abrt: unsanitized systemd journal content written to dump directory files enables content injection

A content injection vulnerability was found in the ABRT post-create event handler scripts in libreport. The event script queries the systemd journal for log entries matching the crashed process and writes the results to files in the dump directory without sanitizing embedded control characters. A...

PT-2026-96059

Name of the Vulnerable Software and Affected Versions To Do List Member WordPress plugin versions prior to 1.7 Description An import routine lacks authorization and nonce checks, and fails to validate the source location of fetched data. This allows unauthenticated users to create arbitrary...

PT-2026-96102

Name of the Vulnerable Software and Affected Versions Beszel versions prior to 0.19.0 Description An insecure direct object reference occurs in the 'POST' and 'DELETE' '/api/beszel/user-alerts' endpoints. This allows authenticated users to create or delete alerts for systems they are not authoriz...

PT-2026-95931

Name of the Vulnerable Software and Affected Versions Import and export users and customers versions prior to 2.5.2 Description Insufficient enforcement of the promote users capability within the front-end import functionality allows users who possess only the create users capability to modify th...

PT-2026-96001

Name of the Vulnerable Software and Affected Versions 03-lovepreetSingh MCP versions up to f95d035c5317fad81af9828286631053ccb23546 Description A remote path traversal issue exists in the create file function within the 'app/api/mcp/route.ts' file. This occurs when the filePath or content argumen...

CVE-2026-85706

CVE-2026-85706 GitLab CE および EE における未認証のパストラバーサル / 任意ファイル読み取り。 CVSS 10.0。ローカルラボの自己管理型 19.3.1 インスタンスに対して検証済み。 影響を受けるバージョン GitLab CE/EE: 18.7 から 19.1.7 まで 19.2.0 から 19.2.5 まで 19.3.0 から 19.3.1 まで 前提条件: インスタンスに少なくとも 1 つの公開プロジェクトが存在すること。任意の実在するプロジェクト id で動作する。アカウントやトークンは不要。 仕組み create-commit エンドポイント...

CVE-2026-13191

The Create plugin for WordPress is vulnerable to generic SQL Injection via the 'orderby' parameter in all versions up to, and including, 2.5.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for...

CVE-2026-13200

The Create plugin for WordPress is vulnerable to generic SQL Injection via the 'order' parameter in all versions up to, and including, 2.5.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for...

EUVD-2026-83551

The Create plugin for WordPress is vulnerable to generic SQL Injection via the 'order' parameter in all versions up to, and including, 2.5.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for...

CVE-2026-13200 Create <= 2.5.3 - Authenticated (Author+) SQL Injection via 'order' Parameter

The Create plugin for WordPress is vulnerable to generic SQL Injection via the 'order' parameter in all versions up to, and including, 2.5.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for...

CVE-2026-13200

The Create plugin for WordPress (by Mediavine) is vulnerable to generic SQL injection via the 'order' parameter in all versions up to and including 2.5.3 . The root cause is insufficient escaping and inadequate preparation of the SQL query. The vulnerable code path in the advanced-filter branch i...

CVE-2026-13200 Create <= 2.5.3 - Authenticated (Author+) SQL Injection via 'order' Parameter

The Create plugin for WordPress is vulnerable to generic SQL Injection via the 'order' parameter in all versions up to, and including, 2.5.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for...

CVE-2026-13191 Create <= 2.5.3 - Authenticated (Author+) SQL Injection via 'order_by' Parameter

The Create plugin for WordPress is vulnerable to generic SQL Injection via the 'orderby' parameter in all versions up to, and including, 2.5.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for...

CVE-2026-13191

The Create plugin for WordPress (by MediaVine ) is affected by a generic SQL injection in the order_by parameter, present in all versions up to and including 2.5.3 . The root cause is insufficient escaping of the user-supplied parameter combined with lack of proper preparation of the existing SQL...

EUVD-2026-83543

The Create plugin for WordPress is vulnerable to generic SQL Injection via the 'orderby' parameter in all versions up to, and including, 2.5.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for...

CVE-2026-13191 Create <= 2.5.3 - Authenticated (Author+) SQL Injection via 'order_by' Parameter

The Create plugin for WordPress is vulnerable to generic SQL Injection via the 'orderby' parameter in all versions up to, and including, 2.5.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for...

CVE-2026-11899 PDF Builder for WooCommerce. Create invoices,packing slips and more <= 2.0.11 - Missing Authorization to Authenticated (Subscriber+) Sensitive Invoice Data Disclosure via GetInvoiceDetail AJAX Handler

The PDF Builder for WooCommerce. Create invoices,packing slips and more plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.0.11. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible...

CVE-2026-1242: Incorrect Authorization

The BlockSpare plugin for WordPress is vulnerable to authorization bypass due to incorrect logic in the permission callback in all versions up to, and including, 4.2.6 due to the use of an AND && operator instead of an OR || operator. This makes it possible for authenticated attackers, with...

PT-2026-95774

Name of the Vulnerable Software and Affected Versions BlockSpare versions prior to 4.2.7 Description The BlockSpare plugin for WordPress contains an authorization bypass flaw caused by incorrect logic within the permission callback. The issue stems from the use of an AND && operator instead of an...

PT-2026-95775

Name of the Vulnerable Software and Affected Versions Create plugin for WordPress versions prior to 2.5.4 Description An issue exists where authenticated attackers with author-level access or higher can perform a SQL Injection. This occurs because the order by parameter is not sufficiently escape...