PT-2026-89772

The teddy-bear-customize-addon WordPress plugin through 1.0.5 does not verify a user's password before authenticating them, allowing unauthenticated attackers to log in as any registered user, including administrators, by supplying only that user's email address...

PT-2026-89767

Name of the Vulnerable Software and Affected Versions multicluster-observability-addon affected versions not specified Description A cross-namespace authorization flaw exists in the multicluster-observability-addon. A user with permissions to modify the ManagedClusterAddOn configuration of a...

CVE-2026-14559: Improper Authentication

The teddy-bear-customize-addon WordPress plugin through 1.0.5 does not verify a user's password before authenticating them, allowing unauthenticated attackers to log in as any registered user, including administrators, by supplying only that user's email address...

PT-2026-89773

Name of the Vulnerable Software and Affected Versions teddy-bear-customize-addon WordPress plugin versions prior to 1.0.6 Description The plugin fails to properly validate uploaded files by relying on a client-supplied content type and preserving the original filename. This allows unauthenticated...

PT-2026-89774

The teddy-bear-customize-addon WordPress plugin through 1.0.5 does not perform any authorization or ownership checks before returning WooCommerce order metadata and the URLs of customer-uploaded attachments, allowing unauthenticated attackers to disclose other customers' order and attachment data...

CVE-2026-81300

Unauthenticated Cross Site Scripting XSS in Calculation For Contact Form 7 = 1.0 versions...

PT-2026-85260

A vulnerability has been found in D-Link DNS-340L 1.01B04. Affected by this vulnerability is an unknown functionality of the file /cgi-bin/addon center.cgi of the component Add-On Center. Such manipulation of the argument f name/f url/f flag/f login user leads to os command injection. It is...

PT-2026-85124

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WPKoi WordPress Themes WPKoi Templates for Elementor allows DOM-Based XSS. This issue affects WPKoi Templates for Elementor: from n/a through 3.7.2...

Critical cPanel Flaw Could Let One Hosting Customer Take Root Control of a Whole Server

cPanel has released patches for a security flaw affecting domain parking and addon domain functionality in cPanel and WebHost Manager WHM, which could allow code execution as the root user. The vulnerability, assigned the CVE identifier CVE-2026-65643 , impacts all supported versions of cPanel &...

WordPress Royal Addons for Elementor plugin < 1.7.1066 - Contributor+ Stored XSS vulnerability

Contributor+ Stored XSS vulnerability discovered by Erwan LR WPScan in WordPress Plugin Royal Elementor Addons versions 1.7.1066...

CVE-2026-75971: Improper Privilege Management

The ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.9.4. This is due to the rumimporter function being registered on the WordPress core importstart action hook with ...

PT-2026-80834

Unauthenticated Arbitrary File Deletion in ShopBuilder Pro – Elementor WooCommerce Builder Addons = 2.2.0 versions...

CVE-2026-63004

Unleash is an open-source feature management platform. Prior to 7.5.2, 7.6.5, and 8.0.2, the addon and integration subsystem passes the operator-controlled parameters.url value from src/lib/addons/webhook.ts and the Slack, Microsoft Teams, Datadog, and New Relic integrations to Addon.fetchRetry i...

EUVD-2026-64040

Unleash is an open-source feature management platform. Prior to 7.5.2, 7.6.5, and 8.0.2, the addon and integration subsystem passes the operator-controlled parameters.url value from src/lib/addons/webhook.ts and the Slack, Microsoft Teams, Datadog, and New Relic integrations to Addon.fetchRetry i...

CVE-2026-63004

Unleash , an open-source feature management platform, is vulnerable to Server-Side Request Forgery (SSRF) in its addon and integration subsystem. The operator-controlled parameters.url value from src/lib/addons/webhook.ts and the Slack, Microsoft Teams, Datadog, and New Relic integrations is pass...

CVE-2026-63004 Unleash: Addon webhook URL is dialed server-side with no internal-address filtering, enabling SSRF to internal services / cloud metadata and exfiltration of configured request headers

Unleash is an open-source feature management platform. Prior to 7.5.2, 7.6.5, and 8.0.2, the addon and integration subsystem passes the operator-controlled parameters.url value from src/lib/addons/webhook.ts and the Slack, Microsoft Teams, Datadog, and New Relic integrations to Addon.fetchRetry i...

CVE-2026-63004 Unleash: Addon webhook URL is dialed server-side with no internal-address filtering, enabling SSRF to internal services / cloud metadata and exfiltration of configured request headers

Unleash is an open-source feature management platform. Prior to 7.5.2, 7.6.5, and 8.0.2, the addon and integration subsystem passes the operator-controlled parameters.url value from src/lib/addons/webhook.ts and the Slack, Microsoft Teams, Datadog, and New Relic integrations to Addon.fetchRetry i...

CVE-2026-63004 Unleash: Addon webhook URL is dialed server-side with no internal-address filtering, enabling SSRF to internal services / cloud metadata and exfiltration of configured request headers

Unleash is an open-source feature management platform. Prior to 7.5.2, 7.6.5, and 8.0.2, the addon and integration subsystem passes the operator-controlled parameters.url value from src/lib/addons/webhook.ts and the Slack, Microsoft Teams, Datadog, and New Relic integrations to Addon.fetchRetry i...

CVE-2026-63004: Server-Side Request Forgery (SSRF)

Unleash is an open-source feature management platform. Prior to 7.5.2, 7.6.5, and 8.0.2, the addon and integration subsystem passes the operator-controlled parameters.url value from src/lib/addons/webhook.ts and the Slack, Microsoft Teams, Datadog, and New Relic integrations to Addon.fetchRetry i...

PT-2026-79421

Unleash is an open-source feature management platform. Prior to 7.5.2, 7.6.5, and 8.0.2, the addon and integration subsystem passes the operator-controlled parameters.url value from src/lib/addons/webhook.ts and the Slack, Microsoft Teams, Datadog, and New Relic integrations to Addon.fetchRetry i...