Linux Distros Unpatched Vulnerability : CVE-2026-13058

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An authenticated user with basic write privileges can cause the mongod process to terminate abnormally by sending a crafted transaction command with an incomple...

PT-2026-64852

Name of the Vulnerable Software and Affected Versions Leantime versions prior to 3.6.3 Description Authenticated users can access milestone data from projects to which they are not assigned. This is possible by providing arbitrary integer milestone IDs to the 'tickets.getMilestone' JSON-RPC...

CVE-2026-14955

The Checkout Field Editor for WooCommerce Pro plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 3.7.7 via the 'thwcfelegacyfile' parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to read the content...

EUVD-2026-48744

The web management interface in Tycon Systems TPDIN-Monitor-WEB2 stores and displays system credentials in cleartext on a certain configuration page accessible to authenticated users. Any party with access to the administrative dashboard can immediately read these credentials, which may be used t...

GHSA-95CV-R8X4-VH75 OpenList: Authenticated users can rename files outside their base path via batch rename `src_name` traversal

Summary The /api/fs/batchrename handler validates and authorizes only the requested source directory. It rejects path separators in newname, but it does not validate srcname. The handler concatenates srcdir and attacker-controlled srcname, then passes the result to the filesystem rename layer,...

CVE-2026-55985

The web management interface in Tycon Systems TPDIN-Monitor-WEB2 stores and displays system credentials in cleartext on a certain configuration page accessible to authenticated users. Any party with access to the administrative dashboard can immediately read these credentials, which may be used t...

CVE-2026-55985 Tycon Systems TPDIN-Monitor-WEB2 Cleartext Storage of Sensitive Information

The web management interface in Tycon Systems TPDIN-Monitor-WEB2 stores and displays system credentials in cleartext on a certain configuration page accessible to authenticated users. Any party with access to the administrative dashboard can immediately read these credentials, which may be used t...

CVE-2026-55985

The web management interface in Tycon Systems TPDIN-Monitor-WEB2 stores and displays system credentials in cleartext on a certain configuration page accessible to authenticated users. Any party with access to the administrative dashboard can immediately read these credentials, which may be used t...

CVE-2026-17039 Pki-core: dogtag-pki: redhat-pki: pki-core: ca renewal request processing omits realm authorization check performed by enrollment path

A flaw was found in pki-core. The certificate authority CA renewal request path does not perform the realm-based authorization check that the enrollment path performs, allowing an authenticated user entitled to one realm to cause a certificate belonging to a different realm to be renewed without...

EUVD-2026-48608

Improper control of generation of code 'Code Injection' in the variables feature in Devolutions PowerShell Universal 2026.2.2 and earlier allows an authenticated user with variable write permission to execute arbitrary PowerShell code via a crafted variable value that is not properly escaped when...

CVE-2026-16801

Improper control of generation of code 'Code Injection' in the variables feature in Devolutions PowerShell Universal 2026.2.2 and earlier allows an authenticated user with variable write permission to execute arbitrary PowerShell code via a crafted variable value that is not properly escaped when...

Improper Authorization

Apache Accumulo is vulnerable to Improper Authorization. The vulnerability is due to insufficient privilege enforcement on remote shutdown commands, allowing authenticated low-privileged users to shut down system components and cause a denial of service...

CVE-2026-15665

The Fluent Support – Helpdesk & Customer Support Ticket System plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'redirect-to' Shortcode Attribute in all versions up to, and including, 2.3.0 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-15821

CVE-2026-15821 affects the SureDash WordPress plugin (Community, Courses & Member Dashboard) up to version 1.10.0. The vulnerability is a stored Cross-Site Scripting via shortcode attributes caused by insufficient input sanitization and output escaping. Authenticated users with contributor-level ...

PT-2026-64246

The Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 600+ Patterns, 58 Blocks & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'cozyCustomFont' Block Attribute in all versions up to, and including, 2.2.11 due to insufficient input sanitization and output...

PT-2026-64419

Name of the Vulnerable Software and Affected Versions Tycon Systems TPDIN-Monitor-WEB2 affected versions not specified Description The web management interface stores and displays system credentials in cleartext on a configuration page accessible to authenticated users. Individuals with access to...

IBM Cognos Analytics 12.1.3 Race Condition (7280311)

The version of IBM Cognos Analytics installed on the remote host is 12.1.3. It is, therefore, affected by a race condition vulnerability as referenced in the IBM Security Bulletin No. 7280311: - IBM Cognos Analytics could allow an attacker to obtain incorrect report summary results or cause...

PT-2026-64375

Name of the Vulnerable Software and Affected Versions sysPass version 3.2.11 Description An insecure direct object reference occurs due to missing authorization checks in the AccountFileController. This allows an authenticated attacker to access account file attachments for which they lack Access...

WordPress Rich Showcase for Google Reviews plugin <= 6.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin Rich Showcase for Google Reviews versions = 6.9.9...

CVE-2026-47752

Tugtainer is a self-hosted app for automating updates of Docker containers. Versions prior to 1.30.2 are vulnerable to Server-Side Template Injection SSTI in the notification template feature. The titletemplate and bodytemplate fields are rendered using an unsandboxed jinja2.Environment, allowing...