CVE-2026-8761

CVE-2026-8761: Dokan WordPress plugin vulnerability in all versions up to 5.0.1 (disputed in title by 5.0.2) where a missing authorization check in the REST CustomersController re-registers WooCommerce’s customer routes under /wp-json/dokan/v1/customers/, replacing manage_woocommerce with a vendo...

Access of Resource Using Incompatible Type ('Type Confusion')

Overview org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services. Affected versions of this package are vulnerable to Access of Resource Using Incompatible Type 'Type Confusion' in ProtocolMappersClientRegistrationPolicy via th...

EUVD-2026-52931

Odysseus before commit 87babb5 contains a server-side request forgery vulnerability that allows admin-privileged attackers to direct the server to probe internal network resources by supplying arbitrary URLs to the embedding endpoint configuration without scheme, host, IP range, or DNS rebind...

CVE-2026-18856 Poesis Rhymix CMS Data Import importer.admin.controller.php procImporterAdminCheckXmlFile server-side request forgery

A vulnerability was determined in Poesis Rhymix CMS up to 2.1.33. This impacts the function procImporterAdminCheckXmlFile of the file modules/importer/importer.admin.controller.php of the component Data Import Module. This manipulation of the argument filename causes server-side request forgery...

CVE-2026-18856

CVE-2026-18856 affects Poesis Rhymix CMS up to version 2.1.33. The vulnerability resides in the function procImporterAdminCheckXmlFile (modules/importer/importer.admin.controller.php) and enables server-side request forgery via manipulation of the filename argument. Exploitation can be remote; th...

PT-2026-68036

Name of the Vulnerable Software and Affected Versions Pluck CMS affected versions not specified Description The admin panel lacks per-request anti-CSRF tokens and relies exclusively on a Referer-header comparison within the requestedByTheSameDomain function located in data/inc/functions.admin.php...

CVE-2025-15677: Improper Neutralization of Input During Web Page Generation

The GeoDirectory WordPress plugin before 2.8.110 does not sanitise and escape a place-category setting before outputting it back in an admin page, allowing high-privilege users such as editors and above to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is...

CVE-2026-15941: Improper Neutralization of Special Elements used in an SQL Command

The plugin provides an Admin Search page that allows users with the editposts capability to run Relevanssi searches from the WordPress dashboard. The AJAX handler accepts a URL-encoded args parameter, parses it into a WPQuery, and then passes user-controlled taxonomy query data into Relevanssi's...

PT-2026-68212

Name of the Vulnerable Software and Affected Versions Progress MarkLogic Server versions prior to 11.3.6 Progress MarkLogic Server versions prior to 12.0.3 Description A cross-site request forgery CSRF issue exists in the Admin UI. This occurs when a remote attacker lures an authenticated...

CVE-2026-71232: Improper Control of Generation of Code

MacCMS10's admin template editor application/admin/controller/Template.php blocks dangerous PHP functions in template content via a blacklist regex, but the blacklist omitted exec, passthru, popen, showsource, createfunction, registershutdownfunction, registertickfunction, and errorlog...

CVE-2026-10090: Privilege Defined With Unsafe Actions

A flaw was found in the Application Subscription controller multicluster-operators-subscription of Red Hat Advanced Cluster Management for Kubernetes ACM. A user with namespace-scoped "edit" privileges in an ACM hub namespace can create a Channel resource pointing to a Helm repository they contro...

CVE-2026-0931: Improper Validation of Syntactic Correctness of Input

Denial-of-service vulnerability in M-Files Server versions before 26.5.16015.3 allows an authenticated admin user to cause the M-Files Server process to crash and fail to restart...

CVE-2026-71292: Improper Neutralization of Special Elements used in an SQL Command

Subrion CMS's admin grid sorting helper, gridGetSorting in includes/classes/ia.base.controller.admin.php, whitelists the ASC/DESC request parameter via inarray, but falls back to the raw, attacker-supplied GET parameter whenever the requested key is not present in the per-controller whitelist...

PT-2026-68156

Name of the Vulnerable Software and Affected Versions Fledge affected versions not specified Description The backup-restore upload handler upload backup python/fledge/services/core/api/backup restore.py fails to validate per-member paths or use a filter argument when calling tarfile.extractalltem...

PT-2026-68060

Name of the Vulnerable Software and Affected Versions WP Post Author – Author Box, Multiple Authors, Guest Authors & Custom Avatars versions prior to 3.9.2 Description This issue is a generic SQL Injection, which occurs when an application fails to properly sanitize user input, allowing an attack...

PT-2026-67993

В известном решении по безопасности Tetragon закрыли «Unauthenticated Tetragon gRPC admin API accessible from hostNetwork pods» - CVE-2026-65960 CVSS 8.8. Суть простая: агент поднимает свой административный gRPC API по TCP на localhost:54321 и без какой-либо аутентификации. Таким образом любой...

CVE-2026-71275: Improper Neutralization of Input During Web Page Generation

OpenBK7231T's httpfnotaexec src/httpserver/httpfns.c reflects the host query parameter directly into an HTML response via hprintf255request, " OTA requested for %s! ", tmpA with no HTML encoding, allowing a crafted URL such as /otaexec?host= to execute JavaScript in an authenticated admin's brows...

CVE-2026-70376: Cross-Site Request Forgery (CSRF)

Pluck CMS's admin panel relies solely on a Referer-header comparison requestedByTheSameDomain in data/inc/functions.admin.php, gating every admin.php action for CSRF protection, with no per-request anti-CSRF token anywhere in the admin area...

PT-2026-68098

Name of the Vulnerable Software and Affected Versions MacCMS10 affected versions not specified Description The admin template editor in application/admin/controller/Template.php uses a blacklist regex to block dangerous PHP functions in template content. However, the blacklist fails to include...

PT-2026-67944

Name of the Vulnerable Software and Affected Versions Relevanssi affected versions not specified Description The plugin includes an Admin Search page that enables users with the edit posts capability to perform searches from the WordPress dashboard. An AJAX handler accepts a URL-encoded args...