PT-2026-6045

Name of the Vulnerable Software and Affected Versions Mail Mint plugin for WordPress versions up to and including 1.19.2 Description The Mail Mint plugin for WordPress is susceptible to Cross-Site Request Forgery due to a lack of nonce validation in the create or update note function. This allows...

MediaWiki 安全漏洞

MediaWiki is a free and open-source web-based wiki engine developed by the Wikimedia Foundation in the United States. This product can be used to deploy internal knowledge management and content management systems. There are security vulnerabilities in versions of MediaWiki prior to 1.39.14,...

CVE-2025-7014

Session Fixation vulnerability in QR Menu Pro Smart Menu Systems Menu Panel allows Session Hijacking. This issue affects Menu Panel: through 29012026. NOTE: The vendor was contacted early about this disclosure but did not respond in any way...

CVE-2025-69183

Incorrect Privilege Assignment vulnerability in e-plugins Hospital Doctor Directory hospital-doctor-directory allows Privilege Escalation.This issue affects Hospital Doctor Directory: from n/a through = 1.3.9...

CVE-2025-68910

Unrestricted Upload of File with Dangerous Type vulnerability in blazethemes Blogzee blogzee allows Using Malicious Files.This issue affects Blogzee: from n/a through = 1.0.5...

PT-2026-4448

Name of the Vulnerable Software and Affected Versions Damian WP Popups versions through 2.2.0.3 Description An issue exists in Damian WP Popups wp-popups-lite related to incorrectly configured access control security levels, allowing for missing authorization. The issue allows exploitation of...

CVE-2026-24371

Missing Authorization vulnerability in bookingalgorithms BA Book Everything ba-book-everything allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects BA Book Everything: from n/a through = 1.8.16...

CVE-2026-24361

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in ThimPress LearnPress - Course Review learnpress-course-review allows Stored XSS.This issue affects LearnPress - Course Review: from n/a through = 4.1.9...

CVE-2026-22406

Authorization Bypass Through User-Controlled Key vulnerability in Mikado-Themes Overton overton allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Overton: from n/a through = 1.3...

CVE-2025-69312

Unrestricted Upload of File with Dangerous Type vulnerability in Xpro Xpro Elementor Addons xpro-elementor-addons allows Upload a Web Shell to a Web Server.This issue affects Xpro Elementor Addons: from n/a through = 1.4.19.1...

CVE-2025-69311

Missing Authorization vulnerability in Broadstreet Broadstreet Ads broadstreet allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Broadstreet Ads: from n/a through = 1.52.1...

CVE-2025-54002

Missing Authorization vulnerability in Jthemes xSmart xsmart allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects xSmart: from n/a through = 1.2.9.4...

PT-2026-4138

Name of the Vulnerable Software and Affected Versions Edge-Themes Overworld versions through 1.3 Description The software contains a flaw related to improper control of filename handling for include/require statements, specifically a PHP Remote File Inclusion issue. This allows for PHP Local File...

PT-2026-4022

Name of the Vulnerable Software and Affected Versions Tickera versions through 3.5.6.2 Description A missing authorization issue exists in Tickera tickera-event-ticketing-system, allowing exploitation of incorrectly configured access control security levels. Recommendations Update Tickera to a...

PT-2026-4136

Name of the Vulnerable Software and Affected Versions LambertGroup Universal Video Player versions through 3.8.4 Description The Universal Video Player software contains a flaw related to improper input handling during web page generation, which allows for Reflected Cross-site Scripting XSS. This...

CVE-2026-21988

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: Core. Supported versions that are affected are 7.1.14 and 7.2.4. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromis...

UBUNTU-CVE-2026-21983

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: Core. Supported versions that are affected are 7.1.14 and 7.2.4. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to...

CVE-2026-21930

Vulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems component: Filesystems. The supported version that is affected is 8.8. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle ZFS Storage Appliance Kit executes ...

PT-2026-3678

Name of the Vulnerable Software and Affected Versions Oracle Solaris version 11 Description An easily exploitable issue exists in the Kernel component of Oracle Solaris that allows an unauthenticated attacker with network access via TCP to compromise the system. Successful attacks can result in...

PT-2026-3697

Name of the Vulnerable Software and Affected Versions Oracle Java SE versions 8u471-b50 Description A difficult-to-exploit issue exists in Oracle Java SE JavaFX component that allows an unauthenticated attacker with network access, via multiple protocols, to compromise the software. Successful...