CVE-2025-56589

A Local File Inclusion LFI and a Server-Side Request Forgery SSRF vulnerability was found in the InsertFromHtmlString function of the Apryse HTML2PDF SDK thru 11.6.0. These vulnerabilities could allow an attacker to read local files on the server or make arbitrary HTTP requests to internal or...

PT-2026-4050

Name of the Vulnerable Software and Affected Versions Deetronix Booking Ultra Pro versions through 1.1.23 Description A flaw exists in Deetronix Booking Ultra Pro that allows for the retrieval of embedded sensitive data due to the insertion of sensitive information into sent data. The affected...

Apryse HTML2PDF SDK has security vulnerabilities

The Apryse HTML2PDF SDK is a file format conversion component developed by the American company Apryse. Versions of the Apryse HTML2PDF SDK 11.6.0 and earlier contained security vulnerabilities. These vulnerabilities stemmed from the InsertFromHtmlString function, which had issues with local file...

PT-2026-4034

Name of the Vulnerable Software and Affected Versions Dimitri Grassi Salon booking system versions prior to and including 10.30.3 Description The Salon booking system contains a flaw that allows the retrieval of embedded sensitive data, potentially exposing system information to unauthorized...

CVE-2026-24042: Missing Authorization

Appsmith is a platform to build admin panels, internal tools, and dashboards. In versions 1.94 and below, publicly accessible apps allow unauthenticated users to execute unpublished edit-mode actions by sending viewMode=false or omitting it to POST /api/v1/actions/execute. This bypasses the...

The vulnerability of the mask_secret() function in the Apache Airflow network programming environment allows a hacker to gain unauthorized access to protected information.

The vulnerability of the masksecret function in the Apache Airflow network programming environment is related to insufficient protection of operational data when processing template fields. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to...

PT-2026-4000

Insertion of Sensitive Information Into Sent Data vulnerability in Johan Jonk Stenström Cookies and Content Security Policy cookies-and-content-security-policy allows Retrieve Embedded Sensitive Data.This issue affects Cookies and Content Security Policy: from n/a through = 2.34...

Atomberg Erica Smart Fan security vulnerability

The Atomberg Erica Smart Fan is a smart ceiling fan produced by the Indian company Atomberg. Version 1.0.36 of the Atomberg Erica Smart Fan contains a security vulnerability. This vulnerability stems from a specially crafted authentication frame, which could allow attackers to obtain sensitive...

PT-2026-3916

Appsmith and Affected Versions Appsmith versions 1.94 and below Description Appsmith is a platform used for building admin panels, internal tools, and dashboards. Publicly accessible applications in versions 1.94 and below are susceptible to a bypass of the expected publish boundary...

PT-2026-3884

Name of the Vulnerable Software and Affected Versions Altium Designer version 24.9.0 Description Altium Designer does not validate self-signed server certificates for cloud connections. This could allow an attacker performing a man-in-the-middle MITM attack to intercept or manipulate network...

ROS-20260122-73-0027

Vulnerability in httpd related to a flaw in the output encoding or escaping mechanism. Exploitation of the vulnerability allows a remote attacker to gain access to sensitive data...

WordPress plugin Nexter Blocks has a security vulnerability

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application extension. There ar...

PT-2026-4002

Name of the Vulnerable Software and Affected Versions sizam REHub Framework versions prior to 19.9.9.4 Description A flaw exists in the sizam REHub Framework, specifically in the rehub-framework component, that allows for the retrieval of embedded sensitive data. This results in the exposure of...

PT-2026-3885

Name of the Vulnerable Software and Affected Versions openCryptoki versions 2.3.2 and above Description openCryptoki is a PKCS11 library used on Linux and AIX systems. Versions 2.3.2 and above are susceptible to symlink-following when operating in privileged contexts. A user belonging to the...

CVE-2026-23990

The Flux Operator is a Kubernetes CRD controller that manages the lifecycle of CNCF Flux CD and the ControlPlane enterprise distribution. Starting in version 0.36.0 and prior to version 0.40.0, a privilege escalation vulnerability exists in the Flux Operator Web UI authentication code that allows...

Flux Operator Web UI Impersonation Bypass via Empty OIDC Claims

A privilege escalation vulnerability exists in the Flux Operator Web UI authentication code that allows an attacker to bypass Kubernetes RBAC impersonation and execute API requests with the operator's service account privileges. After OIDC token claims are processed through CEL expressions, there...

GHSA-4XH5-JCJ2-CH8Q Flux Operator Web UI Impersonation Bypass via Empty OIDC Claims

A privilege escalation vulnerability exists in the Flux Operator Web UI authentication code that allows an attacker to bypass Kubernetes RBAC impersonation and execute API requests with the operator's service account privileges. After OIDC token claims are processed through CEL expressions, there...

WordPress B Accordion plugin <= 2.0.1 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by theviper17 in WordPress Plugin B Accordion versions = 2.0.1...

WordPress Tabby Checkout plugin <= 5.8.4 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by benzdeus in WordPress Plugin Tabby Checkout versions = 5.8.4...

WordPress Salon booking system plugin <= 10.30.3 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by daroo in WordPress Plugin Salon booking system versions = 10.30.3...