PT-2026-79301

Name of the Vulnerable Software and Affected Versions Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin versions prior to 5.0.14 Description An unauthenticated store REST endpoint fails to restrict access to per-vendor commission configurations. This allows any...

PT-2026-79533

Name of the Vulnerable Software and Affected Versions Post Duplicator versions prior to 3.0.12 Description The Post Duplicator plugin for WordPress allows unauthorized modification of data because the duplicate post function fails to verify if a user possesses the edit others posts capability. Th...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-102086)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-102086 advisory. In the Linux kernel, the following vulnerability has been resolved: net: usb: pegasus: validate USB endpoints The pegasus driver should validate that the device it i...

PT-2026-79285

OS command injection in the api endpoint of Datiphy Data Management Center from v8.3.0 through v8.5.1 allows an authenticated administrator to execute arbitrary operating system commands as root...

PT-2026-79431

A vulnerability was identified in Dromara RuoYi-Vue-Plus up to 5.6.2. This issue affects the function FlwInstanceController/FlwDefinitionController/FlwCategoryController/FlwSpelController/TestLeaveController of the component Workflow Endpoint. Such manipulation leads to improper authorization. Th...

Gitea POST /api/v1/repos Component Unauthorized Access

The vulnerability of the POST /api/v1/repos/owner/repo/merge-upstream component of the Git repository management system Gitea is related to the lack of protection for service data. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected...

Grafana Alertmanager Templates Test Endpoint DoS

The vulnerability of the Alertmanager Templates Test Endpoint component of the Grafana monitoring and logging platform involves an uncontrolled consumption of resources. Exploiting this vulnerability could allow a malicious actor to cause service interruptions...

CVE-2026-62945

TREK is a collaborative travel planner. Prior to 3.1.3, TREK file upload, update, and link actions accept attacker-controlled reservationid, placeid, and assignmentid values without using findForeignLinkTarget to verify that the referenced object belongs to the file's trip. An authenticated user...

CVE-2026-49217 Mailu missing authentication on PATCH /api/v1/token/<id>, which allows unauthenticated removal of IP restrictions

Mailu is a mail server as a set of Docker images. Prior to version 2024.06.52, a missing authorization check in the Mailu admin REST API allows any unauthenticated attacker to remove any potential IP restriction or update the comment field from any existing user token provided the REST API is...

CVE-2026-72846 Lightdash Scheduled Delivery Webhook URLs Are Not Validated, Allowing Server-Side Request Forgery

Lightdash stores the webhook URL supplied with a scheduled delivery and later posts to it from sendWebhook in packages/backend/src/clients/GoogleChat/GoogleChatClient.ts and in packages/backend/src/clients/MicrosoftTeams/MicrosoftTeamsClient.ts. In affected versions both call fetch on the stored...

CVE-2026-72843 EverShop Missing Authorization on PATCH /api/customers/:id Allows Unauthenticated Account Takeover

The customer update route in EverShop is declared with "access": "public" in packages/evershop/src/modules/customer/api/updateCustomer/route.json, which causes the admin authentication middleware to call next without checking the caller, and no customer-session middleware guards the route; the on...

CVE-2026-54508

TREK , a collaborative travel planner, is affected by a blind SSRF vulnerability prior to version 3.1.0. The root cause is that importGoogleList(), importNaverList() in placeService.ts and resolveGoogleMapsUrl() in mapsService.ts validate only the initial URL via checkSsrf() but then use fetch() ...

CVE-2026-46355 BigBlueButton: Unauthenticated Session Hijack via Exposed /bigbluebutton/api/handleJoinExistingUser

BigBlueButton is an open-source virtual classroom. Prior to 3.0.23, BigBlueButton exposed /bigbluebutton/api/handleJoinExistingUser through bigbluebutton-web/grails-app/controllers/org/bigbluebutton/web/controllers/ApiController.groovy. A requester able to supply an existingUserID for an active...

CVE-2026-46355

BigBlueButton prior to 3.0.23 exposed the /bigbluebutton/api/handleJoinExistingUser endpoint through a routable controller action in ApiController.groovy rather than a private helper. An authenticated requester who could supply the existingUserID of an active participant was able to reuse that pa...

CVE-2026-67446

Mailpit is an email testing tool and API for developers. Prior to 1.30.4, Mailpit decodes attacker-supplied image attachments into a full raster before checking decoded dimensions, pixel count, or memory use in the GET /api/v1/message/id/part/partID/thumb endpoint. The Thumbnail handler in...

CVE-2026-67446

Mailpit , an email testing tool and API for developers, is vulnerable to a memory exhaustion issue in its thumbnail generation endpoint (GET /api/v1/message/{id}/part/{partID}/thumb). The handler in server/apiv1/thumbnails.go calls imaging.Decode() with AutoOrientation on attacker-supplied image ...

CVE-2026-67446 Mailpit: Thumbnail generation decodes unbounded image dimensions before scaling

Mailpit is an email testing tool and API for developers. Prior to 1.30.4, Mailpit decodes attacker-supplied image attachments into a full raster before checking decoded dimensions, pixel count, or memory use in the GET /api/v1/message/id/part/partID/thumb endpoint. The Thumbnail handler in...

CVE-2026-58427

A flaw was found in Gitea. An incomplete fix for a previous vulnerability allowed any authenticated user to enumerate all members of a private organization through the /members API endpoint. This information disclosure could expose sensitive details about an organization's internal structure and...

CVE-2026-62315

Frappe is a full-stack web application framework. In version 16.31.0 and earlier, frappe.client.setvalue in frappe/client.py checks a dictionary supplied through the fieldname parameter against forbidden standard and child-table fields before parsing the dictionary into individual field names. An...

CVE-2026-61663

django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.9, renderobjectstructure fails to authorize non-PageContent objects that use PlaceholderRelationField. An active staff user without cms.usestructure or model-level view or chan...