CVE-2026-85705: Improper Neutralization of Special Elements used in an SQL Command

The Location Manager plugin for WordPress is vulnerable to generic SQL Injection via 'latitude' and 'longitude' REST API Parameters in all versions up to, and including, 2.3.38 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query...

PT-2026-95676

Name of the Vulnerable Software and Affected Versions IBM Guardium Data Protection version 12.2 Description An OS command injection flaw exists in the Universal Connector plugin upload functionality. A privileged authenticated attacker can provide a malicious filename that is incorporated into a...

CVE-2019-25776: Improper Neutralization of Special Elements used in an SQL Command

Weaver E-cology contains an unauthenticated SQL injection vulnerability that allows remote attackers to execute arbitrary SQL queries by submitting malicious input through the userIdentifiers GET parameter in the mobile plugin endpoint. Attackers can bypass space-based filter controls by wrapping...

PT-2026-95788

Name of the Vulnerable Software and Affected Versions Bread plugin for WordPress versions prior to 2.9.13 Description Information exposure occurs due to missing authentication and authorization checks in the settings export functionality. The download settings function, registered on the plugins...

PT-2026-95211

Name of the Vulnerable Software and Affected Versions Nextcloud affected versions not specified Description An improper authorization issue exists in the DAV plugin where the system resolves files from the absolute request URI without verifying if the path segment matches the authenticated sessio...

PT-2026-101075

Security vulnerability affects the kyverno-policy-reporter-kyverno-plugin-fips package. This issue is resolved in later releases. See references for vulnerability details...

PT-2026-100841

Security vulnerability affects the kyverno-policy-reporter-kyverno-plugin-fips package. This issue is resolved in later releases. See references for vulnerability details...

PT-2026-100972

Security vulnerability affects the kyverno-policy-reporter-kyverno-plugin-fips package. This issue is resolved in later releases. See references for vulnerability details...

PT-2026-100592

Security vulnerability affects the kyverno-policy-reporter-kyverno-plugin-fips package. This issue is resolved in later releases. See references for vulnerability details...

CVE-2026-93873: Cross-Site Request Forgery (CSRF)

Cotonti through 1.0.0 fails to validate anti-CSRF tokens in the contact plugin submission handler, allowing attackers to forge messages. Attackers can auto-submit contact forms from attacker-controlled pages to send forged messages attributed to authenticated victims to the administrator inbox...

PT-2026-95258

Name of the Vulnerable Software and Affected Versions Breeze Cache WordPress plugin versions prior to 2.5.15 Description The plugin fails to include specific tracking-related query parameters in its page-cache key while continuing to cache pages requested with those parameters. This allows an...

CVE-2026-89008: Exposure of Sensitive Information to an Unauthorized Actor

The Bookit — Booking & Appointment Calendar WordPress plugin before 2.6.0.5 does not perform an authorization check on one of its appointment-retrieval actions, allowing users with a low-privilege Bookit — Booking & Appointment Calendar WordPress plugin before 2.6.0.5-specific role to read other...

PT-2026-95231

Name of the Vulnerable Software and Affected Versions MasterStudy LMS WordPress Plugin versions prior to 3.7.50 Description Insufficient per-object ownership or capability checks occur when updating orders via the REST API. This allows users with the Instructor role to modify any order on the sit...

CVE-2026-15797: Improper Neutralization of Input During Web Page Generation

The Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via posttitle in all versions up to, and including, 1.24.0 due to insufficient input sanitization and output escaping. This makes it...

PT-2026-95781

Name of the Vulnerable Software and Affected Versions Search Atlas SEO – Premier SEO Plugin for One-Click WP Publishing & Integrated AI Optimization versions prior to 2.6.24 Description An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform...

EulerOS 2.0 SP10 : docker-engine (EulerOS-SA-2026-3688)

According to the versions of the docker-engine package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Moby is an open source container framework. Prior to version 29.3.1, a security vulnerability has been detected that allows plugins privileg...

Oracle Linux 10 : sudo (ELSA-2026-68692)

The remote Oracle Linux 10 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-68692 advisory. - Fix CVE-2026-82474: execveat2 intercept/logsubcmds bypass Tenable has extracted the preceding description block directly from the Oracle Linux security...

PT-2026-95775

Name of the Vulnerable Software and Affected Versions Create plugin for WordPress versions prior to 2.5.4 Description An issue exists where authenticated attackers with author-level access or higher can perform a SQL Injection. This occurs because the order by parameter is not sufficiently escape...

PT-2026-95293

Name of the Vulnerable Software and Affected Versions NEX-Forms – Ultimate Forms Plugin for WordPress versions prior to 9.3.1 Description An issue exists where authenticated attackers with custom-level access and above can perform a generic SQL Injection. This occurs because the additional params...

CVE-2026-75961: Improper Neutralization of Special Elements used in an SQL Command

The NEX-Forms – Ultimate Forms Plugin for WordPress plugin for WordPress is vulnerable to generic SQL Injection via the 'additionalparams' parameter in all versions up to, and including, 9.3.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the...