CVE-2026-110268: Improper Limitation of a Pathname to a Restricted Directory

The Post Export Import with Media plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.17.2 via the 'themeslug' parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to perform actions on files outsid...

PT-2026-116360

Name of the Vulnerable Software and Affected Versions Post Export Import with Media versions prior to 1.17.3 Description The Post Export Import with Media plugin for WordPress contains a Directory Traversal flaw. This issue allows authenticated users with administrator-level access or higher to...

CVE-2026-17068

IBM i 7.3, 7.4, 7.5, and 7.6 could allow a local attacker to bypass NFS version restrictions due to improper enforcement of the export version flag...

CVE-2026-111706

99AI through 4.3.0 contains a missing authentication vulnerability in the POST /api/chatLog/exportExcel route that allows unauthenticated attackers to export all users' chat logs. Attackers can send requests with controlled page, size, and optional email fields to download xlsx files containing...

EUVD-2026-102998

99AI through 4.3.0 contains a missing authentication vulnerability in the POST /api/chatLog/exportExcel route that allows unauthenticated attackers to export all users' chat logs. Attackers can send requests with controlled page, size, and optional email fields to download xlsx files containing...

EUVD-2026-103073

Risesoft Digital-Infrastructure through 9.6.11 contains a missing authorization vulnerability in the log module DownloadController that allows authenticated users to export any tenant's personnel directory. Attackers can supply another tenant's tenantId to exportLoginXLS or exportNotLoginXLS to...

WordPress Post Export Import with Media plugin <= 1.17.2 - Authenticated (Administrator+) Path Traversal vulnerability

Authenticated Administrator+ Path Traversal vulnerability discovered by Wordfence PRISM in WordPress Plugin Post Export Import with Media versions = 1.17.2...

CVE-2026-101300

Server-Side Request Forgery SSRF reported in the ticket sales chart PDF export functionality of Wegow. According to the report, an authenticated user with a promoter account can manipulate the parameter of the POST request generated by selecting Download PDF. The content is processed by the...

CVE-2026-101300 Server-Side Request Forgery in Wegow PDF export

Server-Side Request Forgery SSRF reported in the ticket sales chart PDF export functionality of Wegow. According to the report, an authenticated user with a promoter account can manipulate the parameter of the POST request generated by selecting Download PDF. The content is processed by the...

EUVD-2026-102829

Server-Side Request Forgery SSRF reported in the ticket sales chart PDF export functionality of Wegow. According to the report, an authenticated user with a promoter account can manipulate the parameter of the POST request generated by selecting Download PDF. The content is processed by the...

CVE-2026-101300

A Server-Side Request Forgery (SSRF) vulnerability exists in the Wegow ticket sales chart PDF export functionality. An authenticated user with a promoter account can manipulate the parameter of a POST request triggered by selecting Download PDF . The processed content is handled by the export.hi...

CVE-2026-109401

The WP Mail Logging plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.17.0 via the 'emailaddress' parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to extract complete logged mail ro...

CVE-2026-109401

The WP Mail Logging plugin for WordPress (versions up to and including 1.17.0 ) is vulnerable to Sensitive Information Exposure due to a LIKE wildcard flaw in the email_address parameter. An authenticated attacker with administrator-level access or higher can exploit this by initiating a personal...

PT-2026-116105

99AI through 4.3.0 contains a missing authentication vulnerability in the POST /api/chatLog/exportExcel route that allows unauthenticated attackers to export all users' chat logs. Attackers can send requests with controlled page, size, and optional email fields to download xlsx files containing...

PT-2026-116050

Risesoft Digital-Infrastructure through 9.6.11 contains a missing authorization vulnerability in the log module DownloadController that allows authenticated users to export any tenant's personnel directory. Attackers can supply another tenant's tenantId to exportLoginXLS or exportNotLoginXLS to...

CVE-2026-101300: Server-Side Request Forgery (SSRF)

Server-Side Request Forgery SSRF reported in the ticket sales chart PDF export functionality of Wegow. According to the report, an authenticated user with a promoter account can manipulate the parameter of the POST request generated by selecting Download PDF. The content is processed by the...

CVE-2026-17068: Improper Authorization

IBM i 7.3, 7.4, 7.5, and 7.6 could allow a local attacker to bypass NFS version restrictions due to improper enforcement of the export version flag...

PT-2026-116134

IBM i 7.3, 7.4, 7.5, and 7.6 could allow a local attacker to bypass NFS version restrictions due to improper enforcement of the export version flag...

WordPress WP Mail Logging plugin <= 1.17.0 - Authenticated (Administrator+) Sensitive Information Exposure in LIKE Wildcard in Personal Data Export Email vulnerability

Authenticated Administrator+ Sensitive Information Exposure in LIKE Wildcard in Personal Data Export Email vulnerability discovered by Sawyer in WordPress Plugin WP Mail Logging versions = 1.17.0...

Astra Linux – Vulnerability in Git

Git is a distributed revision control system. git log can display commits in an arbitrary format using its --format specifiers. This functionality is also exposed to git archive via the export-subst gitattribute. When processing the padding operators, there is an integer overflow in...