EUVD-2026-80094

The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.2.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...

CVE-2026-14349 TrueBooker <= 1.2.3 - Missing Authorization to Unauthenticated Arbitrary User Email Modification via 'admin_addcustomer' AJAX Action

The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.2.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...

CVE-2026-14349

The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress is vulnerable to authorization bypass in all versions up to and including 1.2.3 . The root cause is a missing permission check on the admin_addcustomer AJAX action in main/function_ajax.php, allowing unauthenticated at...

CVE-2026-14349 TrueBooker <= 1.2.3 - Missing Authorization to Unauthenticated Arbitrary User Email Modification via 'admin_addcustomer' AJAX Action

The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.2.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...

SUSE CVE-2026-82049

In CPython 3.13 and earlier, the tarfile module's data and tar extraction filters are vulnerable to crafted archives containing a hard link to a symbolic link. Such archives may cause extraction to modify the permissions or modification time of a file outside the destination directory, or expose...

CVE-2026-20247: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability in Cisco ISE could allow an unauthenticated, remote attacker to conduct SQL injection attacks on an affected device. This vulnerability is due to improper validation of user-supplied input. An attacker could exploit this vulnerability by sending a crafted request to an affected...

CVE-2026-91101: Improper Validation of Array Index

HP has identified and remediated multiple externally reported vulnerabilities within HPLIP. The findings affect several software components that could potentially enable remote code execution, privilege escalation, denial of service, information disclosure, or unauthorized file modification under...

CVE-2026-91100: Improper Neutralization of Special Elements used in an OS Command

HP has identified and remediated multiple externally reported vulnerabilities within HPLIP. The findings affect several software components that could potentially enable remote code execution, privilege escalation, denial of service, information disclosure, or unauthorized file modification under...

PT-2026-93905

Name of the Vulnerable Software and Affected Versions HPLIP versions prior to 3.26.6-1.1 Description Multiple security issues within several software components could potentially enable remote code execution, privilege escalation, denial of service, information disclosure, or unauthorized file...

CVE-2026-61598: Improperly Controlled Modification of Dynamically-Determined Object Attributes

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, djust.mixins.modelbinding.ModelBindingMixin provides a default updatemodel event handler and is part of the LiveView base MRO, so every LiveView exposes it. It...

CVE-2026-20284: Improper Neutralization of Special Elements in Data Query Logic

A vulnerability in the SXP REST API of Cisco ISE could allow an authenticated, remote attacker to conduct SQL injection attacks. This vulnerability is due to insufficient validation of user-supplied input in REST API calls. An attacker could exploit this vulnerability by sending crafted input to ...

PT-2026-94039

Name of the Vulnerable Software and Affected Versions PatrowlManager versions prior to 1.8.5 Description An authorization bypass exists in the events and alerts API endpoints due to a lack of ownership filtering. This allows authenticated attackers to read platform event history, delete arbitrary...

AlmaLinux 9 : firewalld (ALSA-2026:67585)

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:67585 advisory. firewalld: firewalld: Local unprivileged user can modify firewall state due to D-Bus setter mis- authorization CVE-2026-4948 Tenable has extracted the preceding...

Malicious code in jexkcode (npm)

Versions 1.0.1 through 1.1.4 of jexkcode automatically follow a hard-coded WhatsApp newsletter whenever a WhatsApp connection opens. The package waits three seconds and calls newsletterFollow without obtaining user consent or exposing a configuration option. The README advertises newsletter suppo...

CVE-2026-92217: Improperly Controlled Modification of Dynamically-Determined Object Attributes

A vulnerability was determined in a2ui-project a2ui up to 0.10.6. This affects the function processMessages of the file renderers/webcore/src/v09/processing/message-processor.ts of the component Message Parsing. This manipulation causes dynamically-determined object attributes. The attack can be...

PT-2026-93268

The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.2.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...

CVE-2026-91099: UNIX Symbolic Link (Symlink) Following

HP has identified and remediated multiple externally reported vulnerabilities within HPLIP. The findings affect several software components that could potentially enable remote code execution, privilege escalation, denial of service, information disclosure, or unauthorized file modification under...

The vulnerability of the WebLogic Server Proxy Plug-In for third-party web servers within the Oracle Fusion Middleware software platform allows a malicious individual to gain unauthorized access to create, delete, or modify data.

The vulnerability of the WebLogic Server Proxy Plug-In for third-party web servers within the Oracle Fusion Middleware software platform is related to the absence of authentication for a critical function. Exploiting this vulnerability could allow an intruder to gain unauthorized access to create...

CVE-2026-20285: Improper Authorization

A vulnerability in the web-based management interface of Cisco Identity Services Engine ISE and Cisco ISE Passive Identity Connector ISE-PIC could allow an authenticated, remote attacker to modify parts of the configuration on an affected device. This vulnerability is due to the lack of server-si...

PT-2026-93925

Name of the Vulnerable Software and Affected Versions HPLIP affected versions not specified Description Multiple issues within several software components could potentially enable remote code execution, privilege escalation, denial of service, information disclosure, or unauthorized file...