CVE-2026-79625: Concurrent Execution using Shared Resource with Improper Synchronization

Affected products do not properly synchronize access to their monitoring functionality. When multiple clients send concurrent requests, this may lead to incorrect reads or writes, or to corruption of internal memory structures. An authenticated remote attacker with monitoring access can exploit...

PT-2026-103628

Name of the Vulnerable Software and Affected Versions QloApps versions prior to 1.7.1 Description A reflected cross-site scripting issue exists in the back-office room type editor. The application fails to properly escape the room num, floor, and comment field values within input attributes. This...

Iron Mountain enVision 260654 Authenticated SQL Injection

Iron Mountain enVision versions before 260655 contain an authenticated SQL injection vulnerability in the DocumentModule document-listing and detailed-search sorting parameter...

CVE-2026-103474: Unrestricted Upload of File with Dangerous Type

yii2-starter-kit through 4.2.0 fails to validate file types in the backend storage upload actions, allowing authenticated managers to upload PHP files. Attackers with manager role can upload PHP scripts to the web-accessible storage directory and request them to execute arbitrary code on the serv...

CVE-2026-62308: Server-Side Request Forgery (SSRF)

Tugtainer is a self-hosted app for automating updates of Docker containers. Prior to version 1.30.6, Tugtainer allows an authenticated user to make the backend server send outbound HTTP requests to arbitrary user-supplied URLs through the notification test endpoint. The /settings/testnotification...

CVE-2026-100271: Missing Authorization

In JetBrains YouTrack before 2026.2.19197 missing authorisation on several endpoints allowed authenticated users to access information from other projects...

CVE-2026-100266: Missing Authorization

In JetBrains Hub before 2026.2.52366 missing authorisation allowed authenticated users to send arbitrary emails from the server's trusted address...

CVE-2026-102585: Placement of User into Incorrect Group

A flaw was found in Moodle. When enrolling a user into a course while assigning them to a group, the application does not verify whether the selected group actually belongs to that course. An authenticated user with teacher privileges could exploit this flaw to add users to groups within courses...

CVE-2026-102584: Direct Request

A flaw was found in Moodle. Due to a missing capability check, a low-privileged authenticated user can trigger the recalculation of grade penalties without holding the required permissions. This issue allows unauthorized users to modify grade penalty records, potentially altering student assessme...

CVE-2026-102580: Use of Externally-Controlled Input to Select Classes or Code

A flaw was found in Moodle. An authenticated attacker can supply an improperly validated audience class name to the Report Builder component, allowing arbitrary class instantiation. This vulnerability enables the unauthorized creation of internal program objects, which may result in unexpected...

CVE-2026-92872: Insertion of Sensitive Information into Log File

Pgpool-II inserts sensitive information into log file, which may allow an authenticated attacker to obtain the cluster information...

CVE-2026-92869: Out-of-bounds Write

An out-of-bounds write vulnerability exists in Pgpool-II, which may allow an authenticated attacker to cause abnormal process termination...

CVE-2026-92867: Out-of-bounds Write

An out-of-bounds write vulnerability exists in Pgpool-II , which may allow an authenticated attacker to cause abnormal process termination or arbitrary code execution...

CVE-2026-85576: Missing Authorization

The All in One Files Upload WordPress plugin before 2.0.17 does not have any capability check, and does not verify the authenticity of the request, when saving its settings, allowing any authenticated user, such as a subscriber, to change them...

PT-2026-103055

The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'images' parameter of the plugin's bt bb css image grid shortcode in all versions up to, and including, 5.7.2 due to insufficient input sanitization and output escaping on user-supplied attributes. Thi...

PT-2026-103065

Pgpool-II inserts sensitive information into log file, which may allow an authenticated attacker to obtain the cluster information...

PT-2026-103079

Name of the Vulnerable Software and Affected Versions EasyFlow .NET affected versions not specified Description An arbitrary file read flaw allows authenticated remote attackers to download arbitrary system files from the server. Recommendations At the moment, there is no information about a newe...

PT-2026-103127

sogo yhn configures SOGo with a parameter that forces the request with HTTP header "x-webobjects-remote-user" to be treated as sent by a verified user without performing password validation. Since Nginx does not strip this header, any client can supply it arbitrarily and gain access as any user,...

PT-2026-103115

MISP contains an improper input validation vulnerability in its ORM save path. When a user submits data through various endpoints attribute add/edit, event edit, free-text import, sighting capture, shadow attribute proposal, event report creation, object reference add, user admin edit, the...

PT-2026-103038

The Image Optimizer WordPress plugin before 1.7.7 does not enforce its intended capability check on several of its read REST routes, allowing any authenticated user to read attachment metadata and site-wide statistics that should be restricted to administrators...