PT-2026-45617

Name of the Vulnerable Software and Affected Versions Pixa Bank version 2.0 Description An SQL injection allows unauthenticated attackers to extract sensitive data from the database, including names, email addresses, and phone numbers. This is achieved by sending POST requests to the...

CVE-2026-2262

The Easy Appointments plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.12.21 via the /wp-json/wp/v2/eablocks/eaappointments/ REST API endpoint. This is due to the endpoint being registered with 'permissioncallback' = 'returntrue', which...

CVE-2026-1436

Improper Access Control IDOR in the Graylog API, version 2.2.3, which occurs when modifying the user ID in the URL. An authenticated user can access other user's profiles without proper authorization checks. Exploiting this vulnerability allows valid users of the system to be listed and sensitive...