CVE-2026-70376: Cross-Site Request Forgery (CSRF)

Pluck CMS's admin panel relies solely on a Referer-header comparison requestedByTheSameDomain in data/inc/functions.admin.php, gating every admin.php action for CSRF protection, with no per-request anti-CSRF token anywhere in the admin area...

CVE-2026-71292: Improper Neutralization of Special Elements used in an SQL Command

Subrion CMS's admin grid sorting helper, gridGetSorting in includes/classes/ia.base.controller.admin.php, whitelists the ASC/DESC request parameter via inarray, but falls back to the raw, attacker-supplied GET parameter whenever the requested key is not present in the per-controller whitelist...

PT-2026-68156

Name of the Vulnerable Software and Affected Versions Fledge affected versions not specified Description The backup-restore upload handler upload backup python/fledge/services/core/api/backup restore.py fails to validate per-member paths or use a filter argument when calling tarfile.extractalltem...

CVE-2026-6627: Missing Authorization

The WPFormify – Stripe Payments with Form and Checkout plugin for WordPress is vulnerable to unauthorized modification and deletion of Stripe payment credentials in all versions up to, and including, 1.1.1. This is due to missing capability checks and nonce verification on the...

PT-2026-68060

Name of the Vulnerable Software and Affected Versions WP Post Author – Author Box, Multiple Authors, Guest Authors & Custom Avatars versions prior to 3.9.2 Description This issue is a generic SQL Injection, which occurs when an application fails to properly sanitize user input, allowing an attack...

PT-2026-67993

В известном решении по безопасности Tetragon закрыли «Unauthenticated Tetragon gRPC admin API accessible from hostNetwork pods» - CVE-2026-65960 CVSS 8.8. Суть простая: агент поднимает свой административный gRPC API по TCP на localhost:54321 и без какой-либо аутентификации. Таким образом любой...

CVE-2026-71275: Improper Neutralization of Input During Web Page Generation

OpenBK7231T's httpfnotaexec src/httpserver/httpfns.c reflects the host query parameter directly into an HTML response via hprintf255request, " OTA requested for %s! ", tmpA with no HTML encoding, allowing a crafted URL such as /otaexec?host= to execute JavaScript in an authenticated admin's brows...

CVE-2026-71283: Improper Limitation of a Pathname to a Restricted Directory

Fledge's backup-restore upload handler, uploadbackup python/fledge/services/core/api/backuprestore.py, calls tarfile.extractalltemppath on an admin-uploaded tar archive with no filter argument and no per-member path validation. Requires the admin role @haspermission"admin"...

PT-2026-68146

Name of the Vulnerable Software and Affected Versions OpenBK7231T affected versions not specified Description The '/cfg wifi set' endpoint in 'src/httpserver/http fns.c' allows configuration changes through a GET request without requiring a Cross-Site Request Forgery CSRF token. CSRF is a type of...

CVE-2026-71284: Improper Neutralization of Special Elements used in an OS Command

Fledge's backup-restore upload handler, uploadbackup python/fledge/services/core/api/backuprestore.py, takes the first extracted tar member's filename tarfilenames0 and builds a shell command via string formatting. Because os.system invokes a shell and no quoting shlex.quote, list-form subprocess...

PT-2026-67944

Name of the Vulnerable Software and Affected Versions Relevanssi affected versions not specified Description The plugin includes an Admin Search page that enables users with the edit posts capability to perform searches from the WordPress dashboard. An AJAX handler accepts a URL-encoded args...

CVE-2026-18933: Unrestricted Upload of File with Dangerous Type

The wp-downloadmanager WordPress plugin, in version 1.68.11 also affecting the 6.9.4 release line, allows an admin-privileged user currentusercan'managedownloads' to upload arbitrary files via download-add.php with no extension or MIME-type validation of any kind - no wpcheckfiletypeandext, no...

PT-2026-68033

Name of the Vulnerable Software and Affected Versions WPFormify – Stripe Payments with Form and Checkout versions prior to 1.1.2 Description Unauthenticated attackers can modify or delete Stripe payment credentials. This occurs because the wpf stripe callback success and wpf stripe disconnect...

CVE-2026-7326: Cross-Site Request Forgery (CSRF)

A cross-site request forgery vulnerability in the Admin UI of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows a remote attacker who lures an authenticated administrator to a malicious web page to perform administrative actions on the administrator's behalf. This can result in unauthoriz...

CVE-2026-18322: Improper Privilege Management

The Smart Popup by Supsystic plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.12.0. This is due to a permission map collision in the havePermissions function in classes/frame.php, where arraymerge overwrites the popup module's...

PT-2026-68164

Name of the Vulnerable Software and Affected Versions Subrion CMS affected versions not specified Description The admin grid sorting helper gridGetSorting in includes/classes/ia.base.controller.admin.php fails to properly validate the sort GET parameter. While the function attempts to whitelist t...

CVE-2026-70619

Odysseus before commit bf325f6 contains a missing authorization vulnerability that allows authenticated non-admin users to manage server-wide embedding backend configuration by invoking endpoint management routes that verify session authentication but omit the admin authorization guard. Attackers...

CVE-2026-70590

Ghost is a Node.js content management system. Prior to 6.54.1, any staff-level user was able to leak the hashed passwords of other staff users through the Ghost Admin API. An offline password-guessing attack against the hashes could lead to account takeover if successful, but Device Verification...

CVE-2026-70591

Ghost is a Node.js content management system. From 0.10.0 until 6.54.1, a Server-Side Request Forgery in Ghost Admin image fetching allowed any staff-level user to perform a blind HTTP GET request against internal hosts. No output was returned, but this could have been used to probe open ports on...

Ghost: Session Fixation in Ghost Admin

Impact Ghost Admin did not invalidate existing sessions on login which could have allowed for session fixation attacks. Successful exploitation would have required another vulnerability on the same domain where Ghost Admin was hosted. Vulnerable versions This vulnerability is present in Ghost fro...