PT-2026-47637

Name of the Vulnerable Software and Affected Versions jQuery Hover Footnotes versions prior to 1.5 Description The plugin is subject to Cross-Site Request Forgery CSRF, a flaw where an attacker tricks a victim into performing an action they did not intend to. This occurs due to missing or incorre...

PT-2026-47673

Name of the Vulnerable Software and Affected Versions Extra Settings for RocketChat versions prior to 0.2 Description The Extra Settings for RocketChat plugin for WordPress contains a Stored Cross-Site Scripting issue. This occurs because the rxstg shortcode function fails to properly sanitize...

PT-2026-48343

Name of the Vulnerable Software and Affected Versions Symfony versions 5.4.46 through 5.4.51 Symfony versions 6.4.14 through 6.4.39 Symfony versions 7.1.7 through 7.4.11 Symfony versions 8.0.12 Description An issue exists where an unauthenticated user can modify the kernel environment and debug...

PT-2026-47681

Name of the Vulnerable Software and Affected Versions WpMobi versions prior to 0.0.4 Description The WpMobi plugin for WordPress is subject to Cross-Site Request Forgery CSRF, a flaw where an attacker tricks a victim into performing actions they did not intend to. This occurs due to missing or...

PT-2026-47638

Name of the Vulnerable Software and Affected Versions jQuery Hover Footnotes versions prior to 1.5 Description The jQuery Hover Footnotes plugin for WordPress contains a Stored Cross-Site Scripting issue involving the Footnote Qualifier '...' Syntax. Due to insufficient input sanitization and...

PT-2026-47675

Name of the Vulnerable Software and Affected Versions WP ApplicantStack Jobs Display versions prior to 1.1.2 Description Insufficient input sanitization and output escaping in shortcode attributes allow authenticated attackers with contributor-level access or higher to perform Stored Cross-Site...

PT-2026-47639

Name of the Vulnerable Software and Affected Versions Product Filter Widget for Elementor versions prior to 1.0.7 Description Insufficient input sanitization and output escaping allow unauthenticated attackers to inject arbitrary web scripts. This is achieved via a CSRF-style form auto-submission...

PT-2026-47683

Name of the Vulnerable Software and Affected Versions WP GDPR Cookie Consent versions prior to 1.0.1 Description The plugin is subject to Stored Cross-Site Scripting. Authenticated attackers with subscriber-level access or higher can inject arbitrary web scripts into pages. This occurs because th...

PT-2026-47807

Name of the Vulnerable Software and Affected Versions Ivanti Sentry versions prior to R10.5.2 Ivanti Sentry versions prior to R10.6.2 Ivanti Sentry versions prior to R10.7.1 Description An authentication bypass issue allows a remote unauthenticated attacker to create arbitrary administrative...

PT-2026-48245

Name of the Vulnerable Software and Affected Versions Acrobat Reader versions 24.001.30365 through 26.001.21651 Description An out-of-bounds write occurs during TIF file parsing due to an integer overflow. This issue allows for arbitrary code execution in the context of the current user, provided...

PT-2026-47530

Name of the Vulnerable Software and Affected Versions SAP NetWeaver Application Server Java Web Container affected versions not specified Description An unauthenticated attacker can craft a malicious HTTP logon request that manipulates file inclusion parameters. This enables path traversal, which...

PT-2026-47679

Name of the Vulnerable Software and Affected Versions FastPicker versions prior to 1.0.3 Description The FastPicker plugin for WordPress is subject to Cross-Site Request Forgery. This occurs because the settingsPage function lacks proper nonce validation, which is a unique token used to verify th...

Security fix: Addressing a low-impact Pinboards vulnerability

News, Security Security fix: Addressing a low-impact Pinboards vulnerability Share June 9th, 2026 Hi Opera users, Recently, an independent security researcher responsibly disclosed a vulnerability in Opera’s Pinboards feature, which helped our team to quickly work on a fix. The vulnerability...

PT-2026-47806

Name of the Vulnerable Software and Affected Versions Ivanti Sentry versions prior to R10.5.2 Ivanti Sentry versions prior to R10.6.2 Ivanti Sentry versions prior to R10.7.1 Description An OS command injection flaw allows a remote unauthenticated user to execute arbitrary code with root privilege...

PT-2026-48025

Name of the Vulnerable Software and Affected Versions Windows HTTP.sys affected versions not specified Description An integer overflow or wraparound exists in the Windows HTTP Protocol Stack kernel-mode driver HTTP.sys. The issue occurs during the dynamic expansion of the buffer array in the UL...

PT-2026-47722

Name of the Vulnerable Software and Affected Versions Slider Revolution versions prior to 7.0.11 Description The plugin is subject to sensitive information disclosure resulting from three design flaws. First, a valid backend AJAX nonce revslider actions is leaked to all authenticated users,...

PT-2026-47672

Name of the Vulnerable Software and Affected Versions Helpfulcrowd Product Reviews versions prior to 1.3.0 Description The Helpfulcrowd Product Reviews plugin for WordPress allows unauthenticated authorization bypass due to PHP Type Juggling. This occurs because the helpfulcrowd validate token...

WordPress plugin AJAX Report Comments 跨站请求伪造漏洞

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application extension. The...

Apache Answer 信息泄露漏洞

Apache Answer is a community platform of the Apache Foundation in the United States. Versions of Apache Answer 2.0.0 and earlier had an information leakage vulnerability. This vulnerability stemmed from the lack of access restrictions on direct API endpoints, which allowed authenticated users to...

PT-2026-48215

Name of the Vulnerable Software and Affected Versions Dell Client Platform BIOS affected versions not specified Latitude E7250 Latitude 7490 XPS 15 9560 Wyse 5070 Description An unauthenticated attacker with physical access to the SPI flash chip or an attacker-controlled OS boot can recover BIOS...