-2026-21286)

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-21286 advisory. 8.0.128-1.0.1 - Add support for Oracle Linux 8.0.128-1 - Update to .NET SDK 8.0.128 and Runtime 8.0.28 - Resolves: RHEL-181056 8.0.127-1 - Update to...

PT-2026-63906

Unauthenticated Broken Access Control in Content Control = 2.6.5 versions...

PT-2026-63952

Shop Manager Cross Site Scripting XSS in Tabs = 2.5 versions...

PT-2026-63898

Contributor Local File Inclusion in Tonda Core = 2.1.2 versions...

PT-2026-63936

Unauthenticated Broken Access Control in Civi Framework = 2.2.0 versions...

PT-2026-63943

Shop manager SQL Injection in Persian Woocommerce SMS = 7.2.2 versions...

PT-2026-63944

Contributor Cross Site Scripting XSS in Smart SEO Tool = 4.1.2 versions...

TencentOS Server 2: freerdp (TSSA-2026:0754)

The version of Tencent Linux installed on the remote TencentOS Server 2 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0754 advisory. Package updates are available for TencentOS Server 2 that fix the following vulnerabilities...

CVE-2026-60368

Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware component: Centralized Thirdparty Jars. Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via SOAP to...

GHSA-7P3P-8QV8-M2VH Eclipse Jetty: HTTP Authority/Host mismatch

Summary Jetty currently accepts HTTP/2 and HTTP/3 requests where the regular Host header and the pseudo-header :authority do not match. As a result, the same request can carry two different host identities through Jetty: - logic based on HttpURI / Request.getServerNamerequest uses :authority -...

n8n: Improper Authorization Allows Authenticated Users to Assign Workflows to Folders in Other Projects

Impact An authenticated user with permission to create workflows in one project could bypass project/folder authorization boundaries during workflow creation. By supplying a crafted request payload, the user could associate a newly created workflow with a folder belonging to a different project...

CVE-2026-60455

...

CVE-2026-60371

CVE-2026-60371 affects Oracle Platform Security for Java (Fusion Middleware), specifically the Centralized Thirdparty Jars component. Affected versions are 12.2.1.4.0 and 14.1.2.0.0. The issue is described as difficult to exploit, requiring low privileges and access to the hardware’s physical com...

CVE-2026-14881

creationtimestamp| type| source ---|---|--- 2026-07-22 20:55:47+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mrb7ilrmpy2q 2026-07-22 21:00:18+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mrb7qnhc6z2f 2026-07-24 04:46:08+00:00| seen|...

CVE-2026-13072

creationtimestamp| type| source ---|---|--- 2026-07-22 20:50:47+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mrb77namiq27 2026-07-22 21:00:31+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mrb7r2ehvw2g 2026-07-24 04:45:50+00:00| seen|...

WordPress Registrations for the Events Calendar – Event Registration Plugin plugin <= 3.2 - Authenticated (Contributor+) SQL Injection vulnerability

Authenticated Contributor+ SQL Injection vulnerability discovered by Wordfence PRISM in WordPress Plugin Registrations for the Events Calendar versions = 3.2...

WordPress Header Footer Script Adder plugin <= 2.1 - Authenticated (Author+) Stored Cross-Site Scripting vulnerability

Authenticated Author+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin Header Footer Script Adder versions = 2.1...