PT-2026-103974

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to version 1.0.8.6, Vvveb's HTML sanitizer fails to strip event-handler attributes when a tag carries a greater-than character inside a quoted attribute value. A low-privilege content...

PT-2026-103813

Name of the Vulnerable Software and Affected Versions Ghost npm package 'ghost' versions 3.23.0 through 6.22.x Description An issue exists where the Admin API exposes API keys to authenticated users with low-privilege staff accounts. These keys are intended to be accessible only to users with...

PT-2026-103699

The Paytm Payment Gateway WordPress plugin before 2.8.9 does not sanitize and escape data it stores from payment callbacks before outputting it in an admin page, and the integrity check on those callbacks can be forged when the gateway is enabled without credentials, allowing unauthenticated user...

PT-2026-105828

A security flaw has been discovered in BerriAI litellm up to 1.82.2. This impacts the function authenticate user of the file litellm/proxy/auth/login utils.py of the component PROXY ADMIN database API Key Generator. Performing a manipulation results in session expiration. The attack may be...

PT-2026-105804

Impact The live WebSocket transport authorizes a mount via check view auth, not Django's View.dispatch chain. As a result, standard Django authorization — LoginRequiredMixin, PermissionRequiredMixin, UserPassesTestMixin, @method decoratorlogin required, name="dispatch", and custom dispatch guards...

CVE-2026-55231: Improper Limitation of a Pathname to a Restricted Directory

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to version 1.0.8.6, a flawed central path sanitizer lets an authenticated admin-panel user who holds backup access default role siteadmin or higher read and delete arbitrary files on a...

CVE-2026-55230: Improper Neutralization of Input During Web Page Generation

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to version 1.0.8.6, Vvveb's HTML sanitizer fails to strip event-handler attributes when a tag carries a greater-than character inside a quoted attribute value. A low-privilege content...

CVE-2026-104059: Cross-Site Request Forgery (CSRF)

Lektor 3.3.14 and 3.4.0b15 contains a cross-site request forgery vulnerability in the admin API blueprint that allows unauthenticated attackers to perform state-changing actions by sending cross-origin requests without CSRF tokens, Origin/Referer validation, CORS configuration, or Host...

CVE-2026-103277: Improper Neutralization of Input During Web Page Generation

Ghost versions from 2.5.0 before 6.34.0 contain an untrusted script execution vulnerability in the oEmbed preview feature that fails to sandbox externally hosted scripts. Attackers can craft malicious oEmbed content to execute scripts in the context of a staff user's admin session, potentially...

CVE-2026-103278: Relative Path Traversal

Ghost versions 5.8.0 before 6.34.0 contain an input validation vulnerability in the admin iframe that allows attackers to take over staff user accounts. Attackers with content publishing privileges can craft malicious pages that, when visited by active staff users, enable account takeover through...

CVE-2026-70650: Improper Neutralization of Input During Web Page Generation

GetSimple CMS is a content management system CMS, and GetSimple CMS CE is the community edition of that CMS. In versions 3.3.22 and prior, an authenticated stored Cross-Site Scripting XSS vulnerability exists in the page backup viewer admin/backup-edit.php. Page fields are correctly HTML-encoded...

PT-2026-103992

GetSimple CMS is a content management system CMS, and GetSimple CMS CE is the community edition of that CMS. In versions 3.3.22 and prior, an authenticated stored Cross-Site Scripting XSS vulnerability exists in the page backup viewer admin/backup-edit.php. Page fields are correctly HTML-encoded...

PT-2026-103738

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Rich-Text Textarea Field in all versions up to, and including, 1.57.2 due to insufficient input sanitization and output escaping. This makes it possible fo...

CVE-2026-103284: Incorrect Authorization

Ghost versions from 5.125.1 before 6.57.1 contain an information disclosure vulnerability in the Admin Feedback endpoint that allows unauthorized staff users to access member data. Attackers with staff privileges can query the feedback endpoint to retrieve sensitive member information without...

PT-2026-103816

Name of the Vulnerable Software and Affected Versions Ghost versions 5.125.1 through 6.57.0 Description An information disclosure issue exists in the Admin Feedback endpoint. Staff users with limited privileges can query this endpoint to retrieve sensitive member data because the system fails to...

CVE-2026-85235: Improper Neutralization of Input During Web Page Generation

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Rich-Text Textarea Field in all versions up to, and including, 1.57.2 due to insufficient input sanitization and output escaping. This makes it possible fo...

CVE-2026-71542: Improper Neutralization of Input During Web Page Generation

GetSimple CMS is a content management system CMS, and GetSimple CMS CE is the community edition of that CMS. In versions 3.3.22 and prior, GetSimpleCMS-CE is vulnerable to stored Cross-Site Scripting XSS in the "Theme to Components" functionality admin/components.php via the title parameter. The...

Rocky Linux 10.0 [CIQ] Security Update: ipa-client / ipa-client-common / ipa-client-debuginfo / etc (crlsa-2025_17085)

The Rocky Linux 10.0 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202517085 advisory. FreeIPA: idm: Privilege escalation from host to domain admin in FreeIPA CVE-2025-7493 Tenable has extracted the preceding description block directly from the CI...

PT-2026-104059

Name of the Vulnerable Software and Affected Versions ClipBucket versions 5 through 5.5.3-197 Description Authenticated users with ad manager access permission can perform SQL injection via the delete parameter in the 'admin area/ads manager.php' endpoint. By using time-based blind payloads...

RockyLinux 9 : pki-core (RLSA-2026:73766)

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:73766 advisory. pki-core: Dogtag/PKI: certprofile-import allows code execution via unsanitized profile content ExternalProcessConstraint CVE-2026-76561 pki-core: Dogtag...