CVE-2026-16080

The Image Uploader for Welcart plugin for WordPress is vulnerable to generic SQL Injection via the 'posttitle' parameter in all versions up to, and including, 1.4.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes...

CVE-2026-16080

CVE-2026-16080 affects the WordPress plugin “Image Uploader for Welcart” (authenticated scenario). The vulnerability is a generic SQL injection in the attachment field post_title for versions up to 1.4.6, caused by insufficient escaping of user input and lack of proper query preparation. Impact d...

CVE-2026-16080 Image Uploader for Welcart <= 1.4.6 - Authenticated (Author+) SQL Injection via Attachment 'post_title' Parameter

The Image Uploader for Welcart plugin for WordPress is vulnerable to generic SQL Injection via the 'posttitle' parameter in all versions up to, and including, 1.4.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes...

EUVD-2026-58834

The Image Uploader for Welcart plugin for WordPress is vulnerable to generic SQL Injection via the 'posttitle' parameter in all versions up to, and including, 1.4.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes...

aquila-graph-poc

Aquila Graph POC A reproducible proof of concept for combinin...

SUSE CVE-2022-4993

HTML::FormHandler versions through 0.40068 for Perl allow attacker selected method dispatch and resource exhaustion because applyactions and adderror use error message text built from request data as a Locale::Maketext bracket notation template. adderror hands its first argument to the language...

SUSE CVE-2026-13051

Form::Processor::Field::HtmlArea versions from 0.06 through 1.162360 for Perl allow attacker selected method dispatch and resource exhaustion via an HTML::Tidy diagnostic that validate passes to adderror as a Locale::Maketext template. validate runs HTML::Tidy over the submitted markup and passes...

SUSE CVE-2026-14664

Heap buffer overflow in PostgreSQL regexp allows the query author to execute arbitrary code as the operating system user running the database, via text that would not pass encoding validation. This shares heritage with CVE-2026-2006, but this case involved unanticipated data growth when...

SUSE CVE-2026-14666

Incomplete tracking in PostgreSQL of changes to role membership, role attributes, and database ownership allows a query to continue using cached row-level security policies after those changes require a different policy, via plan reuse. Stale policies continue until some other event invalidates t...

PT-2026-72919

In the Linux kernel, the following vulnerability has been resolved: s390/qeth: Check CAP NET ADMIN for private ioctls Gate the SIOCDEVPRIVATE ioctl commands SIOC QETH ADP SET SNMP CONTROL, SIOC QETH GET CARD TYPE and SIOC QETH QUERY OAT with CAP NET ADMIN capable check to ensure unprivileged user...

PT-2026-72156

Name of the Vulnerable Software and Affected Versions Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms versions prior to 5.2 Description This issue is a generic SQL Injection that occurs due to insufficient escaping of user-supplied parameters and a lack of sufficient preparati...

PT-2026-72807

In the Linux kernel, the following vulnerability has been resolved: bpf: fix BPF PROG QUERY OOB write and cgroup backward compat BPF PROG QUERY writes back the 'query.revision' field unconditionally to userspace. If userspace passes a smaller 'bpf attr' structure e.g. 40 bytes, which was the layo...

PT-2026-73230

Three pressures shaped this week's queue. Perimeter and analytics software came under confirmed attack, with three fresh KEV entries carrying remediation deadlines that have already passed. Microsoft shipped one of the largest security releases in its history. PostgreSQL shipped the largest singl...

PT-2026-72154

The Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms plugin for WordPress is vulnerable to generic SQL Injection via the 'key' parameter in all versions up to, and including, 5.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on t...

PT-2026-72510

In the Linux kernel, the following vulnerability has been resolved: ipv6: mcast: Fix potential UAF in MLD delayed work A race condition exists between device teardown and incoming MLD query processing, leading to a Use-After-Free in the MLD delayed work. During device destruction, the primary...

PT-2026-73058

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.7.4 Description An authentication bypass exists in the WebSocket endpoint due to differential parsing of query parameters between authentication exemption and session quarantine checks. Unauthenticated attackers can...

PT-2026-72511

In the Linux kernel, the following vulnerability has been resolved: ipv4: igmp: Fix potential UAF in igmp gq start timer A race condition exists between device teardown inetdev destroy and incoming IGMP query processing igmp rcv, leading to a Use-After-Free in the IGMP timer callback. During devi...

PT-2026-72143

Name of the Vulnerable Software and Affected Versions Object Sync for Salesforce versions prior to 2.2.14 Description An unauthenticated SQL Injection exists in the /wp-json/object-sync-for-salesforce/push/ REST endpoint. The issue occurs because the can process permission callback only verifies...

PT-2026-72902

In the Linux kernel, the following vulnerability has been resolved: drm/amd/pm: fix pptable use-after-free amdgpu dpm get pp table returns a pointer to a driver-owned power table after dropping adev-pm.mutex. The sysfs path then copies from that pointer. A concurrent pp table write can replace an...

PT-2026-72887

Name of the Vulnerable Software and Affected Versions WPML Multilingual CMS versions prior to 4.9.6 Description Insufficient escaping of user-supplied input and lack of proper preparation in SQL queries allow authenticated attackers with translator-level access or higher to perform SQL Injection...