CVE-2026-88394

WookTeam v1.6.6 and before is vulnerable to a Directory Traversal. The project task export endpoint /api/project/task/export downloads an arbitrary file from the server when the data parameter is supplied with a crafted JSON payload. The file value inside the JSON is concatenated directly into...

PT-2026-106281

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.13, packages/server/src/models/ApplicationModel.ts accepts a caller-chosen application authorization identifier, applications/:id/confirm binds that identifier to a logged-in use...

PT-2026-106193

Deserialization of Untrusted Data vulnerability in WP Sunshine Sunshine Photo Cart sunshine-photo-cart allows Object Injection.This issue affects Sunshine Photo Cart: from n/a through 3.7.1...

CVE-2026-93617: Deserialization of Untrusted Data

Deserialization of Untrusted Data vulnerability in WP Sunshine Sunshine Photo Cart sunshine-photo-cart allows Object Injection.This issue affects Sunshine Photo Cart: from n/a through 3.7.1...

ROS-20261005-73-0023

The vulnerability in rsync is related to incorrect input of configuration data. The vulnerability can be exploited remotely...

ROS-20261005-73-0043

The vulnerability in expat is related to synchronization errors. Exploiting this vulnerability can allow an attacker to gain read, modify, or delete access to data, or cause a service failure...

The vulnerability of the Setup Wizard component in Android operating systems allows a hacker to gain increased privileges.

The vulnerability of the Setup Wizard component in Android operating systems is related to a breach of data protection mechanisms. Exploiting this vulnerability allows an attacker who operates remotely to enhance their privileges...

PT-2026-106191

A flaw was found in Maestro. Its REST API write endpoints were registered without proper authentication middleware. This allows a remote attacker to perform unauthorized write operations, such as creating, modifying, or deleting consumers and resource bundles. This could lead to data integrity...

PT-2026-104801

The JavaScript preprocessing Duktape engine on Zabbix server has a vulnerability where a limited administrator is able to read raw heap data potentially resulting in leaked data from other running preprocessors not available to said administrator...

PT-2026-104817

URLs could be constructed which expanded environment variable or INI file values, so potentially sensitive information could be exfiltrated to a remote server on opening a document containing such links. The check added for CVE-2024-12426 did not cover every place a document can supply a URL...

PT-2026-106171

Name of the Vulnerable Software and Affected Versions WP Ultimate Exporter versions prior to 3.0 Description An issue involving the deserialization of untrusted data in the wp-ultimate-exporter component allows for Object Injection. Object Injection occurs when untrusted data is used to abuse the...

PT-2026-106220

Name of the Vulnerable Software and Affected Versions maestro gRPC broker affected versions not specified Description A flaw in the maestro gRPC broker allows a remote attacker possessing a valid client certificate to bypass authentication. This allows the attacker to subscribe to event streams...

CVE-2026-71297: Missing Authentication for Critical Function

A flaw was found in the maestro gRPC broker. This vulnerability allows a remote attacker, with a valid client certificate, to bypass authentication. This bypass enables the attacker to subscribe to other consumers' event streams, leading to unauthorized information disclosure, or to publish forge...

CVE-2026-88394: Improper Limitation of a Pathname to a Restricted Directory

WookTeam v1.6.6 and before is vulnerable to a Directory Traversal. The project task export endpoint /api/project/task/export downloads an arbitrary file from the server when the data parameter is supplied with a crafted JSON payload. The file value inside the JSON is concatenated directly into...

CVE-2026-63268: Exposure of Sensitive Information to an Unauthorized Actor

LibreOffice Calc can link a cell range to an external data source, and the link is saved in the document. A link of the sql type could name a folder of local text files as a database, so opening a document could read a local text file into the sheet. In fixed versions only the csv, html and xml...

CVE-2026-63267: Server-Side Request Forgery (SSRF)

LibreOffice Calc can link a cell range to an external csv data source, and the link is saved in the document. Such a link was fetched while the document loaded, so opening a document could read a local file into the sheet, or make a request to a host of the document's choosing. In fixed versions...

CVE-2026-63270: Exposure of Sensitive Information to an Unauthorized Actor

URLs could be constructed which expanded environment variable or INI file values, so potentially sensitive information could be exfiltrated to a remote server on opening a document containing such links. The check added for CVE-2024-12426 did not cover every place a document can supply a URL...

CVE-2026-105073: Exposure of Sensitive System Information to an Unauthorized Control Sphere

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Arraytics WP Event Solution wp-event-solution allows Retrieve Embedded Sensitive Data.This issue affects WP Event Solution: from n/a through 4.1.25...

CVE-2026-103348: Deserialization of Untrusted Data

Deserialization of Untrusted Data vulnerability in Smackcoders Inc. WP Ultimate Exporter wp-ultimate-exporter allows Object Injection.This issue affects WP Ultimate Exporter: from n/a through 3.0...

CVE-2026-100511: Deserialization of Untrusted Data

Deserialization of Untrusted Data vulnerability in Vektor Inc. VK Google Job Posting Manager vk-google-job-posting-manager allows Object Injection.This issue affects VK Google Job Posting Manager: from n/a through 1.3.1...