ROS-20261005-73-0023

The vulnerability in rsync is related to incorrect input of configuration data. The vulnerability can be exploited remotely...

PT-2026-106155

Name of the Vulnerable Software and Affected Versions Google Android affected versions not specified Description An out-of-bounds write can occur in multiple locations due to uninitialized data. This issue allows for remote escalation of privilege without requiring user interaction or additional...

PT-2026-106073

Insertion of Sensitive Information Into Sent Data vulnerability in Etoile Web Design Incorporated Five Star Restaurant Reservations restaurant-reservations allows Retrieve Embedded Sensitive Data.This issue affects Five Star Restaurant Reservations: from n/a through 2.7.24...

PT-2026-104781

Insertion of Sensitive Information Into Sent Data vulnerability in Pixelite Events Manager events-manager allows Retrieve Embedded Sensitive Data.This issue affects Events Manager: from n/a through 7.4.5...

PT-2026-104788

Improper Validation of Specified Quantity in Input vulnerability in Magepeople inc. Taxi Booking Manager for WooCommerce ecab-taxi-booking-manager allows Input Data Manipulation.This issue affects Taxi Booking Manager for WooCommerce: from n/a through 2.1.1...

PT-2026-106220

Name of the Vulnerable Software and Affected Versions maestro gRPC broker affected versions not specified Description A flaw in the maestro gRPC broker allows a remote attacker possessing a valid client certificate to bypass authentication. This allows the attacker to subscribe to event streams...

CVE-2026-71299: Missing Authentication for Critical Function

A flaw was found in Maestro. Its REST API write endpoints were registered without proper authentication middleware. This allows a remote attacker to perform unauthorized write operations, such as creating, modifying, or deleting consumers and resource bundles. This could lead to data integrity...

CVE-2026-39783: Missing Authorization

Missing Authorization vulnerability in WP SYNTEX Polylang polylang allows Retrieve Embedded Sensitive Data.This issue affects Polylang: from n/a through 3.8.7...

CVE-2026-63268: Exposure of Sensitive Information to an Unauthorized Actor

LibreOffice Calc can link a cell range to an external data source, and the link is saved in the document. A link of the sql type could name a folder of local text files as a database, so opening a document could read a local text file into the sheet. In fixed versions only the csv, html and xml...

CVE-2026-63270: Exposure of Sensitive Information to an Unauthorized Actor

URLs could be constructed which expanded environment variable or INI file values, so potentially sensitive information could be exfiltrated to a remote server on opening a document containing such links. The check added for CVE-2024-12426 did not cover every place a document can supply a URL...

CVE-2026-93319: Unsynchronized Access to Shared Data in a Multithreaded Context

A malicious external BuildKit frontend can send requests using the internal API that can create conditions for a data race that can cause the BuildKit daemon to panic...

PT-2026-104815

LibreOffice Calc can link a cell range to an external data source, and the link is saved in the document. A link of the sql type could name a folder of local text files as a database, so opening a document could read a local text file into the sheet. In fixed versions only the csv, html and xml...

PT-2026-104801

The JavaScript preprocessing Duktape engine on Zabbix server has a vulnerability where a limited administrator is able to read raw heap data potentially resulting in leaked data from other running preprocessors not available to said administrator...

PT-2026-104817

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description Opening a document containing specially crafted links allows the construction of URLs that expand environment variable or INI file values. This can lead to the...

PT-2026-106065

A malicious external BuildKit frontend can send requests using the internal API that can create conditions for a data race that can cause the BuildKit daemon to panic...

CVE-2026-59782: Out-of-bounds Read

The JavaScript preprocessing Duktape engine on Zabbix server has a vulnerability where a limited administrator is able to read raw heap data potentially resulting in leaked data from other running preprocessors not available to said administrator...

Containerd Code Execution

The vulnerability of the Containerd process for importing the CRI of the runtime environment is related to insufficient verification of data authenticity. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

CVE-2026-103348: Deserialization of Untrusted Data

Deserialization of Untrusted Data vulnerability in Smackcoders Inc. WP Ultimate Exporter wp-ultimate-exporter allows Object Injection.This issue affects WP Ultimate Exporter: from n/a through 3.0...

CVE-2026-97257: Deserialization of Untrusted Data

Deserialization of Untrusted Data vulnerability in PressTigers Simple Event Planner simple-event-planner allows Object Injection.This issue affects Simple Event Planner: from n/a through 1.5.7...

CVE-2026-93617: Deserialization of Untrusted Data

Deserialization of Untrusted Data vulnerability in WP Sunshine Sunshine Photo Cart sunshine-photo-cart allows Object Injection.This issue affects Sunshine Photo Cart: from n/a through 3.7.1...