CVE-2026-11801

The WPAdverts – Classifieds Plugin plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.3.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to...

PT-2026-78047

Name of the Vulnerable Software and Affected Versions Oracle BI Publisher version 8.2.0.0.0 Oracle BI Publisher version 12.2.1.4.0 Oracle BI Publisher version 26.01.0.0.0 Description A flaw in the Web Service API component allows a low privileged attacker with network access via HTTP to compromis...

PT-2026-77298

Name of the Vulnerable Software and Affected Versions Pydio Cells versions 5.0.0 through 5.0.2 Description An authorization bypass exists in the REST handler for the endpoint "GET /a/share/link/Uuid" within the idm/share/rest/handler.go file. The handler processes the Uuid variable from the path...

PT-2026-78048

Name of the Vulnerable Software and Affected Versions Oracle BI Publisher version 8.2.0.0.0 Oracle BI Publisher version 26.1.0.0.0 Description A flaw exists in the Web Service API component of the Oracle BI Publisher product of Oracle Analytics. A low privileged attacker with network access via...

PT-2026-77300

Froxlor is open source server administration software. Prior to 2.3.8, the Admins.add and Admins.update endpoints in lib/Froxlor/Api/Commands/Admins.php accept an attacker-controlled ipaddress array and store it as JSON in panel admins.ip without enforcing numeric element types. When the poisoned...

PT-2026-77167

A flaw was found in the AAP Controller's HashiCorp Vault credential plugin. The kubernetes auth function in awx plugins/credentials/hashivault.py reads the controller pod's Kubernetes service account token and sends it to an attacker-controlled URL when a HashiCorp Vault Secret Lookup credential...

PT-2026-76983

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 154 Firefox ESR versions prior to 153.1 Thunderbird versions prior to 154 Thunderbird versions prior to 153.1 Description Privilege escalation exists within the Downloads API component. Recommendations Update Firefox ...

Linux Distros Unpatched Vulnerability : CVE-2026-68520

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.6, asdictsecure in glances/config.py checks only option names and exposes...

PT-2026-76935

Grav API plugin getgrav/grav-plugin-api before 1.0.14 contains a missing authorization vulnerability in userPassesAuthorize AbstractApiController.php. The function fails to consult the calling request's API key scopes, relying instead on the account's raw super-admin flag and ACL grants. As a...

PT-2026-77166

CodeWhale versions before 0.8.64 contain an environment variable exposure vulnerability in the js execution tool that fails to scrub parent process environment variables before spawning Node.js. Attackers can craft malicious JavaScript code executed by the tool to read process.env and leak API...

PT-2026-76992

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 154 Firefox ESR versions prior to 140.14 Firefox ESR versions prior to 153.1 Thunderbird versions prior to 154 Thunderbird versions prior to 140.14 Thunderbird versions prior to 153.1 Description A mitigation bypass...

Linux Distros Unpatched Vulnerability : CVE-2026-68517

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.6, the corsorigins guard in glances/outputs/glancesrestfulapi.py uses exact list...

PT-2026-77303

Name of the Vulnerable Software and Affected Versions Froxlor versions 2.3.7 through 2.3.7 Description Certain API commands retrieve full database rows and return them without removing sensitive fields. An authenticated API caller with appropriate permissions can obtain password hashes and...

PT-2026-78240

Name of the Vulnerable Software and Affected Versions 4gaBoards versions prior to 3.3.9 Description An authenticated user can modify backend-managed identity attributes via the 'PATCH /api/users/:id' endpoint. This occurs because the whitelist in the update.js controller allows mass assignment of...

PT-2026-77345

Name of the Vulnerable Software and Affected Versions Oracle Java SE versions 8u501, 11.0.32, 17.0.20, 21.0.12, 25.0.4, and 26.0.2 Oracle GraalVM for JDK versions 17.0.20 and 21.0.12 Oracle GraalVM Enterprise Edition version 21.3.19 Description A security issue in the Security component allows an...

PT-2026-77707

Name of the Vulnerable Software and Affected Versions Oracle E-Business Suite Oracle Sales Foundation versions 12.2.3 through 12.2.15 Description A flaw in the Security API component allows a low privileged attacker with network access via HTTP to compromise the system. Successful exploitation ca...

PT-2026-76932

The Grav API plugin getgrav/grav-plugin-api, bundled with Grav 2.0 before version 1.0.14 fixed in 1.0.15 contains a missing authorization vulnerability in BlueprintPathResolver::resolveUserScope. The method gates the users/ scope on the account's raw super-admin ACL flag access.api.super instead ...

PT-2026-76987

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 154 Firefox ESR versions prior to 153.1 Thunderbird versions prior to 154 Thunderbird versions prior to 153.1 Description Information disclosure occurs due to a side-channel in the Storage: Cache API component. A...

CVE-2026-9693

Mattermost versions 10.11.x = 10.11.20, 11.7.x = 11.7.5 Mattermost fails to remove thread membership records when a user is removed from or leaves a team, which allows a previously removed user who is later re-invited to the team to view private channel thread root post content and metadata via t...

CVE-2026-9816

Mattermost versions 11.7.x = 11.7.6, 10.11.x = 10.11.21, 11.8.x = 11.8.3 fail to validate BoardMember.Scheme fields server-side on insert and archive-import paths which allows a board editor or non-guest team member to grant board admin to arbitrary users via POST /api/v2/boards/boardID/members a...