CVE-2026-16079

The CVE concerns the WordPress Fullscreen Galleria plugin (

CVE-2026-19927 OpenBoxes Product Upload Endpoint ProductController.groovy upload server-side request forgery

A vulnerability was found in OpenBoxes up to 0.9.7. The impacted element is the function Upload of the file grails-app/controllers/org/pih/warehouse/product/ProductController.groovy of the component Product Upload Endpoint. Performing a manipulation of the argument params.url results in server-si...

PT-2026-73069

Name of the Vulnerable Software and Affected Versions code-projects Online Shopping System version 1.0 Description A remote SQL injection is possible due to improper handling of the total count argument within the '/checkout process.php' endpoint. SQL injection is a technique where an attacker...

Assessing Attack Surfaces in Generative Search Engines through Publisher Attributes: A Case Study in Political Domains

We characterize the attack surface of generative search engines GSEs against poisoning attacks in the political domain, from the perspectives of citation selection and personalization. GSEs integrate web search and answer generation with user preferences and backgrounds using large language model...

CVE-2026-19899

CVE-2026-19899 affects SourceCodester Class and Exam Timetabling System 1.0. The vulnerability is in an unknown function within the file /edit_teacher.php, where manipulating the argument ID can cause an SQL injection. It is described as exploitable remotely with a publicly disclosed exploit (PoC...

CVE-2026-19899

A vulnerability was determined in SourceCodester Class and Exam Timetabling System 1.0. The affected element is an unknown function of the file /editteacher.php. Executing a manipulation of the argument ID can lead to sql injection. The attack may be performed from remote. The exploit has been...

CVE-2026-12795

A flaw was found in BerriAI litellm. This vulnerability allows a remote attacker to bypass authentication within the SSO Debug Flow component by manipulating the json.dumps function. The successful exploitation of this flaw could lead to unauthorized access and potential information disclosure...

GHSA-3GMF-P6R4-Q8M6 vulnerabilities

Vulnerabilities for packages: geoserver...

EUVD-2026-59524

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Copy WQE to local buffer in non-SRQ receive path For non-SRQ QPs, the responder reads WQE fields directly from the shared queue buffer mapped into userspace. This allows a malicious user to modify fields like numsge or...

CVE-2026-74377 RDMA/rxe: Copy WQE to local buffer in non-SRQ receive path

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Copy WQE to local buffer in non-SRQ receive path For non-SRQ QPs, the responder reads WQE fields directly from the shared queue buffer mapped into userspace. This allows a malicious user to modify fields like numsge or...

CVE-2026-74330

The CVE-2026-74330 entry specifies a Linux kernel fix for configfs lockless traversals of ->s_children. The issue allowed cursor movement or freeing under lock protection of the parent directory, potentially enabling invalid cursor states via lseek() despite entry protection from removal. The ...

CVE-2026-72164 ocfs2: avoid moving extents to occupied clusters

In the Linux kernel, the following vulnerability has been resolved: ocfs2: avoid moving extents to occupied clusters For non-auto OCFS2IOCMOVEEXT operations, userspace supplies a physical megoal. ocfs2moveextent initializes newphyscpos from that goal and expects ocfs2probeallocgroup to replace it...

CVE-2026-8840

The Booking calendar, Appointment Booking System plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.2.36. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated...

CVE-2026-12128

The Pinpoint Booking System – Version 2 plugin for WordPress is vulnerable to Price Manipulation via the cartdata parameter in all versions up to, and including, 2.9.9.6.8. This is due to the dopbspwoocommerceaddtocart AJAX action being registered via wpajaxnopriv with no authentication, no nonce...

CVE-2026-12128 Pinpoint Booking System <= 2.9.9.6.8 - Unauthenticated Improper Input Validation to Price Manipulation via 'cart_data' Parameter

The Pinpoint Booking System – Version 2 plugin for WordPress is vulnerable to Price Manipulation via the cartdata parameter in all versions up to, and including, 2.9.9.6.8. This is due to the dopbspwoocommerceaddtocart AJAX action being registered via wpajaxnopriv with no authentication, no nonce...

CVE-2026-12128

The Pinpoint Booking System – Version 2 plugin for WordPress is vulnerable to Price Manipulation via the cartdata parameter in all versions up to, and including, 2.9.9.6.8. This is due to the dopbspwoocommerceaddtocart AJAX action being registered via wpajaxnopriv with no authentication, no nonce...

CVE-2026-12128

CVE-2026-12128 affects Pinpoint Booking System – Version 2 for WordPress. The vulnerability allows unauthenticated attackers to manipulate checkout prices for any bookable product linked to a booking calendar by exploiting the WooCommerce price handling flow: the dopbsp_woocommerce_add_to_cart AJ...

EUVD-2026-58843

The Pinpoint Booking System – Version 2 plugin for WordPress is vulnerable to Price Manipulation via the cartdata parameter in all versions up to, and including, 2.9.9.6.8. This is due to the dopbspwoocommerceaddtocart AJAX action being registered via wpajaxnopriv with no authentication, no nonce...

CVE-2026-12128 Pinpoint Booking System <= 2.9.9.6.8 - Unauthenticated Improper Input Validation to Price Manipulation via 'cart_data' Parameter

The Pinpoint Booking System – Version 2 plugin for WordPress is vulnerable to Price Manipulation via the cartdata parameter in all versions up to, and including, 2.9.9.6.8. This is due to the dopbspwoocommerceaddtocart AJAX action being registered via wpajaxnopriv with no authentication, no nonce...

EUVD-2026-58839

The Booking calendar, Appointment Booking System plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.2.36. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated...