EUVD-2026-58843

The Pinpoint Booking System – Version 2 plugin for WordPress is vulnerable to Price Manipulation via the cartdata parameter in all versions up to, and including, 2.9.9.6.8. This is due to the dopbspwoocommerceaddtocart AJAX action being registered via wpajaxnopriv with no authentication, no nonce...

CVE-2026-8840

The Booking calendar, Appointment Booking System plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.2.36. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated...

EUVD-2026-58839

The Booking calendar, Appointment Booking System plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.2.36. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated...

CVE-2026-8840 Booking calendar, Appointment Booking System <= 3.2.36 - Missing Authorization to Unauthenticated Arbitrary Modification via wpdevart_payment AJAX Action

The Booking calendar, Appointment Booking System plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.2.36. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated...

CVE-2026-8840

The CVE-2026-8840 entry concerns the Booking calendar, Appointment Booking System plugin for WordPress, affected up to version 3.2.36. The vulnerability is an authorization bypass caused by inadequate verification of a user’s permission to perform actions, enabling unauthenticated attackers to ma...

CVE-2026-49844 vulnerabilities

Vulnerabilities for packages: akhq, apache-pulsar, sonarqube, solr, kafka, apache-tika, spdx-tools-java, neo4j, druid, wildfly, keycloak-config-cli, apache-activemq-artemis, spark, wavefront-proxy, strimzi-kafka-operator, kserve-modelmesh, thingsboard, opensearch, celeborn, trino, infinispan,...

CVE-2026-12128: Improper Input Validation

The Pinpoint Booking System – Version 2 plugin for WordPress is vulnerable to Price Manipulation via the cartdata parameter in all versions up to, and including, 2.9.9.6.8. This is due to the dopbspwoocommerceaddtocart AJAX action being registered via wpajaxnopriv with no authentication, no nonce...

PT-2026-72149

Name of the Vulnerable Software and Affected Versions Booking calendar, Appointment Booking System versions prior to 3.2.37 Description An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. Unauthenticated attackers can wri...

PT-2026-72139

Name of the Vulnerable Software and Affected Versions Pinpoint Booking System – Version 2 versions prior to 2.9.9.6.9 Description Unauthenticated attackers can manipulate the checkout price of bookable products tied to a booking calendar. The issue occurs because the dopbsp woocommerce add to car...

PT-2026-72813

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description In the RDMA/rxe component, the responder reads Work Queue Element WQE fields directly from a shared queue buffer mapped into userspace for non-SRQ Queue Pairs QPs. This allows a maliciou...

SUSE CVE-2026-73480

gdu fails to strip terminal escape sequences from directory and file names when printing paths after TUI exit. Attackers can craft malicious directory or file names containing escape sequences that are interpreted by the terminal, enabling title spoofing, clipboard manipulation, or other...

CVE-2026-74244

A flaw was found in Red Hat Quay's Stripe billing webhook handler. This vulnerability allows an unauthenticated attacker to forge billing events by sending crafted JSON requests to the /webhooks/stripe endpoint without validating the Stripe-Signature header. Successful exploitation can lead to th...

CVE-2026-34492

External control of file name or path vulnerability in Johnson Controls Airwall allows : File Manipulation. This issue affects Airwall: before 4.1...

CVE-2026-34492

Johnson Controls Airwall (before 4.1) is affected by CVE-2026-34492: external control of a file name or path can lead to arbitrary file read (and related file manipulation). The provided documents do not specify the exact root cause details, vulnerable components, or affected versions beyond Air...

CVE-2026-34492 Airwall - Arbitrary file read

External control of file name or path vulnerability in Johnson Controls Airwall allows : File Manipulation. This issue affects Airwall: before 4.1...

EUVD-2026-58772

External control of file name or path vulnerability in Johnson Controls Airwall allows : File Manipulation. This issue affects Airwall: before 4.1...

CVE-2026-34492 Airwall - Arbitrary file read

External control of file name or path vulnerability in Johnson Controls Airwall allows : File Manipulation. This issue affects Airwall: before 4.1...

CVE-2026-34492

External control of file name or path vulnerability in Johnson Controls Airwall allows : File Manipulation. This issue affects Airwall: before 4.1...

CVE-2026-48528 Metacat has an unauthenticated SQL injection vulnerability

Metacat is data repository software that helps researchers preserve, share, and discover data. Metacat versions 2.0.0 through 3.4.0 contain an unauthenticated SQL injection vulnerability in the /cn/v1/object and /cn/v2/object REST API endpoints due to unsanitized user input that can be passed...

CVE-2026-47192 kas's late signature validation may allow unnoticed repository manipulations

kas is a setup tool for bitbake based projects. Starting in version 4.8 and prior to version 5.3, kas checks out and processes repositories regarding configuration includes prior to validating signatures of those repositories. This may allow to replace on original repository with one under the...