PT-2026-104138

Name of the Vulnerable Software and Affected Versions Smash Balloon Social Post Feed – Simple Social Feeds for WordPress versions prior to 4.13.1 Description Insufficient input sanitization and output escaping in the Admin Builder Preview allow unauthenticated attackers to perform Stored Cross-Si...

PT-2026-104117

The Download Monitor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Cross-Origin postMessage to Admin Editor in all versions up to, and including, 5.2.10 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inje...

PT-2026-104227

Name of the Vulnerable Software and Affected Versions Ghost versions 4.39.0 through 6.63.x Description An information disclosure issue exists in the Admin API that allows staff users to view secret tokens associated with pending staff invites. Staff users who possess invite viewing permissions ca...

PT-2026-104226

Name of the Vulnerable Software and Affected Versions Ghost versions 0.7.2 through 6.63.0 Description An information disclosure issue exists in the Admin API that allows authenticated staff-level users to determine the relative ordering of password hashes belonging to other staff users. This is...

PT-2026-104346

A security flaw has been discovered in CodeAstro Simple Loan Management System 1.0. Impacted is an unknown function of the file /admin/index.php. Performing a manipulation of the argument g name results in sql injection. The attack may be initiated remotely. The exploit has been released to the...

PT-2026-104478

Name of the Vulnerable Software and Affected Versions Dell OpenManage Integration with Microsoft Windows Admin Center versions prior to 3.7.0 Description An OS Command Injection issue exists due to improper neutralization of special elements used in an OS command. A low privileged attacker with...

CVE-2026-103956: Missing Authentication for Critical Function

Missing authentication for critical function in the authentication dependency in Loom for AWS before 1.6.1 allowed remote actors to obtain super-admin authority over the agent control plane, including registering tool servers, reading stored integration credentials, and rewriting the IAM role...

CVE-2026-104415: Observable Discrepancy

Ghost from 0.7.2 before 6.64.0 contains an information disclosure vulnerability in the Admin API that allows staff-level users to determine the relative ordering of other staff users' password hashes. Authenticated staff users can query the Admin API to infer hash ordering, though this does not...

PT-2026-104480

Armadin researcher @mhskai2017 has uncovered two authenticated RCE vulnerability affecting Dell OpenManage Integration and Lenovo XClarity Integration with Windows Admin Center CVE-2026-101207 and CVE-2026-65949, both High severity CVSS 8.8. A domain user credential is enough to gain SYSTEM on th...

Rocky Linux 10.2 [CIQ] Security Update: dogtag-pki-debugsource / idm-pki-acme / idm-pki-base / idm-pki-ca / etc Multiple Vulnerabilities (crlsa-2026_73765)

The Rocky Linux 10.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202673765 advisory. pki-core: Dogtag/PKI: certprofile-import allows code execution via unsanitized profile content ExternalProcessConstraint CVE-2026-76561 pki-core: Dogta...

RockyLinux 9 : gvfs (RLSA-2026:74370)

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:74370 advisory. gvfs: SFTP: heap-based buffer overflow in readreply CVE-2026-84268 gvfs: gvfs-admin socket ownership race permits local root CVE-2026-88924 Tenable has...

PT-2026-104064

Name of the Vulnerable Software and Affected Versions itsourcecode Pet Shop Management System version 1.0 Description A SQL injection issue exists in the admin reject completed.php file. This occurs when the ID argument is manipulated, allowing a remote attacker to execute unauthorized database...

PT-2026-104456

Name of the Vulnerable Software and Affected Versions OpenLiteSpeed versions prior to 1.9.3 Description A local privilege escalation issue exists in the admin/misc/lsup.sh script. The system executes unverified update packages from a directory writable by the nobody user as the root user. An...

PT-2026-104417

Name of the Vulnerable Software and Affected Versions Loom for AWS versions prior to 1.6.1 Description A missing authentication for a critical function in the authentication dependency allows remote actors to obtain super-admin authority over the agent control plane. This occurs in deployments...

PT-2026-104448

Dell Container Storage Modules, versions prior to 1.18.0, contains an Insertion of Sensitive Information into Log File vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure...

CVE-2026-104625: Improper Neutralization of Special Elements used in an SQL Command

A security flaw has been discovered in CodeAstro Simple Loan Management System 1.0. Impacted is an unknown function of the file /admin/index.php. Performing a manipulation of the argument gname results in sql injection. The attack may be initiated remotely. The exploit has been released to the...

CVE-2026-104416: Observable Discrepancy

Ghost from 4.39.0 before 6.64.0 contains an information disclosure vulnerability in the Admin API that allows staff users to view secret tokens of pending staff invites. Staff users with invite viewing permission can accept pending invites for higher-privileged roles to escalate their privileges...

GO-2026-6576 Cloudreve: Privilege Scope Bypass: State-Mutating Admin Operations Accessible via Read-Only OAuth Scope in github.com/cloudreve/Cloudreve

Cloudreve: Privilege Scope Bypass: State-Mutating Admin Operations Accessible via Read-Only OAuth Scope in github.com/cloudreve/Cloudreve...

CVE-2026-70650

GetSimple CMS is a content management system CMS, and GetSimple CMS CE is the community edition of that CMS. In versions 3.3.22 and prior, an authenticated stored Cross-Site Scripting XSS vulnerability exists in the page backup viewer admin/backup-edit.php. Page fields are correctly HTML-encoded...

CVE-2026-71542

GetSimple CMS is a content management system CMS, and GetSimple CMS CE is the community edition of that CMS. In versions 3.3.22 and prior, GetSimpleCMS-CE is vulnerable to stored Cross-Site Scripting XSS in the "Theme to Components" functionality admin/components.php via the title parameter. The...