CVE-2026-9231 WP Travel Engine <= 6.8.0 - Authenticated (Contributor+) Local File Inclusion via 'template' Shortcode Attribute

The WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 6.8.0 via the wtegettemplate function. This makes it possible for authenticated attackers, with contributor-level access and above, ...

ship-safe v10.1.0

The independent security agent for AI-written software. It finds issues, investigates whether they are real, and shows you the evidence. Website · Docs · Security & Data Flow · Benchmark · Pricing · Blog · Contribute Ship Safe CLI Ship Safe runs locally in your repo and works in two layers. A...

[SECURITY] Fedora 45 Update: openmw-0.51.0-8.fc45

OpenMW is an open-source game engine focused on 3D role-playing games...

PT-2026-96684

Name of the Vulnerable Software and Affected Versions WP Travel Engine – Tour Booking Plugin – Tour Operator Software versions prior to 6.8.1 Description The plugin contains a Local File Inclusion flaw, which occurs when an application includes a file without properly validating the input, allowi...

HPESBNW05137 rev.1 - Multiple Vulnerabilities in HPE Networking Analytics and Location Engine (ALE)

Potential Security Impact: Local: Access Restriction Bypass SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. ArubaOS Wi-Fi Controllers and Gateways ALE 5.0.0.0 and below CVSS Scores: | CVE | CVSS Vector | Base Score | | --- | --- | --- | | CVE-2026-76708 |...

PT-2026-96993

Name of the Vulnerable Software and Affected Versions HPE Analytics and Location Engine versions 5.0.0.0 and earlier Description A flaw in the internal administrative component allows an unauthenticated remote attacker to obtain unauthorized write access to the file system with elevated privilege...

CVE-2026-76711: Improper Input Validation

A vulnerability exists in an Analytics and Location Engine ALE component where the impacted process improperly processes incoming socket connections. An unauthenticated remote attacker could exploit this vulnerability by providing specially crafted input during the connection process. Successful...

CVE-2026-76709: Improper Access Control

A vulnerability exists in the internal administrative component of Analytics and Location Engine ALE. Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to gain unauthorized write access to the file system with elevated privileges, potentially resulting i...

CVE-2026-76713: Improper Privilege Management

A vulnerability exists in the maintenance restore functionality of Analytics and Location Engine ALE. Successful exploitation of this vulnerability could allow an authenticated remote attacker to gain unauthorized access to the file system with root privileges, potentially resulting in full syste...

CVE-2026-76717: Exposure of Sensitive Information to an Unauthorized Actor

A vulnerability exists in the Analytics and Location Engine ALE API that may allow for the disclosure of sensitive information. An unauthenticated remote attacker could exploit this vulnerability by providing specially crafted input to a specific API endpoint. Successful exploitation could result...

CVE-2026-76708: Use of Hard-coded Credentials

A vulnerability exists in the Analytics and Location Engine ALE where the application and underlying operating system use default, hard-coded credentials for several administrative and system accounts. An unauthenticated remote attacker could exploit this vulnerability by attempting to log in usi...

CVE-2026-95501: Improper Control of Generation of Code

A vulnerability was found in mtrano APENCMS up to 6546096d354153309693efabb9a0d824628ed4f5. The affected element is the function eval of the file cms/weasel.php of the component Template Engine. The manipulation of the argument $CMS'site' results in code injection. The attack may be performed fro...

CVE-2026-76715: Channel Accessible by Non-Endpoint

A vulnerability in an administrative component of Analytics and Location Engine ALE is vulnerable to a man-in-the-middle MitM attack. Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to execute arbitrary code with root privileges on the affected applian...

PT-2026-96994

Name of the Vulnerable Software and Affected Versions Analytics and Location Engine ALE affected versions not specified Description The management interface contains a flaw that allows an unauthenticated remote attacker to disclose sensitive information. By sending specially crafted requests to...

PT-2026-96992

Name of the Vulnerable Software and Affected Versions Analytics and Location Engine affected versions not specified Description The Analytics and Location Engine ALE and its underlying operating system utilize default, hard-coded credentials for multiple system and administrative accounts. An...

CVE-2026-9231: Improper Control of Filename for Include/Require Statement in PHP Program

The WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 6.8.0 via the wtegettemplate function. This makes it possible for authenticated attackers, with contributor-level access and above, ...

PT-2026-97000

Name of the Vulnerable Software and Affected Versions Analytics and Location Engine affected versions not specified Description Multiple issues exist that may allow for unauthorized access or denial of service. An unauthenticated remote attacker could exploit these by sending specially crafted...

PT-2026-96996

Name of the Vulnerable Software and Affected Versions Analytics and Location Engine ALE affected versions not specified Description An issue in the Analytics and Location Engine ALE allows an unauthenticated remote attacker to gain unauthorized access, disclose sensitive information, or cause a...

PT-2026-97001

Name of the Vulnerable Software and Affected Versions Analytics and Location Engine ALE API affected versions not specified Description An unauthenticated remote attacker can cause the disclosure of sensitive information by providing specially crafted input to a specific API endpoint. This issue...

Design and Evaluation of a Controlled Post-Alert Incident Orchestration and Response Subsystem Using a Rule Engine and a Local Large Language Model

This paper presents a controlled post-alert incident orchestration and response subsystem for educational information systems. The architecture separates deterministic classification, contextual analysis, human approval, and technical execution. A Rule Engine determines severity and selects the...