UBUNTU-CVE-2026-66047

ProfilePress wp-user-avatar WordPress plugin before 4.17.2 contains an unauthenticated remote code execution vulnerability that allows unauthenticated attackers to install and activate arbitrary plugins by brute-forcing a weak 32-bit connect token via the ppressconnectprocess AJAX handler...

PT-2026-84106

The Support Genix – Helpdesk, AI Chatbot, Knowledge Base & Customer Support Ticketing System plugin for WordPress is vulnerable to Authentication Bypass leading to Administrator Account Takeover in all versions up to, and including, 1.4.52 via the guest ticket login function and its p parameter...

ROS-20260901-73-0001

The vulnerability of the SoapServer class in the PHP programming language is related to the use of memory after it is freed during the processing of the SOAPPERSISTENCESESSION parameter. Exploiting this vulnerability can allow a malicious actor to disclose sensitive information or cause service...

ROS-20260901-73-0002

The vulnerability of the SoapServer class in the PHP programming language is related to the use of memory after it is freed during the processing of the SOAPPERSISTENCESESSION parameter. Exploiting this vulnerability can allow a malicious actor to disclose sensitive information or cause service...

Alibaba Cloud Linux 3 : 0264: freerdp (ALINUX3-SA-2026:0264)

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2026:0264 advisory. Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities: CVE-2026-64624: FreeRDP before 3.28.0 trea...

Linux Distros Unpatched Vulnerability : CVE-2024-58379

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - nodemailer before 6.9.9 contains a regular expression denial of service vulnerability in email parsing when attachDataUrls parameter is set or processing embedd...

PT-2026-84112

The LearnPress plugin for WordPress is vulnerable to SQL Injection via the 'orderby' parameter of the export order csv AJAX action in versions up to, and including, 4.4.4. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...

PT-2026-84118

The Charitable – Donation & Fundraising Platform Donation Forms, Recurring Donations & Fundraising Campaigns plugin for WordPress is vulnerable to generic SQL Injection via 'order' Shortcode Attribute in all versions up to, and including, 1.8.12.1 due to insufficient escaping on the user supplied...

PT-2026-84153

LibreNMS versions before 26.5.0 contain a remote code execution vulnerability in the AboutController where the snmpget configuration parameter is passed to shell exec without proper validation. An authenticated administrator can modify the snmpget configuration to point to a malicious executable...

Alibaba Cloud Linux 3 : 0265: bind (ALINUX3-SA-2026:0265)

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2026:0265 advisory. Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities: CVE-2026-10723: BIND may accept incorrect...

CVE-2026-66047

ProfilePress wp-user-avatar WordPress plugin before 4.17.2 contains an unauthenticated remote code execution vulnerability that allows unauthenticated attackers to install and activate arbitrary plugins by brute-forcing a weak 32-bit connect token via the ppressconnectprocess AJAX handler...

CVE-2024-58379

nodemailer before 6.9.9 contains a regular expression denial of service vulnerability in email parsing when attachDataUrls parameter is set or processing embedded file attachments. Attackers can send specially crafted emails with malicious data URLs or embedded attachments to cause the event loop...

UBUNTU-CVE-2026-82853

Nodemailer versions before 8.0.5 contain an SMTP command injection vulnerability in the transport name option used in EHLO/HELO commands. The name parameter is concatenated directly into SMTP commands without sanitizing carriage return and line feed characters, allowing attackers to inject...

PT-2026-84102

The Shopping Cart & eCommerce Store plugin for WordPress is vulnerable to generic SQL Injection via the 'product order' parameter in all versions up to, and including, 5.9.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query...

Alibaba Cloud Linux 3 : 0268: glib2 (ALINUX3-SA-2026:0268)

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2026:0268 advisory. Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities: CVE-2026-15588: A denial-of-service and...

PT-2026-84529

Proxmox Virtual Environment VE 7.0 through 8.0 contains an authentication bypass vulnerability in libpve-access-control before 8.0.4 that allows unauthenticated attackers to authenticate as any existing enabled user without a configured second factor by supplying an arbitrary tfa-challenge value ...

PT-2026-84379

Name of the Vulnerable Software and Affected Versions sqlparse versions prior to 0.6.0 Description An issue exists when SQL is formatted with reindentation enabled, where the ReindentFilter repeatedly rebuilds prefixes of the current statement to calculate token offsets. An attacker providing a...

PT-2026-84294

The FS-Poster plugin for WordPress is vulnerable to Remote Code Execution in versions up to and including 8.0.1. This is due to insufficient input sanitization of the FFmpeg path parameter before passing it to the exec function, combined with missing authorization checks on the REST API endpoints...

PT-2026-84377

Wyoming before 1.10.2 contains a server-side request forgery vulnerability that allows unauthenticated attackers with network access to force outbound connections to arbitrary targets by supplying a malicious uri query parameter to the HTTP API. Attackers can pass arbitrary tcp:// or unix:// URIs...

PT-2026-84537

WWBN AVideo contains a path traversal vulnerability in the API get api login code endpoint that allows unauthenticated attackers to delete arbitrary .log files by supplying directory traversal sequences in the code parameter. Attackers can exploit this to destroy audit logs and probe for file...