PT-2026-95156

Name of the Vulnerable Software and Affected Versions CubeCart versions prior to 6.7.5 Description An authorization bypass exists in the GDPR tools located in the admin/sources/customers.gdpr.inc.php file. The system relies on page-level CC PERM READ access and fails to require CC PERM DELETE for...

CVE-2026-54507: Server-Side Request Forgery (SSRF)

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.5, the oEmbedProxy handler in admin/controller/editor/editor.php accepts an attacker-controlled url parameter and passes it to getUrl, while validateUrl in system/functions.php...

PT-2026-94406

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the network scheduler where the qdisc get stab function accepts a user-supplied size table. The qdisc calculate pkt len function can amplify the qdisc pkt len value...

PT-2026-95051

Stored XSS in the Admin Dashboard via unsafe HTML-stripping innerHTML of entity descriptions Package: @vendure/dashboard vendure-ecommerce/vendure, latest master · Summary The dashboard's RichTextDescriptionCell "strips HTML" from an entity's description by assigning it to a live element's...

PT-2026-94137

Name of the Vulnerable Software and Affected Versions All-in-One WP Migration and Backup versions prior to 7.111 Description The plugin contains an issue related to insufficient credential protection. The Ai1wm Main Controller::init function, which is registered on the admin init hook and execute...

PT-2026-95153

Name of the Vulnerable Software and Affected Versions CubeCart versions prior to 6.7.5 Description An issue exists where the file 'admin/sources/products.index.inc.php' reads rich-text fields from the $GLOBALS'RAW''POST' variable and only removes script elements before storing and rendering them...

PT-2026-95151

Name of the Vulnerable Software and Affected Versions CubeCart versions prior to 6.7.5 Description An authenticated administrator without order modification privileges can delete order-history notes, which removes operational records and audit-trail data. This occurs because the delete-note handl...

PT-2026-95103

Name of the Vulnerable Software and Affected Versions Speakr versions prior to 0.8.21-alpha Description An issue exists where the csrf exempt for api tokens before request hook in src/app.py calls csrf.exemptview func, which permanently adds the selected view to the process-global exemption set o...

PT-2026-95155

Name of the Vulnerable Software and Affected Versions CubeCart versions prior to 6.7.5 Description An issue exists in the ecommerce software where the endpoint 'admin/sources/settings.index.inc.php' directly concatenates the download expire POST parameter into a raw UPDATE statement for CubeCart...

PT-2026-95145

Name of the Vulnerable Software and Affected Versions Vvveb versions prior to 1.0.8.5 Description An issue exists where the getThemeFolder function in admin/controller/editor/revisions.php returns the theme parameter without proper sanitization. The backupFolder function then concatenates this...

PT-2026-95142

Name of the Vulnerable Software and Affected Versions Vvveb versions prior to 1.0.8.5 Description The oEmbedProxy handler in admin/controller/editor/editor.php accepts an attacker-controlled url parameter and passes it to getUrl. The validateUrl function in system/functions.php only checks the...

PT-2026-94343

Name of the Vulnerable Software and Affected Versions Vendure versions prior to 3.6.5 Description Stored cross-site scripting XSS exists in the admin dashboard due to unsafe HTML stripping in the RichTextDescriptionCell component within...

CVE-2026-54648: Missing Authorization

CubeCart is an ecommerce software solution. Prior to 6.7.5, the GDPR tools in admin/sources/customers.gdpr.inc.php rely on page-level CCPERMREAD access and do not require CCPERMDELETE for the purge, noorderpurge, or deleteguests commands. An authenticated administrator with read-only customer...

CVE-2026-54643: Missing Authorization

CubeCart is an ecommerce software solution. Prior to 6.7.5, the delete-note handler in admin/sources/orders.index.inc.php verifies only the presence of orderid and delete-note parameters before deleting records from CubeCartordernotes, without requiring CCPERMDELETE for orders. An authenticated...

CVE-2026-54642: Cross-Site Request Forgery (CSRF)

CubeCart is an ecommerce software solution. Prior to 6.7.5, the resetid download-counter action and deletecard stored-payment-card action in admin/sources/orders.index.inc.php use state-changing GET requests and are omitted from the protection map in admin/skins/default/csrf.inc.php. A remote...

CVE-2026-54612: Improper Limitation of a Pathname to a Restricted Directory

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. From 1.0.0 until 1.0.8.5, saveGlobalElements in admin/controller/editor/global-trait.php concatenates the attacker-controlled file portion of data-v-save-global to the active theme directory...

CVE-2026-90229: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: nvme-apple: Destroy the admin queue on removal The admin queue is allocated with blkmqallocqueue but never destroyed. nvmefreectrl only drops the last reference and blkmqexitqueue and blksyncqueue never run: the hctx is never mov...

CVE-2026-89064: Insufficiently Protected Credentials

The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to Insufficient Credential Protection in versions up to, and including, 7.110. This is due to the Ai1wmMainController::init method — registered on the admininit hook, which fires unauthenticated on admin-ajax.php and...

PT-2026-94157

Name of the Vulnerable Software and Affected Versions Paid Downloads versions prior to 3.16 Description The Paid Downloads plugin for WordPress allows unauthenticated arbitrary file upload through the admin request handler function. This occurs because the function lacks proper authorization and...

PT-2026-94398

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the Fair Queuing fq scheduler where the change path accepts TCA FQ QUANTUM and TCA FQ INITIAL QUANTUM values up to INT MAX. This allows a user with CAP NET ADMIN...