PT-2026-124469

TuxCare rebuilt @babel/plugin-proposal-decorators to address 1 CVE. Fixed in 7.16.7-tuxcare.3...

PT-2026-124525

TuxCare rebuilt @babel/plugin-proposal-optional-chaining to address 1 CVE. Fixed in 7.12.5-tuxcare.1...

PT-2026-124524

TuxCare rebuilt @babel/plugin-proposal-optional-chaining to address 1 CVE. Fixed in 7.12.18-tuxcare.1...

PT-2026-124526

TuxCare rebuilt @babel/plugin-proposal-optional-chaining to address 1 CVE. Fixed in 7.18.9-tuxcare.2...

PT-2026-124529

TuxCare rebuilt @babel/plugin-proposal-optional-chaining to address 1 CVE. Fixed in 7.21.0-tuxcare.4...

PT-2026-124530

TuxCare rebuilt @babel/plugin-proposal-optional-chaining to address 2 CVEs. Fixed in 7.21.5-tuxcare.2...

PT-2026-124531

TuxCare rebuilt @babel/plugin-proposal-optional-chaining to address 1 CVE. Fixed in 7.18.9-tuxcare.3...

PT-2026-124513

TuxCare rebuilt @babel/plugin-proposal-numeric-separator to address 1 CVE. Fixed in 7.16.7-tuxcare.3...

PT-2026-124522

TuxCare rebuilt @babel/plugin-proposal-optional-chaining to address 1 CVE. Fixed in 7.16.7-tuxcare.1...

PT-2026-124523

TuxCare rebuilt @babel/plugin-proposal-optional-chaining to address 1 CVE. Fixed in 7.14.8-tuxcare.1...

PT-2026-115448

Name of the Vulnerable Software and Affected Versions Search Regex version 3.5 Description An issue exists where authenticated users with subscriber-level access and above can perform PHP Object Injection. This occurs through the deserialization of untrusted input within the replace all function...

PT-2026-115470

Name of the Vulnerable Software and Affected Versions MB Custom Post Types & Custom Taxonomies WordPress plugin versions prior to 2.12.2 Description An issue exists where migration actions do not perform a capability check or validate a nonce. This allows any authenticated user, including those...

PT-2026-115472

Name of the Vulnerable Software and Affected Versions Salon Booking System WordPress plugin versions prior to 10.31.9 Description The plugin fails to generate booking-API access tokens using a secure random source. Instead, tokens are derived from a hardcoded value and the specific second the tok...

PT-2026-115479

Name of the Vulnerable Software and Affected Versions Document Gallery WordPress plugin versions prior to 5.1.2 Description The plugin fails to perform capability or ownership checks when generating a gallery on demand. This allows unauthenticated users to enumerate and disclose titles,...

PT-2026-115489

Name of the Vulnerable Software and Affected Versions HivePress – Business Directory, Listings & Classified Ads Plugin versions prior to 1.7.33 Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting XSS, a technique...

PT-2026-115497

Name of the Vulnerable Software and Affected Versions GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress versions prior to 2.8.193 Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Authenticat...

PT-2026-115922

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the mysql json plugin assumed that imported MySQL tables contained valid MySQL binary JSON data. A specially prepared MySQL table containing invalid JSON data...

PT-2026-115910

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the mysql json plugin assumed that imported MySQL tables contained valid MySQL binary JSON data. A specially prepared MySQL table containing invalid JSON data...

PT-2026-115921

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the qc info plugin could be confused by a query containing embedded null bytes. Reading information schema.query cache info after such a query was cached could...

PT-2026-115909

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the qc info plugin could be confused by a query containing embedded null bytes. Reading information schema.query cache info after such a query was cached could...