PT-2026-78432

Name of the Vulnerable Software and Affected Versions HumHub Community Edition version 1.18.4 Description A reflected cross-site scripting issue exists in the Space membership-request workflow. An attacker can inject malicious button configuration into the options query-string parameter of the...

CVE-2026-18756: Improper Neutralization of Input During Web Page Generation

HumHub Community Edition 1.18.4 contains a reflected cross-site scripting vulnerability in the Space membership-request workflow. An attacker can place attacker-controlled button configuration in the options query-string parameter of space/membership/request-membership-form, lure an authenticated...

The vulnerability of the Adobe Campaign Classic software platform for managing marketing campaigns stems from the lack of protective measures for the SQL query structure, allowing attackers to execute arbitrary code.

The vulnerability of the Adobe Campaign Classic software platform for managing marketing campaigns is related to the lack of security measures regarding the SQL query structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary code...

Linux Distros Unpatched Vulnerability : CVE-2026-18695

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue in MongoDB Server's handling of certain query predicates against time-series collections with a metaField could allow an authenticated user with write...

Linux Distros Unpatched Vulnerability : CVE-2026-18694

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue in MongoDB Server's geospatial query processing could allow an authenticated user with write privileges to cause certain malformed geometry data to be...

CVE-2026-72322

A flaw was found in the Linux kernel's IPv6 multicast mcast component. A race condition exists during the teardown of a network device and the processing of incoming Multicast Listener Discovery MLD queries. This can lead to a Use-After-Free UAF vulnerability, where memory is accessed after it ha...

Froxlor: Credential and 2FA secret disclosure via Froxlor API endpoints

Summary Several Froxlor API command classes return sensitive authentication material in JSON API responses. The affected endpoints retrieve full database rows using SELECT , SELECT alias., or equivalent full-row queries, then return the results directly through $this-response... without removing...

CVE-2026-49223 Vvveb product review authorization bypass allows Vendors to read, approve, edit, or delete reviews under other Vendors' products

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend product review operations allow a low-privileged Vendor to manage reviews under another Vendor's products. The admin/sql/sqlite/productreview.sql queries accept ...

CVE-2026-49223

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend product review operations allow a low-privileged Vendor to manage reviews under another Vendor's products. The admin/sql/sqlite/productreview.sql queries accept ...

CVE-2026-49222

In Vvveb versions before 1.0.8.4, the admin/sql/sqlite/product_question.sql queries accept a caller-controlled product_question_id without verifying that product_question.product_id belongs to the current vendor's admin_id. A low-privileged vendor can read, approve, edit, or delete questions unde...

CVE-2026-49221

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend digital asset operations allow a low-privileged Vendor to access digital assets linked to another Vendor's products. The admin/controller/product/digital-asset.p...

CVE-2026-66622

Unauthenticated SQL Injection in Depicter Slider = 4.8.0 versions...

CVE-2026-73345 WordPress License Manager for WooCommerce plugin <= 3.0.18 - SQL Injection vulnerability

Customer SQL Injection in License Manager for WooCommerce = 3.0.18 versions...

CVE-2026-75842

ArcadeDB versions before 26.8.1 contain an arbitrary file read vulnerability in the OpenCypher LOAD CSV FROM clause that allows authenticated users to read local files. Attackers with read query privileges can use the file:// protocol in LOAD CSV statements to access arbitrary files with server...

CVE-2026-75842 ArcadeDB before 26.8.1 Arbitrary File Read via LOAD CSV

ArcadeDB versions before 26.8.1 contain an arbitrary file read vulnerability in the OpenCypher LOAD CSV FROM clause that allows authenticated users to read local files. Attackers with read query privileges can use the file:// protocol in LOAD CSV statements to access arbitrary files with server...

WordPress Query Wrangler plugin <= 1.5.57 - Authenticated (Subscriber+) Remote Code Execution via 'options' Parameter vulnerability

Authenticated Subscriber+ Remote Code Execution via 'options' Parameter vulnerability discovered by Enis - TURKOL YAZILIM in WordPress Plugin Query Wrangler versions = 1.5.57...

SUSE CVE-2026-18635

Velociraptor's VQL has a query plugin which allows running a VQL query in a different org or user context. To be able to run as a different user, the calling user needs to have the IMPERSONATE permission usually only given to administrators. Velociraptor versions prior to 0.77.2 evaluate this...

PT-2026-79911

GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.1.4 and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user to read policy configuration belonging to a namespace they were not authorized to access, due to incorrect...

PT-2026-84058

Уязвимость системы управления содержимым сайта DIAFAN.CMS связана с непринятием мер по защите структуры запроса SQL. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, выполнить произвольный код...

PT-2026-84057

Уязвимость системы управления содержимым сайта DIAFAN.CMS связана с непринятием мер по защите структуры запроса SQL. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, выполнить произвольный код...