PT-2026-103905

Name of the Vulnerable Software and Affected Versions Fortra Core Privileged Access Manager BoKS versions prior to 8.1.0.24 Fortra Core Privileged Access Manager BoKS versions prior to 9.0.0.7 Description A stack-based buffer overflow exists in the boks autoregisterd service. A remote attacker wi...

CVE-2026-64949: Unrestricted Upload of File with Dangerous Type

Incomplete extension blacklist in the File Manager module allows authenticated upload and execution of arbitrary .phar files. Affects Pandora FMS from 777 onwards...

CVE-2026-19902: Improper Neutralization of Input During Web Page Generation

The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the Referer header in all versions up to, and including, 2.8.18 due to insufficient input sanitization and output escaping on the 'search-query' dynamic tag. When an ad block's code...

CVE-2026-62063: Missing Authorization

Missing Authorization vulnerability in Magepeople inc. WpTravelly tour-booking-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WpTravelly: from n/a through 2.3.1...

CVE-2026-12627: Stack-based Buffer Overflow

Fortra's Core Privileged Access Manager BoKS contains a stack-based buffer overflow vulnerability in boksautoregisterd. A remote attacker with network access to the autoregistration service may be able to trigger memory corruption during client response processing...

CVE-2026-64946: Improper Neutralization of Input During Web Page Generation

A chained CSRF and unrestricted SVG file upload vulnerability in the File Manager module allows stored Cross-Site Scripting, enabling session cookie exfiltration and administrator account takeover. This issue affects Pandora FMS: from 777 onwards...

PT-2026-103765

A chained CSRF bypass and unrestricted file upload vulnerability in the Plugin File Manager allows an attacker to upload and execute arbitrary PHP code, resulting in Remote Code Execution. This issue affects Pandora FMS: from 777 onwards...

PT-2026-103740

Name of the Vulnerable Software and Affected Versions Ad Inserter – Ad Manager & AdSense Ads versions prior to 2.8.19 Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Reflected Cross-Site Scripting. This occurs when a site administrator...

PT-2026-103893

Subscriber Broken Access Control in WP Project Manager = 4.0.7 versions...

CVE-2026-79898: Improper Neutralization of Special Elements used in an OS Command

Fortra BoKS Manager contains a command injection vulnerability in crlserver. An authenticated user authorized to add CRL URLs through BCC, the WSI REST or SOAP API, or the cacrl command-line interface could cause shell command substitution to be processed by crlserver as root on the BoKS Master...

CVE-2026-86610: Improper Neutralization of Input During Web Page Generation

The Download Manager WordPress plugin before 3.3.71 does not sufficiently sanitise and escape a package setting before outputting it back in a page, which could allow users with the Author role and above to perform Stored Cross-Site Scripting attacks against any visitor who opens the package's...

CVE-2026-97281: Missing Authorization

Subscriber Broken Access Control in WP Project Manager = 4.0.7 versions...

CVE-2026-89427: Improper Neutralization of Input During Web Page Generation

The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 's' Search Parameter in all versions up to, and including, 2.8.18 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

CVE-2026-79899: Insecure Temporary File

Fortra BoKS Manager contains an insecure temporary file vulnerability in bccgethostcert. The utility creates predictable temporary files without first setting a restrictive umask. A local user on the BoKS Master who can read files under BOKStmp may be able to obtain CA secret or host private-key...

PT-2026-105811

JupyterLab's PyPI extension manager runs python -m pip uninstall with the extension name taken from the request body. ExtensionHandler.post validates the name for cmd=install but not for cmd=uninstall, so a name that begins with - reaches the command line and pip reads it as an option rather than...

PT-2026-103767

Incomplete extension blacklist in the File Manager module allows authenticated upload and execution of arbitrary .phar files. Affects Pandora FMS from 777 onwards...

CVE-2026-64947: Unrestricted Upload of File with Dangerous Type

A chained CSRF bypass and unrestricted file upload vulnerability in the Plugin File Manager allows an attacker to upload and execute arbitrary PHP code, resulting in Remote Code Execution. This issue affects Pandora FMS: from 777 onwards...

CVE-2026-64950: Improper Neutralization of Input During Web Page Generation

Missing input validation and output encoding on the directory name parameter in File Manager's Create Directory allows stored XSS, executing without user interaction. Affects Pandora FMS from 777 onwards...

CVE-2026-79896: Out-of-bounds Read

Fortra BoKS Manager contains an out-of-bounds read vulnerability in the custom TLS ClientHello parser used by boksportmux. A remote unauthenticated attacker can submit a malformed ClientHello and terminate boksportmux. Although the daemon is normally restarted automatically, repeated requests can...

PT-2026-103907

Fortra BoKS Manager contains an out-of-bounds read vulnerability in the custom TLS ClientHello parser used by boks portmux. A remote unauthenticated attacker can submit a malformed ClientHello and terminate boks portmux. Although the daemon is normally restarted automatically, repeated requests c...