CVE-2026-92966

The The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin is vulnerable to unauthenticated arbitrary shortcode execution in versions up to and including 5.7.0 . The root cause is insufficient validation of input values before they are processed by the do_shortcod...

CVE-2026-92966 Appointment Booking Plugin <= 5.7.0 - Unauthenticated Arbitrary Shortcode Execution via First/Last Name Field

The The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.7.0. This is due to the software allowing users to execute an action that does not properly validate a...

EUVD-2025-209823

The WPC Badge Management for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'text' attribute of the wpcbmbestseller shortcode in all versions up to, and including, 3.1.6 due to insufficient input sanitization and output escaping. This makes it possible for...

EUVD-2025-209819

The Broadstreet plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the createadvertiser AJAX action in all versions up to, and including, 1.53.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create...

EUVD-2025-209820

The Broadstreet plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.53.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions an...

EUVD-2025-209816

The Cost Calculator Builder plugin for WordPress is vulnerable to Unauthenticated Price Manipulation and Insecure Direct Object Reference IDOR in all versions up to, and including, 4.0.1 only when used in combination with Cost Calculator Builder PRO. This is due to the ccbwoocommercepayment AJAX...

EUVD-2025-209818

The Broadstreet plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.53.1 via the getsponsoredmeta AJAX action. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract data from password protect...

PT-2026-103707

The Five Star Restaurant Reviews WordPress plugin before 2.3.14 does not properly escape a user-supplied value before outputting it into an HTML tag, allowing unauthenticated attackers to inject arbitrary web script that runs in the browser of anyone tricked into submitting a crafted request,...

PT-2026-103701

The Download Manager WordPress plugin before 3.3.71 does not sufficiently sanitise and escape a package setting before outputting it back in a page, which could allow users with the Author role and above to perform Stored Cross-Site Scripting attacks against any visitor who opens the package's...

PT-2026-103835

Name of the Vulnerable Software and Affected Versions Apache APISIX versions 3.12.0 through 3.18.0 Description Improper Authentication occurs when using the openid-connect plugin with remote introspection against an authorization server that serves multiple issuers. In this scenario, a token that...

PT-2026-103831

Name of the Vulnerable Software and Affected Versions Apache APISIX versions 3.17.0 through 3.18.0 Description An improper verification of cryptographic signatures occurs within the saml-auth plugin under default configuration. This allows an unauthenticated attacker to impersonate any user on...

PT-2026-103954

Name of the Vulnerable Software and Affected Versions Capacitor versions prior to 6.2.2 Capacitor versions prior to 7.6.9 Capacitor versions prior to 8.3.5 Capacitor versions prior to 8.4.3 Capacitor versions prior to 8.5.1 Description The Android and iOS WebView navigation guard validates the ho...

Rocky Linux 10.2 [CIQ] Security Update: mysql8.4 / mysql8.4-common / mysql8.4-debuginfo / etc Multiple Vulnerabilities (crlsa-2026_20693)

The Rocky Linux 10.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202620693 advisory. mysql: InnoDB unspecified vulnerability CPU Apr 2026 CVE-2026-22004 mysql: Information Schema unspecified vulnerability CPU Apr 2026 CVE-2026-22001...

Rocky Linux 9 [CIQ] Security Update: vim-X11 / vim-X11-debuginfo / vim-common / vim-common-debuginfo / etc Multiple Vulnerabilities (crlsa-2026_8259)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20268259 advisory. vim: Vim: Arbitrary code execution via OS command injection in the netrw plugin CVE-2026-28417 vim: Vim: Denial of service and information disclosure via...

Rocky Linux 9.6 [TuxCare] Security Update: vim-X11 / vim-common / vim-enhanced / vim-filesystem / vim-minimal (ALMALINUX9.6:CLSA-2026:1781607668)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1781607668 advisory. - Vim is an open source, command line text editor. Prior to version 9.2.0495, a Vimscript code injection vulnerability exists in...

CentOS Linux 7 [TuxCare] Security Update: vim-X11 / vim-common / vim-enhanced / vim-filesystem / vim-minimal (CENTOS7:CLSA-2026:1782139332)

The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2026:1782139332 advisory. - Vim is an open source, command line text editor. Prior to version 9.2.0495, a Vimscript code injection vulnerability exists in...

AlmaLinux 9.2 [TuxCare] Security Update: grafana (ALMALINUX9.2:CLSA-2025:1751142388)

The AlmaLinux 9.2 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1751142388 advisory. - Grafana is an open source observability and data visualization platform. Versions of Grafana for endpoints prior to 9.1.8 and 8.5.14 could...

Rocky Linux 8 [CIQ] Security Update: mecab / mecab-debuginfo / mecab-debugsource / mecab-devel / etc Multiple Vulnerabilities (crlsa-2026_26180)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202626180 advisory. mysql: InnoDB unspecified vulnerability CPU Apr 2026 CVE-2026-22004 mysql: Information Schema unspecified vulnerability CPU Apr 2026 CVE-2026-22001 mysql:...

Rocky Linux 8 [CIQ] Security Update: mecab / mecab-debuginfo / mecab-debugsource / mecab-devel / etc Multiple Vulnerabilities (crlsa-2026_25919)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202625919 advisory. mysql: InnoDB unspecified vulnerability CPU Apr 2026 CVE-2026-22004 mysql: Information Schema unspecified vulnerability CPU Apr 2026 CVE-2026-22001 mysql:...

Linux Distros Unpatched Vulnerability : CVE-2026-47503

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - NVIDIA GPU Display Driver for Linux contains a vulnerability in the Virtual GPU Manager vGPU plugin, where a guest VM user may cause an out-of-bounds write by...