PT-2026-97193

Name of the Vulnerable Software and Affected Versions Booking Manager WordPress plugin versions prior to 2.1.21 Description Authenticated users with Author-level access and above can perform SQL injection attacks. This occurs because the plugin fails to sanitize and escape values retrieved from a...

CVE-2026-87848: Missing Authorization

The MPCX Lightbox WordPress plugin 1.2.2 through 1.2.5 does not have any authorisation or authentication on one of its AJAX actions available to unauthenticated users, nor does it check the status of the requested post, allowing unauthenticated visitors to retrieve the title, content or excerpt o...

CVE-2026-93508: Missing Authorization

The WC Fields Factory WordPress plugin before 4.1.11 does not properly restrict access to its field-management AJAX action, allowing authenticated users with Subscriber-level access and above to create, modify and delete arbitrary post meta on any post, including WooCommerce products, regardless ...

CVE-2026-84150: Authorization Bypass Through User-Controlled Key

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.5 does not verify that the target user of a REST route matches the authenticated caller before reading and modifying that user's saved favorites, allowing any authenticated user with...

CVE-2026-66076: Missing Authorization

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, isauthorized/2 calls rabbitmgmtutil:isauthorized/2, which checks only the management tag, instead of isauthorizedvhost/2. The /api/queues/quorum/:vhost/:queue/status handler reads the vhost...

CVE-2026-86612: Improper Neutralization of Special Elements in Output Used by a Downstream Component

The Ninja Tables WordPress plugin before 5.2.17 does not restrict shortcode expansion to administrator-authored table rows which, in a non-default configuration, allows unauthenticated users to have arbitrary shortcodes executed on a public page, and to permanently break that page, by submitting ...

MAL-2026-16476 Malicious code in @memtensor/memos-cloud-openclaw-plugin (npm)

On September 23, 2026, an attacker published malicious versions of two MemTensor packages. The affected packages are the OpenClaw plugin @memtensor/memos-cloud-openclaw-plugin on npm and the MemOS Python library MemoryOS on PyPI. Both versions contain the same Go implant, sckit. The binary runs i...

CVE-2026-93510: Missing Authorization

The Points and Rewards for WooCommerce WordPress plugin before 2.10.4 does not validate the claimed reward amount or restrict who can call its Win Wheel claim handler, allowing authenticated users, Subscriber and above, to credit their own account with an arbitrary and unlimited amount of loyalty...

PT-2026-97244

Name of the Vulnerable Software and Affected Versions Tauri affected versions not specified Description The updater plugin verifies update binaries using minisign signatures, but the signature only covers the raw binary bytes. The update manifest, which includes the version number, download URL,...

CVE-2026-86603: Exposure of Sensitive Information to an Unauthorized Actor

The WP Recipe Maker WordPress plugin before 10.8.2 does not have any authorisation check in one of its AJAX actions, allowing any authenticated user, such as a subscriber, to retrieve the IDs and titles of other users' unpublished lists...

PT-2026-97157

Name of the Vulnerable Software and Affected Versions Newsletters WordPress plugin versions prior to 4.18.1 Description The plugin fails to perform ownership checks on certain subscriber management actions and grants management sessions to unauthenticated visitors upon request. This allows...

PT-2026-105065

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.17, 4.0.22, 4.1.13, and 4.2.6, match origin/1 returned the bare reflected Origin and allowed credentials even when the wildcard "" was configured, so the response echoed the attacker's origin together with...

PT-2026-97200

Name of the Vulnerable Software and Affected Versions Premium Packages WordPress plugin versions prior to 7.2.1 Description The plugin fails to verify the signature of webhooks received from PayPal when processing payment and subscription notifications. This allows unauthenticated attackers to...

PT-2026-97174

Name of the Vulnerable Software and Affected Versions The Events Calendar WordPress plugin versions prior to 6.17.5 Description A broken access control issue exists where the software fails to verify the post status of linked records before including their stored details in a public REST API...

CVE-2026-81338: Insufficient Verification of Data Authenticity

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not properly sanitise and restrict HTML in user-submitted content before storing it and rendering it to other users, allowing users with subscriber-level accounts and above to perform stored HTML injection, such as embedding...

Malicious code in @memtensor/memos-cloud-openclaw-plugin (npm)

On September 23, 2026, an attacker published malicious versions of two MemTensor packages. The affected packages are the OpenClaw plugin @memtensor/memos-cloud-openclaw-plugin on npm and the MemOS Python library MemoryOS on PyPI. Both versions contain the same Go implant, sckit. The binary runs i...

PT-2026-97568

Name of the Vulnerable Software and Affected Versions RabbitMQ versions prior to 3.13.15 RabbitMQ versions prior to 4.0.20 RabbitMQ versions prior to 4.1.11 RabbitMQ versions prior to 4.2.6 RabbitMQ versions prior to 4.3.0 Description When no CA bundle is available, the ssl options/1 function fal...

CVE-2026-67232: Improper Handling of Highly Compressed Data (Data Amplification)

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, The cowboy WebSocket options at line 117 set compress = true, enabling RFC 7692 permessage-deflate negotiation. The handler does not set maxframesize, so cowboy's default of infinity applies...

PT-2026-97171

🚨 CVE-2026-84098 The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.5 does not properly verify a listing's ownership before deleting it, allowing authenticated attackers with Subscriber-level access and above to delete arbitrary listings, includi...

CVE-2026-75825: Missing Authentication for Critical Function

ZohoCorp ManageEngine OpManager versions 12.8.710 and below with the Application Manager Plugin enabled were vulnerable to an Authentication Bypass vulnerability...