CVE-2026-11767: Improper Neutralization of Input During Web Page Generation

The Free Builder for Elementor WordPress plugin before 1.6.7 does not sanitise submitted contact form field values before storing them and outputting them in the admin dashboard, allowing unauthenticated attackers to perform Stored Cross-Site Scripting attacks that execute when a logged-in...

PT-2026-62476

Name of the Vulnerable Software and Affected Versions Oracle GoldenGate versions 21.3 through 21.21 Oracle GoldenGate versions 23.4 through 23.26.1 Description An issue exists in the Admin Server Executable component that allows an unauthenticated attacker with network access via HTTPS to...

PT-2026-63303

Name of the Vulnerable Software and Affected Versions Gitea affected versions not specified Description Gitea contains an issue where the post-receive git hook handler incorrectly processes git push options on existing repositories. Users with owner or admin-collaborator access can use the...

Gitea: Webhooks created by a collaborator keep firing after their repo access is revoked → ongoing real-time exfiltration of private repo content

When a collaborator with admin permission on a private repo creates a webhook, that webhook keeps firing after the collaborator's access is revoked. Gitea's revocation cleanup DeleteCollaboration removes the collaboration record, recalculates accesses, drops watches, and unassigns issues — but it...

PT-2026-61930

Name of the Vulnerable Software and Affected Versions Grav versions 2.0.4 through 2.0.6 Description Remote code execution is possible through the Blueprint::dynamicData function in the system/src/Grav/Common/Data/Blueprint.php file. The issue occurs because a Class::method callable string and its...

CVE-2026-16450: Authorization Bypass Through User-Controlled Key

A vulnerability was identified in zsadmin2025 ZS-Admin up to b52e14536d59fda11e56e2536a1c32e82a38cead. This affects the function getTenantId of the file /api/system/sys/dept/page of the component MyBatis-Plus Tenant Plugin. Such manipulation of the argument X-Tenant-Id leads to authorization...

📄 WordPress Optional Email 1.3.11 Unauthenticated Administrator Account Takeover

WordPress Optional Email plugin version 1.3.11 contains an unauthenticated administrator account takeover vulnerability through Reset-Key Poisoning. A remote attacker can take over an administrator account. This proof of concept exploit demonstrates the vulnerable request flow against the affecte...

PT-2026-62482

Name of the Vulnerable Software and Affected Versions Oracle GoldenGate versions 19.1.0.0.0 through 19.30.0.0 Oracle GoldenGate versions 21.3 through 21.21 Oracle GoldenGate versions 23.4 through 23.26.1 Description A flaw in the Admin Server Executable component allows a low privileged attacker...

PT-2026-63313

Name of the Vulnerable Software and Affected Versions Gitea affected versions not specified Description The ToHook function in services/webhook/general.go decrypts the HeaderAuthorizationEncrypted field and returns the plaintext authorization header in the API response. This allows repository...

PT-2026-61820

Name of the Vulnerable Software and Affected Versions Zyxel AX7501-B1 versions prior to 5.17ABPC.7.2C0 Description A post-authentication command injection issue exists within the syslog component. An authenticated attacker with administrator privileges can execute arbitrary operating system...

PT-2026-62479

Name of the Vulnerable Software and Affected Versions Oracle GoldenGate versions 19.1.0.0.0 through 19.30.0.0 Oracle GoldenGate versions 21.3 through 21.21 Oracle GoldenGate versions 23.4 through 23.26.1 Description An issue exists in the Admin Server Executable component that allows an...

PT-2026-62120

Two undocumented privileged accounts exist in Autel Maxi Charger Single firmware through V1.03.51. The accounts use vendor-defined password derivation mechanisms based on device-specific values, allowing an attacker with knowledge of the algorithm and required inputs to authenticate to the web...

PT-2026-61929

The Grav api plugin grav-plugin-api before 1.0.8 fails to properly authorize API key generation and revocation: the plugin intercepts the apiKeyGenerate/apiKeyRevoke admin tasks before the account-management ACL runs and authorizes the caller on only the admin.login permission the baseline...

PT-2026-62115

kirby-modules through 5.5.7, fixed in commit 315417e, contains an information disclosure vulnerability that allows any authenticated Kirby Panel user to retrieve the full plaintext commercial license key by sending a GET request to the modules/activate dialog endpoint. The plugin's activate dialo...

PT-2026-63306

Name of the Vulnerable Software and Affected Versions Gitea version 1.25.4 Description A flaw exists where webhooks created by a collaborator with admin permissions on a private repository continue to trigger after the collaborator's access has been revoked. The DeleteCollaboration function in...

PT-2026-61844

The Tutor LMS Elementor Addons plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 4.0.0 This is due to missing capability checks on the activate tutor free and activate elementor free functions registered as admin action handlers. This makes it...

PT-2026-61975

Name of the Vulnerable Software and Affected Versions SolarWinds Serv-U affected versions not specified Description SolarWinds Serv-U contains an insecure direct object reference IDOR flaw, which occurs when an application provides direct access to objects based on user-supplied input. This issue...

PT-2026-61964

Name of the Vulnerable Software and Affected Versions SolarWinds Serv-U affected versions not specified Description SolarWinds Serv-U contains an insecure direct object reference IDOR flaw, which occurs when an application provides direct access to objects based on user-supplied input. This issue...

PT-2026-62039

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description An authenticated non-admin user can exploit a SQL injection flaw in the ticketing REST API to access sensitive data stored in the appliance database. SQL injecti...

PT-2026-61928

Grav contains a stored cross-site scripting vulnerability in shortcode-core attribute handlers where the XSS detection scan only matches payloads containing literal angle brackets, allowing shortcode parameters to bypass validation. Attackers with admin.pages permission can inject malicious...