CVE-2026-76546: Improper Neutralization of Input During Web Page Generation

The User Profile Builder WordPress plugin before 4.0.1 does not escape the output of one of its optional shortcodes, allowing users with a role as low as contributor to perform Stored Cross-Site Scripting attacks against any user viewing the affected content, including administrators. The shortco...

PT-2026-83404

Name of the Vulnerable Software and Affected Versions User Profile Builder versions prior to 4.0.1 Description The User Profile Builder WordPress plugin fails to properly restrict its front-end file upload feature. This flaw allows unauthenticated visitors to obtain privileges reserved for...

PT-2026-83432

rust-iot-platform through commit 5df942ab stores user passwords in cleartext without hashing in the user model. Attackers can read API responses from user retrieval and listing routes to obtain plaintext credentials for all accounts...

PT-2026-83403

Name of the Vulnerable Software and Affected Versions User Profile Builder WordPress plugin versions prior to 4.0.1 Description Insufficient validation of deserialized data occurs when importing a configuration file, which allows high privilege users, such as administrators, to perform PHP Object...

PT-2026-83399

Name of the Vulnerable Software and Affected Versions MStore API versions prior to 4.21.1 Description The MStore API WordPress plugin fails to verify if the order targeted by a delivery endpoint belongs to the user making the request. This allows any authenticated user, including those with...

CVE-2026-18233: Missing Authorization

The MStore API WordPress plugin before 4.21.1 does not verify that the order targeted by one of its delivery endpoints belongs to the requester, allowing any authenticated user, including Subscribers, to mark arbitrary orders as completed and paid without any payment being made...

CVE-2026-18234: Missing Authorization

The MStore API WordPress plugin before 4.21.1 does not verify that the order targeted by its wallet payment handling belongs to the requester, and does not deduct the wallet balance for most payment methods, allowing any authenticated user, including Subscribers, to mark arbitrary orders as paid...

CVE-2026-15369: Improper Privilege Management

The Custom User Registration Fields for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 2.2.3. This is due to the plugin accepting an attacker-controlled afregselectuserrole value from the unauthenticated WooCommerce Store API...

PT-2026-83416

Name of the Vulnerable Software and Affected Versions MasterStudy LMS WordPress Plugin versions prior to 3.7.43 Description An open redirect issue exists during the user registration process. The plugin fails to validate a redirect parameter before utilizing it, which allows unauthenticated...

Unity Linux 20.1070e Security Update: rpm (UTSA-2026-104949)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-104949 advisory. A flaw was found in the RPM Package Manager RPM. A local user could be affected by a heap buffer overflow vulnerability when processing a specially crafted NDB...

Freenet: Deanonymization Vulnerability

Background Freenet is an encrypted network without censorship. Description A vulnerability has been discovered in Freenet. Please review the CVE identifier referenced below for details. Impact This release fixes as an XSS vulnerability that may allow an attacker to deanonymize the user. Workaroun...

CVE-2026-18904

IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote attacker to obtain sensitive information and inject unauthorized messages due to a namespace collision between user identifiers...

CVE-2026-18904

IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote attacker to obtain sensitive information and inject unauthorized messages due to a namespace collision between user identifiers...

Graylog token revocation endpoint allows authenticated users to delete other users’ access tokens

Impact Graylog contains an insecure direct object reference IDOR vulnerability in the token revocation endpoint. An authenticated user can delete access tokens belonging to other users, including service account tokens and administrator tokens, if they know or can guess a valid token identifier...

Authorization Bypass Through User-Controlled Key

Overview org.graylog2:graylog2-server is a log management platform. Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key in the token revocation endpoint, which deletes an access token by its identifier without verifying that the token belongs to th...

GHSA-J769-9GV9-65GR Graylog token revocation endpoint allows authenticated users to delete other users’ access tokens

Impact Graylog contains an insecure direct object reference IDOR vulnerability in the token revocation endpoint. An authenticated user can delete access tokens belonging to other users, including service account tokens and administrator tokens, if they know or can guess a valid token identifier...

CVE-2026-55867 Graylog token revocation endpoint allows authenticated users to delete other users’ access tokens

Graylog is a free and open log management platform. From 6.2.0 until 6.3.12, 7.0.7, and 7.1.2, the DELETE /users/userId/tokens/idOrToken endpoint implemented by UsersResource.revokeToken in graylog2-server/src/main/java/org/graylog2/rest/resources/users/UsersResource.java checks USERSTOKENREMOVE...

CVE-2026-55867 Graylog token revocation endpoint allows authenticated users to delete other users’ access tokens

Graylog is a free and open log management platform. From 6.2.0 until 6.3.12, 7.0.7, and 7.1.2, the DELETE /users/userId/tokens/idOrToken endpoint implemented by UsersResource.revokeToken in graylog2-server/src/main/java/org/graylog2/rest/resources/users/UsersResource.java checks USERSTOKENREMOVE...

GHSA-F2XF-7X3G-4272 PrivateBin has stored Cross-Side-Scripting (XSS) vulnerability in attachment download link via dangerous MIME types with required user-interaction

Summary Stored cross-site scripting XSS in PrivateBin's attachment download link. An anonymous attacker can create a paste with a text/html attachment that, with certain user interaction, bypasses protections similar to CVE-2022-24833. When a victim opens the "Download attachment" link in a new...

CVE-2026-55696 PrivateBin: Stored Cross-Side-Scripting (XSS) vulnerability in attachment download link via dangerous MIME types with required user-interaction

PrivateBin is an online pastebin where the server has zero knowledge of pasted data. Prior to 2.0.5, AttachmentViewer.setAttachment in js/privatebin.js uses getAttachmentMimeType to accept attacker-controlled MIME types and uses getBlobUrl to create a same-origin blob before setting...