PT-2026-56315

Name of the Vulnerable Software and Affected Versions Backstage - Customizer Demo Access versions prior to 1.4.3 Description This issue allows unauthenticated attackers to achieve privilege escalation. The plugin assigns the manage options capability to the backstage customizer user demo role,...

PT-2026-56318

Name of the Vulnerable Software and Affected Versions Chatra Live Chat + ChatBot + Cart Saver versions prior to 1.0.13 Description Insufficient input sanitization and output escaping in the admin settings allow authenticated attackers with administrator-level permissions and above to perform Stor...

PT-2026-56394

Name of the Vulnerable Software and Affected Versions Smash Balloon Social Photo Feed – Easy Social Feeds Plugin versions prior to 6.11.2 Description Cross-Site Request Forgery occurs due to missing or incorrect nonce validation in the maybe connection data function. This allows unauthenticated...

PT-2026-56586

Name of the Vulnerable Software and Affected Versions PAN-OS versions prior to 12.1.8 PAN-OS versions prior to 11.2.13 PAN-OS versions prior to 11.1.16 PAN-OS versions prior to 10.2.18-h8 Description A command injection issue exists in the management plane of the software, specifically within the...

PT-2026-57871

Name of the Vulnerable Software and Affected Versions AnyDesk affected versions not specified Description A flaw in the Send Support Information feature allows local attackers to create a denial-of-service condition. An attacker with the ability to execute low-privileged code on the target system...

PT-2026-56545

Name of the Vulnerable Software and Affected Versions LiteLLM versions prior to 1.84.0 Description LiteLLM is a proxy server AI Gateway used to call LLM APIs. The MCP Streamable HTTP endpoint contains an authentication bypass where an unauthenticated attacker can use a fabricated Authorization...

📄 OpenSourcePOS 3.4.1 Cross Site Request Forgery

OpenSourcePOS version 3.4.1 suffers from a cross site request forgery vulnerability. ================================================================================================================================== | Title : OpenSourcePOS 3.4.1 CSRF Vulnerability Leading to Unauthorized Admin...

PT-2026-56529

Multiple protection mechanism failures in the Prisma Access Agent Data Loss Prevention DLP component for Windows allow a local user to bypass DLP policy enforcement controls. The Prisma Access Agent on macOS is not affected...

PT-2026-56714

Name of the Vulnerable Software and Affected Versions ERP: Complete HR, Accounting & CRM Suite with Recruitment and WooCommerce CRM Support versions prior to 1.17.6 Description This issue is a generic SQL Injection, which occurs when an attacker can interfere with the queries that an application...

PT-2026-56454

Name of the Vulnerable Software and Affected Versions Adalo versions 1 through 2 Description Attackers can extract complete user records and correlate user behavior across multiple applications through the enumeration of the dbId variable. This occurs because the platform lacks data minimization,...

PT-2026-56404

Name of the Vulnerable Software and Affected Versions Essential Addons for Elementor versions prior to 6.6.3 Description Stored Cross-Site Scripting XSS occurs in the Event Calendar widget due to insufficient input sanitization and output escaping on event titles sourced from The Events Calendar...

PT-2026-56539

Name of the Vulnerable Software and Affected Versions PasswordPusher versions prior to 2.8.1 Description Insufficient validation in the valid url function allows the application to accept data URI schemes in URL push payloads. This enables attackers to create malicious pushes containing...

PT-2026-56317

The Social Share, Social Login and Social Comments Plugin – Super Socializer plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'heateor mastodon share' parameter in all versions up to, and including, 7.14.5 due to insufficient input sanitization and output escaping. Thi...

PT-2026-56455

Name of the Vulnerable Software and Affected Versions Adalo affected versions not specified Description This issue allows large-scale data harvesting without the need for app-specific secrets. A single request to a minimal leaderboard component can return user records that include emails, UUIDs,...

PT-2026-56414

Name of the Vulnerable Software and Affected Versions Blocksy Companion Pro plugin for WordPress versions prior to 2.1.47 Description An unauthenticated arbitrary file upload issue exists within the Advanced Reviews feature. The save attachments function fails to properly validate file extensions...

PT-2026-56608

Name of the Vulnerable Software and Affected Versions Appium versions prior to 10.7.0 Description The base-driver unconditionally mounts the '/test/guinea-pig', '/test/guinea-pig-scrollable', and '/test/guinea-pig-app-banner' endpoints. The compileLodashTemplate function reflects the throwError...

PT-2026-56323

Name of the Vulnerable Software and Affected Versions Bulk Order Update for WooCommerce versions prior to 1.7 Description An unauthenticated arbitrary file read exists due to the bouw fetch csv data AJAX handler being registered on the wp ajax nopriv hook without capability or nonce checks. The...

PT-2026-56552

Name of the Vulnerable Software and Affected Versions Bitwarden Server versions prior to 2026.6.0 Description An issue exists where the server fails to verify if the email address provided in the body of the 'POST /auth-requests/admin-request' endpoint belongs to the authenticated user. This allo...

PT-2026-56310

Name of the Vulnerable Software and Affected Versions Widget Logic Visual versions prior to 1.53 Description Authenticated attackers with subscriber-level access and above can achieve remote code execution on the server. The issue occurs during the widget-logic-update-conditional-tags AJAX action...

PT-2026-56530

Name of the Vulnerable Software and Affected Versions authentik versions prior to 2026.2.6 authentik versions prior to 2026.5.5 Description In enterprise deployments using a Google Chrome Endpoint stage with mode set to REQUIRED or the deprecated Google Chrome Device Trust Connector stage, the...