384103 matches found
PT-2026-106093
Name of the Vulnerable Software and Affected Versions BuildKit – Product Builder for WooCommerce – Custom PC Builder versions prior to 1.0.29 Description Improper validation of the specified quantity in the input allows for input data manipulation within the woo-product-builder component...
PT-2026-106074
Name of the Vulnerable Software and Affected Versions Product Feed PRO for WooCommerce versions prior to 13.5.8 Description Deserialization of untrusted data in the woo-product-feed-pro plugin allows Object Injection. Object Injection occurs when an application deserializes untrusted data,...
PT-2026-106220
Name of the Vulnerable Software and Affected Versions maestro gRPC broker affected versions not specified Description A flaw in the maestro gRPC broker allows a remote attacker possessing a valid client certificate to bypass authentication. This allows the attacker to subscribe to event streams...
PT-2026-106195
Deserialization of Untrusted Data vulnerability in PressTigers Simple Event Planner simple-event-planner allows Object Injection.This issue affects Simple Event Planner: from n/a through 1.5.7...
PT-2026-106191
A flaw was found in Maestro. Its REST API write endpoints were registered without proper authentication middleware. This allows a remote attacker to perform unauthorized write operations, such as creating, modifying, or deleting consumers and resource bundles. This could lead to data integrity...
PT-2026-106190
A flaw was found in maestro. A remote attacker could exploit a SQL injection vulnerability in the orderBy query parameter of its REST API list endpoints. This flaw, which does not require authentication, allows for read-only blind extraction of data from the database...
PT-2026-106098
Name of the Vulnerable Software and Affected Versions RepairBuddy versions prior to 4.1226 Description A missing authorization flaw in the computer-repair-shop component allows the retrieval of embedded sensitive data. Recommendations Update to version 4.1226 or later...
PT-2026-106171
Name of the Vulnerable Software and Affected Versions WP Ultimate Exporter versions prior to 3.0 Description An issue involving the deserialization of untrusted data in the wp-ultimate-exporter component allows for Object Injection. Object Injection occurs when untrusted data is used to abuse the...
CVE-2026-88394
WookTeam v1.6.6 and before is vulnerable to a Directory Traversal. The project task export endpoint /api/project/task/export downloads an arbitrary file from the server when the data parameter is supplied with a crafted JSON payload. The file value inside the JSON is concatenated directly into...
PT-2026-104815
LibreOffice Calc can link a cell range to an external data source, and the link is saved in the document. A link of the sql type could name a folder of local text files as a database, so opening a document could read a local text file into the sheet. In fixed versions only the csv, html and xml...
PT-2026-104781
Insertion of Sensitive Information Into Sent Data vulnerability in Pixelite Events Manager events-manager allows Retrieve Embedded Sensitive Data.This issue affects Events Manager: from n/a through 7.4.5...
PT-2026-104788
Improper Validation of Specified Quantity in Input vulnerability in Magepeople inc. Taxi Booking Manager for WooCommerce ecab-taxi-booking-manager allows Input Data Manipulation.This issue affects Taxi Booking Manager for WooCommerce: from n/a through 2.1.1...
PT-2026-104801
The JavaScript preprocessing Duktape engine on Zabbix server has a vulnerability where a limited administrator is able to read raw heap data potentially resulting in leaked data from other running preprocessors not available to said administrator...
PT-2026-106273
Name of the Vulnerable Software and Affected Versions Dify versions prior to 1.16.0 Description An authenticated workspace member can modify the status and parameters of another application's MCP server, which could lead to service disruption or data redirection. This occurs because the...
CVE-2026-88394
WookTeam versions v1.6.6 and before are vulnerable to a Directory Traversal flaw within the project task export endpoint (/api/project/task/export). The root cause is the lack of path normalization or directory boundary checks when processing the data parameter. Specifically, a crafted JSON paylo...
PT-2026-104764
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Memberful Memberful - Membership Plugin memberful-wp allows Retrieve Embedded Sensitive Data.This issue affects Memberful - Membership Plugin: from n/a through 1.81.2...
PT-2026-104809
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Arraytics WP Event Solution wp-event-solution allows Retrieve Embedded Sensitive Data.This issue affects WP Event Solution: from n/a through 4.1.25...
PT-2026-106281
Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.13, packages/server/src/models/ApplicationModel.ts accepts a caller-chosen application authorization identifier, applications/:id/confirm binds that identifier to a logged-in use...
PT-2026-106136
Name of the Vulnerable Software and Affected Versions Apache Struts versions 2.0.0 through 2.3.37 Apache Struts versions 2.5.0 through 2.5.33 Apache Struts versions 6.0.0 through 6.11.0 Apache Struts versions 7.0.0 through 7.3.0 Description A race condition occurs when a localized message formats...
