CVE-2026-15993

The Form Maker by 10Web WordPress plugin (vulnerable up to 1.15.44) is affected by a blind SQL Injection in the Dynamic-Choice Field WHERE clause that references the {username} placeholder. Root cause: insufficient escaping of the user-supplied parameter and inadequate preparation of the existing...

CVE-2026-15993 Form Maker by 10Web <= 1.15.44 - Authenticated (Subscriber+) SQL Injection via '{username}' Placeholder in Dynamic-Choice Field WHERE Clause

The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to blind SQL Injection via 'username' Placeholder in Dynamic-Choice Field WHERE Clause in all versions up to, and including, 1.15.44 due to insufficient escaping on the user supplied...

CVE-2026-15001

The bLoyal: Loyalty & Promotions by bLoyal plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.1.611.78. This is due to the AJAX actions savebloyalconfigurationdata and savebloyalaccesskeyverificationdata being registered without any capability or...

CVE-2026-15312

The Propovoice: All-in-One Client Management System plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.7.8. This is due to the create function's REST endpoint failing to validate the user-supplied role parameter against an allowlist of permitted...

EUVD-2026-58836

The Propovoice: All-in-One Client Management System plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.7.8. This is due to the create function's REST endpoint failing to validate the user-supplied role parameter against an allowlist of permitted...

CVE-2026-15312 Propovoice: All-in-One Client Management System <= 1.7.8 - Authenticated (ndpv_manager+) Privilege Escalation via 'role' Parameter

The Propovoice: All-in-One Client Management System plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.7.8. This is due to the create function's REST endpoint failing to validate the user-supplied role parameter against an allowlist of permitted...

EUVD-2026-58820

A flaw was found in Red Hat Quay. When the SECURITYSCANNERV4PSK pre-shared key is not set, a remote unauthenticated attacker can send POST requests to the security scanner notification endpoint. This allows the attacker to flood the notification queue and inject path traversal characters into Cla...

CVE-2026-72078: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: Input: ims-pcu - validate control endpoint type The driver currently assumes that the first endpoint of the control interface is an interrupt IN endpoint without verifying it. A malicious device could provide a different endpoint...

CVE-2026-19898: Improper Restriction of Excessive Authentication Attempts

A vulnerability was found in VictoriaMetrics up to 1.146.0. Impacted is the function requestHandler of the file app/vmauth/main.go of the component VMAuth Authentication Endpoint. Performing a manipulation results in improper restriction of excessive authentication attempts. The attack is possibl...

CVE-2026-19897: Improper Restriction of Excessive Authentication Attempts

A vulnerability has been found in mangroup dtale up to 3.22.0. This issue affects the function Login of the file dtale/auth.py of the component Login Endpoint. Such manipulation leads to improper restriction of excessive authentication attempts. The attack can be executed remotely. This attack is...

CVE-2026-19895: Improper Restriction of Excessive Authentication Attempts

A vulnerability was detected in opensourcepos Open Source Point of Sale up to 3.4.2. This affects the function Login::index of the file app/Config/Filters.php of the component Login Endpoint. The manipulation results in improper restriction of excessive authentication attempts. The attack may be...

PT-2026-72145

Name of the Vulnerable Software and Affected Versions Propovoice: All-in-One Client Management System versions prior to 1.7.9 Description An issue exists where the REST endpoint of the create function fails to validate the user-supplied role parameter against a list of permitted WordPress roles a...

PT-2026-72267

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The ims-pcu driver fails to verify that the first endpoint of the control interface is an interrupt IN endpoint. A malicious device could provide an incorrect endpoint type, which is the...

PT-2026-72710

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the CXL driver where NULL endpoint decoder pointer holes can be left in the target array of an active auto-assembly region. This occurs when cxl cancel auto attach...

PT-2026-72591

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A NULL pointer dereference occurs in the ALSA FCP component when processing a malformed USB device. The fcp find fc interface function selects the first vendor-specific interface and...

PT-2026-72153

Name of the Vulnerable Software and Affected Versions Form Maker by 10Web versions prior to 1.15.45 Description An issue exists where authenticated attackers with subscriber-level access or higher can perform blind SQL Injection. This occurs due to insufficient escaping of user-supplied parameter...

PT-2026-72781

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the RDMA/siw component regarding endpoint and socket association handling. Disassociating a socket from an endpoint using the siw socket disassoc function may release...

PT-2026-72139

Name of the Vulnerable Software and Affected Versions Pinpoint Booking System – Version 2 versions prior to 2.9.9.6.9 Description Unauthenticated attackers can manipulate the checkout price of bookable products tied to a booking calendar. The issue occurs because the dopbsp woocommerce add to car...

PT-2026-73058

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.7.4 Description An authentication bypass exists in the WebSocket endpoint due to differential parsing of query parameters between authentication exemption and session quarantine checks. Unauthenticated attackers can...

PT-2026-72161

Name of the Vulnerable Software and Affected Versions ECS WordPress plugin versions prior to 4.3.8 Description An issue exists where the plugin fails to verify post status or user capabilities when rendering an Elementor document via AJAX actions. This allows unauthenticated users to retrieve the...