PT-2026-89264

Name of the Vulnerable Software and Affected Versions Builderall for WordPress versions prior to 3.0.3 Description Stored Cross-Site Scripting XSS occurs due to insufficient input sanitization and output escaping in the Photo Module attributes setting. This allows authenticated attackers with...

PT-2026-88898

Name of the Vulnerable Software and Affected Versions PayTR Virtual Pos iFrame API WHMCS Module versions 9.0.0 through 9.0.2 Description The PayTR Virtual Pos iFrame API WHMCS Module contains a flaw involving the use of a less trusted source, which allows for the exploitation of trusted...

CVE-2026-81644: Undefined Security Weakness

DoS vulnerability in the preview service module. Impact: Successful exploitation of this vulnerability may affect availability...

CVE-2026-49313: Undefined Security Weakness

Permission control vulnerability in the app lock module. Impact: Successful exploitation of this vulnerability may affect service confidentiality...

CVE-2026-49311: Undefined Security Weakness

Permission control vulnerability in the event notification module.Impact: Successful exploitation of this vulnerability may affect availability...

CVE-2026-81647: Integer Overflow to Buffer Overflow

Out-of-bounds read vulnerability in the graphics module. Impact: Successful exploitation of this vulnerability may affect availability...

PT-2026-89244

Name of the Vulnerable Software and Affected Versions Drupal SAML SSO - Service Provider versions 0.0.0 through 3.2.0 Description The miniorange saml module does not sufficiently validate certain user-supplied URLs before performing redirects. This allows an attacker to redirect users to an...

PT-2026-89248

Name of the Vulnerable Software and Affected Versions SAML SSO - Service Provider versions 0.0.0 through 3.2.0 Description This module enables a Drupal site to function as a SAML 2.0 Service Provider for external identity provider authentication. The issue occurs because the module fails to...

PT-2026-89249

Name of the Vulnerable Software and Affected Versions Drupal SAML SSO - Service Provider versions 0.0.0 through 3.2.0 Description The module allows a Drupal site to function as a SAML 2.0 Service Provider for external identity provider authentication. It contains hard-coded credentials that may...

PT-2026-88803

Out-of-bounds read vulnerability in the graphics module. Impact: Successful exploitation of this vulnerability may affect availability...

PT-2026-88808

Permission control vulnerability in the app lock module. Impact: Successful exploitation of this vulnerability may affect service confidentiality...

CVE-2026-16272: Use of Less Trusted Source

Use of less trusted source vulnerability in PayTR Payment and Electronic Money Institution Inc. PayTR Virtual Pos iFrame API WHMCS Module allows Exploitation of Trusted Identifiers. This issue affects PayTR Virtual Pos iFrame API WHMCS Module: from v9.0.0 before v9.0.3...

CVE-2026-80923: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: xhci: dbgtty: Fix unregister on ttyregisterdriver failure If ttyregisterdriver fails, it drops the reference, but fails to set the global dbcttydriver to NULL, causing the unregister to be called again when module exits. On modul...

PT-2026-89242

Name of the Vulnerable Software and Affected Versions Drupal SAML SSO - Service Provider versions 0.0.0 through 3.2.0 Description The miniorange saml module fails to correctly restrict access to specific administrative functionality. This flaw allows unauthorized users to perform forceful browsin...

SAML SSO - Service Provider - Moderately critical - Embedded credentials - SA-CONTRIB-2026-148

This module allows you to configure your Drupal site as a SAML 2.0 Service Provider so that users can authenticate through an external identity provider. The module contains embedded credentials used by the functionality provided by the module. Under certain circumstances, these credentials could...

PT-2026-88802

Out-of-bounds read vulnerability in the graphics module. Impact: Successful exploitation of this vulnerability may affect availability...

VulnCheck KEV: CVE-2026-80099

Several Newfold plugins are vulnerable to Authentication Bypass. The vulnerability exists because the plugins bundle the wp-module-data module. In the module, the authenticate method — registered on the restauthenticationerrors filter and therefore evaluated for every unauthenticated REST API...

PT-2026-89247

Name of the Vulnerable Software and Affected Versions SAML SSO - Service Provider versions 0.0.0 through 3.2.0 Description This module allows a Drupal site to function as a SAML 2.0 Service Provider for authentication via an external identity provider. The issue occurs because the module does not...

SAML SSO - Service Provider - Critical - Weak cryptographic practices - SA-CONTRIB-2026-144

This module allows you to configure your Drupal site as a SAML 2.0 Service Provider so that users can authenticate through an external identity provider. The module uses cryptographic constructions that do not align with current security best practices. The module performs certain signature...

CVE-2026-41987: Undefined Security Weakness

Permission control vulnerability in the app management module. Impact: Successful exploitation of this vulnerability may affect availability...