PT-2026-76684

Name of the Vulnerable Software and Affected Versions new-api versions prior to 1.0.0-rc.7 Description An information disclosure issue exists in the admin user list and user lookup APIs, specifically the 'GET /api/user/' endpoint. The system serializes User.AccessToken as access token because use...

CVE-2026-18653 WP Directory Kit < 1.5.7 - Admin+ SQL Injection via section Parameter

The WP Directory Kit WordPress plugin before 1.5.7 does not sanitise and escape a parameter before using it in a SQL statement, allowing administrators to perform SQL injection attacks. On a multisite installation this lets an administrator of a single site read data belonging to the entire...

CVE-2026-17582

The Slider Hero plugin for WordPress is vulnerable to second-order SQL Injection in versions up to, and including, 9.1.7 via the qcldsliderheroduplicate function. Slide data description, title, btn, btn2, imagelink, custom, etc. is stored safely via $wpdb-update with %s placeholders in the...

Zyxel USG FLEX 50(W) / USG20(W)-VPN 4.16 < 5.43 / ATP 4.32 < 5.43 / USG FLEX 4.50 < 5.43 Path Traversal

The firmware version of the Zyxel ZLD firewall device is affected by a path traversal vulnerability. A path traversal vulnerability in the CLI command used to execute configuration files in Zyxel ATP series firmware versions from V4.32 through V5.42 Patch 1, USG FLEX series firmware versions from...

CVE-2026-73481 phpList < 3.7.0-RC5 Cross-Site Request Forgery via Bounce Rules

phpList before 3.7.0-RC5 fail to enforce CSRF token validation on the bounce rule deletion endpoint bouncerules.php / bouncerule.php. The deletion is performed via a GET request ?page=bouncerules&del=N, and the central CSRF check verifyCsrfGetToken is invoked with enforce=false, so it only...

CVE-2026-73330

CamaleonCMS 2.9.1 contains a server-side template injection vulnerability that allows authenticated administrators to execute arbitrary commands by embedding ERB tags in the email parameter of the testemail settings action, which are evaluated when an SMTP rejection reflects the recipient address...

CVE-2026-72793

SiYuan before v3.7.4 exposes sensitive configuration data via /api/system/getConf. The root cause is failure to mask fields such as the session-cookie signing key, OS username (via pandoc path), and encrypted-notebook key material, enabling anonymous or publish-reader users to access these secret...

CVE-2026-47228

Admidio is an open-source user management solution. modules/registration.php mode sendlogin regenerates a random password for useruuidassigned, stores its bcrypt hash in admusers.usrpassword, and emails the cleartext to that user. Every other state-changing mode in the same file assignmember,...

CVE-2026-73069 Twenty: SQL Injection in the `searchVector` Field Settings Allows Arbitrary PostgreSQL Execution

Twenty is an open-source CRM customer relationship management platform. Prior to 2.15.0, Twenty allowed a workspace administrator with the DATAMODEL permission to supply settings.asExpression for the system TSVECTOR field searchVector through PATCH /rest/metadata/fields/:id or the updateOneField...

CVE-2026-72881

Dokploy (PaaS) is affected before 0.29.13 by a command injection in the backup/restore code paths. The vulnerable components are database backup and restore command builders in packages/server/src/utils/backups/utils.ts and packages/server/src/utils/restore/utils.ts, which interpolate database na...

CVE-2026-68127

CVE-2026-68127 describes a Linux kernel flaw in the Identifier-Locator Addressing (ILA) subsystem where a slab-use-after-free can occur during IPv6 packet processing if a transport-header-based path is used. Specifically, ila_csum_adjust_transport() caches ip6h before pskb_may_pull(), and non-lin...

CVE-2026-13701 Advanced Excerpt < 4.5 - Admin+ Stored XSS via Ellipsis Setting

The Advanced Excerpt WordPress plugin before 4.5 does not sanitise and escape one of its settings before outputting it on the front end of the site, which could allow administrators including those without the unfilteredhtml capability, such as on multisite to perform Stored Cross-Site Scripting...

CVE-2026-18933

The wp-downloadmanager plugin (v1.68.11, also affecting the 6.9.4 line) allows an admin user to upload arbitrary files via download-add.php without any extension/MIME validation or traversal protection. The destination path is built from unsanitized $_POST['file_upload_to'], and since the base pa...

CVE-2026-70620

Odysseus SSRF via embedding endpoint configuration: a vulnerability in Odysseus before commit 87babb5 allows an admin-privileged attacker to direct the server to probe internal resources by supplying arbitrary URLs to the embedding endpoint configuration without proper URL validation. The issue e...

PT-2026-67885

Name of the Vulnerable Software and Affected Versions Ghost versions 1.20.1 through 6.54.0 Description An Administrator-level user can remotely overwrite specific files on the filesystem, which may result in integrity and availability issues. This occurs because the database export endpoint does...

JFrog Artifactory 7.146.x < 7.146.34 / 7.161.x < 7.161.15 Multiple Vulnerabilities

According to its self-reported version number, the version of JFrog Artifactory installed on the remote host is affected by multiple vulnerabilities: - An authenticated privilege-escalation vulnerability in JFrog Platform may be exploited under admin-provisioned account conditions. Successful...

CVE-2026-64137 smb: client: require net admin for CIFS SWN netlink

In the Linux kernel, the following vulnerability has been resolved: smb: client: require net admin for CIFS SWN netlink CIFSGENLCMDSWNNOTIFY is the userspace witness-notify command. The intended sender is the cifs.witness helper, but the generic-netlink operation currently has no capability flag,...

Improper Authorization

FlaskBB is vulnerable to Improper Authorization. The vulnerability is due to a type mismatch in the bulk group deletion protection check, where integer group IDs are incorrectly compared against string values, allowing authenticated administrators to delete built-in authorization groups and...

CVE-2026-59190 Grav Admin Plugin — IDOR Privilege Escalation via saveUser()

grav-plugin-admin is an HTML user interface that provides a way to configure Grav and create and modify pages. In 1.10.52 and earlier, an authenticated attacker with admin.users permission can change the password of any user account, including the super administrator, by sending a direct POST...

CVE-2026-59721 Hoppscotch: Admin RCE via MAILER_SMTP_URL nodemailer sendmail-transport injection

Hoppscotch is an open source API development ecosystem. Prior to 2026.6.0, the updateInfraConfigs GraphQL mutation in admin/infra.resolver.ts accepts an attacker-controlled MAILERSMTPURL value, and validateSMTPUrl in utils.ts permits path, query, or fragment content that nodemailer parses into...