PT-2026-113666

The LTL Freight Quotes WordPress plugin before 4.2.19 does not perform any authorization check or validation on one of its REST routes that writes to the database, allowing unauthenticated users to modify some of the LTL Freight Quotes WordPress plugin before 4.2.19's stored settings...

PT-2026-113665

The WP Booking System WordPress plugin before 2.1.0.1 does not sanitise and escape a client-controllable request value before storing it and later outputting it in an administration screen, allowing unauthenticated attackers to perform Stored Cross-Site Scripting attacks that execute in the sessi...

PT-2026-113694

The SellKit WordPress plugin before 2.8.0 does not validate a client-supplied product price when totals are recalculated during checkout, allowing unauthenticated attackers to place orders for any purchasable product at a price of their own choosing...

PT-2026-113958

The authentication middleware of the JTL-Shop administration backend processes the plugin safe mode toggle on the admin logout route before checking whether the requesting user is authenticated. An unauthenticated remote attacker can therefore switch the shop's plugin safe mode on and off, which...

PT-2026-114178

Name of the Vulnerable Software and Affected Versions Better Auth versions 1.5.0-beta.12 through 1.7.6 Description An authentication bypass exists in the OAuth Proxy plugin. Unauthenticated attackers can sign in as other users by forging encrypted profiles. This occurs when the proxy shares the...

CVE-2026-103369: Improper Neutralization of Input During Web Page Generation

The Social Share Buttons & Analytics Plugin – GetSocial.io plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'response' parameter in all versions up to, and including, 4.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

CVE-2026-108484: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WPManageNinja Best Payments Plugin for WP wp-payment-form allows Stored XSS.This issue affects Best Payments Plugin for WP: from n/a through 4.6.27...

CVE-2026-102086: NULL Pointer Dereference

A NULL Pointer Dereference vulnerability in the DNS plugin of Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause a complete Denial-of-Service DoS. When multiple DNS queries are received in a single flow session, where one query matches a Security...

RAW image plugin Heap Buffer Overflow RCE

The vulnerability of the plugin for viewing RAW images is related to the execution of operations outside the buffer in memory. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code...

CVE-2026-86002: Improper Neutralization of Directives in Dynamically Evaluated Code

Dokku is a docker-powered platform as a service. In Dokku versions before 0.38.25, a user with app-level Dokku access and remote SSH access to execute docker-options commands can store arbitrary strings through the docker-options plugin, and those strings are later concatenated into DOCKERARGS an...

CVE-2026-103671: External Control of Assumed-Immutable Web Parameter

External control of assumed-Immutable web parameter issue exists in EC-CUBE plugin for EC-CUBE 4 series "AmazonPay Plugin". If exploited, the user may be redirected to an arbitrary website during the ordering process. As a result, user's account information may be obtained...

VulnCheck KEV: CVE-2026-103671

External control of assumed-Immutable web parameter issue exists in EC-CUBE plugin for EC-CUBE 4 series "AmazonPay Plugin". If exploited, the user may be redirected to an arbitrary website during the ordering process. As a result, user's account information may be obtained...

PT-2026-114318

The Tickera WordPress plugin before 3.6.0.4 does not correctly verify the integrity of incoming payment notifications, and the validated signature does not cover the order or the amount, allowing unauthenticated attackers to forge a payment confirmation and mark arbitrary orders as paid without...

PT-2026-113783

The WPCode WordPress plugin before 2.4.0 does not correctly verify that a request is genuinely for the login screen before entering its snippet safe mode, allowing unauthenticated visitors to disable all of the site's automatically inserted snippets for their own requests...

PT-2026-113922

A NULL Pointer Dereference vulnerability in the DNS plugin of Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause a complete Denial-of-Service DoS. When multiple DNS queries are received in a single flow session, where one query matches a Security...

PT-2026-113684

The Trust Payments Gateway for WooCommerce WordPress plugin before 3.1.0 does not verify the authenticity of the payment provider's response when a customer returns from the hosted payment page, nor bind that response to the targeted order or check the amount, allowing unauthenticated attackers t...

PT-2026-113690

The Tainacan WordPress plugin before 1.4.0 does not restrict its reports REST endpoints to users with a management capability, allowing any authenticated subscriber to read the email addresses of the repository's staff...

CVE-2026-102082: Improper Handling of Missing Special Element

An Improper Handling of Missing Special Element vulnerability in the SSL plugin of Juniper Networks Junos OS on SRX Series allows a network-based, unauthenticated attacker to cause a Denial-of-Service DoS. This issue is will occur when 'ssl-proxy' is configured on SRX platforms and during a TLS...

Juniper Junos OS Vulnerability (JSA112170)

The version of Junos OS installed on the remote host is affected by a vulnerability as referenced in the JSA112170 advisory. - A NULL Pointer Dereference vulnerability in the DNS plugin of Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause a complet...

PT-2026-113722

Name of the Vulnerable Software and Affected Versions AmazonPay Plugin for EC-CUBE 4 series affected versions not specified Description An issue exists where an assumed-immutable web parameter is under external control. This allows an attacker to redirect users to an arbitrary website during the...