PT-2026-97109

Name of the Vulnerable Software and Affected Versions plone.app.dexterity versions prior to 3.2.3 plone.app.dexterity versions 4.0.0 through 4.1.2 plone.app.dexterity version 5.0.0 plone.app.contenttypes versions prior to 3.0.12 plone.app.contenttypes versions 4.0.0 through 4.0.9...

PT-2026-96760

MarketKing plugin for WordPress before 2.1.72 contains a missing authorization vulnerability in the marketking get page content AJAX action that allows authenticated attackers with subscriber-level access or higher to access arbitrary vendor administrator panel pages by supplying an arbitrary...

PT-2026-96941

Name of the Vulnerable Software and Affected Versions CAI Content Credentials affected versions not specified Description An improper input validation issue allows for a security feature bypass. An attacker can exploit this to obtain unauthorized limited write access. This requires user...

PT-2026-97019

Name of the Vulnerable Software and Affected Versions SIPGO versions prior to 1.4.1 Description An unauthenticated peer can cause a denial of service by sending a stream-transport message over TCP, TLS, WS, or WSS with an oversized declared length. The ParserStream.parseSingle function in...

PT-2026-96937

Name of the Vulnerable Software and Affected Versions CAI Content Credentials affected versions not specified Description Improper input validation can lead to an application denial-of-service, allowing an attacker to crash the application. Exploitation requires user interaction, such as visiting...

PT-2026-96962

Name of the Vulnerable Software and Affected Versions CAI Content Credentials affected versions not specified Description An Integer Overflow or Wraparound issue exists, which can lead to an application denial-of-service. An attacker can cause the application to crash by inducing a victim to visi...

PT-2026-96654

Name of the Vulnerable Software and Affected Versions BM Content Builder versions prior to 3.17.1 Description An issue exists where authenticated users with Subscriber-level access and above can perform Directory Traversal, a technique used to access files and directories that are stored outside...

PT-2026-96939

CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue requires user interaction in...

CVE-2026-76194: Improper Input Validation

CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized limited write access. Exploitation of this issue requires user...

PT-2026-96655

Name of the Vulnerable Software and Affected Versions BM Content Builder versions prior to 3.17.1 Description Insufficient file path validation in the ux cb remove layout ajax and ux cb tools export ajax functions allows authenticated attackers with Subscriber-level access and above to delete...

CVE-2026-88415

MCMS 6.1.1 through 6.2.1 is vulnerable to stored Cross-Site Scripting XSS. The article content field contentDetails is excluded from the global XSS filter...

CVE-2026-75638: Improper Input Validation

CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue requires user interaction in...

CVE-2026-89277: Integer Overflow or Wraparound

CAI Content Credentials is affected by an Integer Overflow or Wraparound vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue requires user...

EUVD-2026-84857

CMSimple 5.24 ships with CSRF protection disabled by default, which turns csrfProtection into a no-op on every state-changing admin request, and it does not send the csrftoken hidden field in admin forms. Because administrator authentication is cookie-only and no CSRF token is enforced, an...

PT-2026-96659

Name of the Vulnerable Software and Affected Versions Custom Field Template versions prior to 2.7.9 Description The plugin contains an Insecure Direct Object Reference IDOR flaw, which occurs when an application provides direct access to objects based on user-supplied input. The issue exists in t...

APSB26-147 : Security updates available for Content Credentials SDK

Adobe has released a security update for Content Credentials SDK. This update addresses critical and important vulnerabilities that could result in security feature bypass and application denial-of-service. Adobe is not aware of any exploits in the wild for any of the issues addressed in this...

CVE-2026-59815

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.7, Joplin Server's ItemModel.checkIfAllowed authorizes writes to items with a share ID when any shareusers row exists for the caller, without requiring ShareUserStatus.Accepted. ...

CVE-2026-59814

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.7, Joplin Server's GET /shares/:id?resourceid= route serves a resource with the attacker-controlled mime value and omits Content-Disposition when the resource title is empty. A...

CVE-2026-61541

Zapros, a Python HTTP client, prior to version 0.14.0 is vulnerable to denial of service when an application requests content from an untrusted server, or follows a redirect to one, because a malicious response containing an excessive number of chained Content-Encoding values causes Zapros to...

CVE-2026-61541 Zapros has an Unbounded Content-Encoding decompression chain that allows denial of service

Zapros, a Python HTTP client, prior to version 0.14.0 is vulnerable to denial of service when an application requests content from an untrusted server, or follows a redirect to one, because a malicious response containing an excessive number of chained Content-Encoding values causes Zapros to...