PT-2026-109477

Name of the Vulnerable Software and Affected Versions Extensions For CF7 versions prior to 3.4.6 Description An arbitrary file upload flaw exists in the extcf7 submit function. The issue stems from missing file extension, MIME type, and size validation within the validation filter of the signatur...

PT-2026-109652

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WPMU DEV Forminator forminator allows Stored XSS.This issue affects Forminator: from n/a through 1.57.3...

PT-2026-109743

Improper Verification of Source of a Communication Channel vulnerability in CodePeople2 Sell Downloads sell-downloads allows Exploitation of Trusted Credentials.This issue affects Sell Downloads: from n/a through 1.2.3...

PT-2026-109704

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in themeStek ThemeStek Extras for LabtechCO Theme themestek-labtechco-extras allows Reflected XSS.This issue affects ThemeStek Extras for LabtechCO Theme: from n/a through 8.4...

PT-2026-109736

Incorrect Privilege Assignment vulnerability in WPMU DEV Forminator forminator allows Privilege Escalation.This issue affects Forminator: from n/a through 1.57.3...

PT-2026-109742

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in drfuri Martfury - WooCommerce Marketplace WordPress Theme martfury allows Reflected XSS.This issue affects Martfury - WooCommerce Marketplace WordPress Theme: from n/a through 3.3.9...

PT-2026-109660

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Greg Winiarski WPAdverts wpadverts allows Stored XSS.This issue affects WPAdverts: from n/a through 2.3.4...

PT-2026-109642

Name of the Vulnerable Software and Affected Versions Apache DataSketches C++ versions 3.1.0 through 5.2.9 Description An out-of-bounds read exists during the deserialization of compact Theta sketches. The functions compact theta sketch::deserialize and wrapped compact theta sketch::wrap read...

PT-2026-109653

Deserialization of Untrusted Data vulnerability in 10Web Slider by 10Web slider-wd allows Object Injection.This issue affects Slider by 10Web: from n/a through 1.2.62...

Mobile Security Framework MobSF 4.5.2 Command Injection

Mobile Security Framework MobSF version 4.5.2 contains a command injection issue in Android package-name handling during dynamic-analysis APK retrieval...

PT-2026-109790

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in ThemeREX Group Kids Planet allows Reflected XSS. This issue affects Kids Planet: from n/a through 2.2.14.2...

PT-2026-109750

Server-Side Request Forgery SSRF vulnerability in Builderius.io Builderius allows Server Side Request Forgery. This issue affects Builderius: from 1.4 through 1.4-beta...

PT-2026-109643

Name of the Vulnerable Software and Affected Versions Apache DataSketches C++ versions 2.0.0-incubating through 5.2.9 Description An out-of-bounds read exists in the VarOpt union deserialization process. The var opt union::deserialize function reads a 32-byte preamble from a non-empty union even...

PT-2026-109640

Name of the Vulnerable Software and Affected Versions Apache DataSketches C++ versions 1.0.0-incubating through 5.2.9 Description A heap buffer overflow occurs during the HLL sketch deserialization process when operating in LIST mode from a byte buffer or stream. The issue arises because the coup...

PT-2026-109659

Deserialization of Untrusted Data vulnerability in Tainacan Community Tainacan tainacan allows Object Injection.This issue affects Tainacan: from n/a through 1.3.0...

PT-2026-109703

Deserialization of Untrusted Data vulnerability in bPlugins Super Video Player super-video-player allows Object Injection.This issue affects Super Video Player: from n/a through 1.8.13...

PT-2026-109865

Memory Allocation with Excessive Size Value vulnerability in ericmj decimal allows Denial of Service. Decimal.round/3 builds the full result for the requested number of decimal places before the context precision 34 digits by default is applied, so its cost grows with the places argument instead ...

PT-2026-109661

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Greg Winiarski WPAdverts wpadverts allows Reflected XSS.This issue affects WPAdverts: from n/a through 2.3.4...

PT-2026-109699

Name of the Vulnerable Software and Affected Versions VillaTheme AFFI – Affiliate Marketing for WooCommerce versions prior to 1.0.11 Description An Object Injection issue exists due to the deserialization of untrusted data. This occurs when the application processes specially crafted serialized...

PT-2026-109645

ExtUtils::Typemaps::STL::List versions before 1.07 for Perl allocate a 32 GiB array on an empty list. The OUTPUT typemaps call av extend av, len-1 . On an empty list, this undeflows, and av extend will allocate an array with 2^32 slots, leading to memory exhaustion. Note that a similar issue was...