PT-2026-134187

Name of the Vulnerable Software and Affected Versions Arc versions prior to 26.06.2 Description An authorization bypass exists that allows cross-database access through DuckDB table-valued I/O functions. In internal/api/query.go, the extractTableReferences function skips names followed by an...

PT-2026-133721

The Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.4.1 via the legacy render function. This is due to broken authorization on the Lightroom gallery edit endpoint combined with mass...

PT-2026-134415

Summary This vulnerability is a patch bypass that exploits catastrophic backtracking in a regular expression used to filter ATTACH statements in AdminNeo's SQLite functionality. The original vulnerability CVE-2021-43008 allowed authenticated users to create PHP files through SQLite ATTACH...

CVE-2026-16760: trailofbits fickling: In Trail of Bits fickling through 0.1.12, the _process_import() method in fickle.py adds an imported name to the…

In Trail of Bits fickling through 0.1.12, the processimport method in fickle.py adds an imported name to the likelysafeimports set whenever the source module is present in sys.stdlibmodulenames and the name is absent from the UNSAFEIMPORTS denylist, without inspecting what the name resolves to or...

Gravity Forms deserialization injection vulnerability

Gravity Forms versions 3.1.2 and earlier contain a deserialization injection vulnerability. This vulnerability arises because GFFormsModel::createpost passes submission values to WordPress’s global maybeunserialize function instead of using the plugin-validated GFCommon::maybeunserialize. As a...

CVE-2026-73322: Apache Software Foundation Apache Pinot: Incorrect Authorization vulnerability in the single-stage query engine of Apache Pinot

Incorrect Authorization vulnerability in the single-stage query engine of Apache Pinot. When broker access control is enabled, the single-stage query engine authorizes only the table named in the query's FROM clause. The lookup transform function identifies its dimension table with a string liter...

PT-2026-134442

Name of the Vulnerable Software and Affected Versions PDF Invoice for WooCommerce + Drag and Drop Template Builder versions prior to 7.1.2 Description PHP Object Injection occurs due to insufficient sanitization of the customer note parameter. The input is inlined into invoice HTML, entity-decode...

PT-2026-134171

Name of the Vulnerable Software and Affected Versions PinePods versions prior to 0.9.0 Description An authenticated user can trigger server-side requests to internal loopback, private-network, and cloud metadata services. This occurs when the system processes an attacker-controlled RSS feed via t...

PT-2026-133506

Name of the Vulnerable Software and Affected Versions vsftpd versions prior to 3.0.6 Description An authentication bypass exists in the ssl data accept function. Unauthenticated attackers who share the same source IP address as a victim can hijack FTPS data connections by resuming their own TLS...

FlowiseAI Flowise permission and access control issue vulnerability

FlowiseAI Flowise versions 3.1.4 and earlier contain a vulnerability related to permission escalation and access control. This vulnerability stems from a sandbox escape issue: attackers can submit JavaScript to /api/v1/node-custom-function, then write files to the mammoth package via LocalFileSto...

Chamilo 3 deserialization injection vulnerability

Versions prior to Chamilo 3 2.0.1 contain a deserialization injection vulnerability. This vulnerability arises because public/main/inc/lib/career.lib.php and public/main/cron/importcsv.php fail to utilize the allowedclasses: false security option when invoking PHP’s native unserialize function on...

WordPress Page and Post Restriction authorization issue vulnerability

WordPress Page and Post Restriction versions 1.6.1 and earlier contain an authorization vulnerability. This vulnerability arises because the paprrestrictpagepostrestapi function fails to validate a REST nonce when processing GET or HEAD REST requests. It then re-authenticates the current user via...

AlmaLinux 9.2 [TuxCare] Security Update: ansible-core / ansible-test (ALMALINUX9.2:CLSA-2026:1793373763)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1793373763 advisory. - A flaw was found in ansible-core. The extractcollectionfromgit function in ansible-core's concreteartifactmanager.py constructs git clone...

SQLite buffer error vulnerability

Versions of SQLite prior to 3.54.0 contain a buffer error vulnerability. This vulnerability stems from a heap buffer overflow in the sqlite3changesetapply function within the session extension. By providing a specially crafted changeset, attackers can repeat table names and increase the number of...

PT-2026-133788

Name of the Vulnerable Software and Affected Versions Pistache versions 0.0.5 through 0.4.26 Description The SegmentTreeNode::sanitizeResource function in src/server/router.cc uses std::regex replace with the //+ expression to collapse consecutive slashes. When using libstdc++, a path containing...

WordPress Essential Addons for Elementor permission and access control issue vulnerability

WordPress Essential Addons for Elementor versions 6.8.7 and earlier contain a permission and access control vulnerability. This flaw stems from improper handling of the pageid parameter in the registeruser function. The post state rejection list accepts the inherit state carried by modified...

PT-2026-134227

Name of the Vulnerable Software and Affected Versions LightSAML versions prior to 4.7.1 LightSAML versions prior to 5.0.1 Description LightSAML and xmlseclibs have a discrepancy regarding which assertion an inbound SAML signature covers. The Response::deserialize function uses manyElementsFromXml...

CVE-2026-115346: ThemeFusion Avada | Website Builder For WordPress & WooCommerce: The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to Arbitrary File Upload in…

The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to Arbitrary File Upload in versions up to, and including, 7.16.2 via the convertpaletteimagestotruecolor function. This is due to insufficient file type validation before processing uploaded files. This mak...

CVE-2026-63377: fctr-id okta-ai-agent: TAKO AI Agent for Okta is a local-first AI agent that helps Okta administrators query tenant data using natural language

TAKO AI Agent for Okta is a local-first AI agent that helps Okta administrators query tenant data using natural language. Prior to 3.0.1-beta, POST /api/auth/setup in src/api/routers/auth.py allows an unauthenticated network attacker to create the first administrator account before the legitimate...

PT-2026-134410

Summary AdminNeo's CSRF protection uses a BREACH-resistant XOR masking scheme, but the implementation transmits both the XOR mask and the masked value in every token. This allows any observer who sees a single CSRF token via network sniffing, log files, Referrer header, or XSS to instantly recove...