CVE-2026-86796

Hide My WP Ghost (WP Ghost) WordPress plugin versions before 7.0.11 contain an unauthenticated bypass of its firewall, threat-detection, and login/URL-hiding protections. The root cause is that the plugin does not verify a request is a genuine WooCommerce request before disabling those protection...

CVE-2026-86796 WP Ghost (Hide My WP Ghost) 7.0.10 - Unauthenticated Firewall, Threat Detection and URL Hiding Bypass via WooCommerce Request Parameters

The Hide My WP Ghost WordPress plugin before 7.0.11 does not verify that a request is a genuine WooCommerce request before disabling its firewall, threat-detection and login/URL-hiding protections, treating the mere presence of an attacker-suppliable request parameter as sufficient, which allows...

EUVD-2026-82685

The Hide My WP Ghost WordPress plugin before 7.0.11 does not verify that a request is a genuine WooCommerce request before disabling its firewall, threat-detection and login/URL-hiding protections, treating the mere presence of an attacker-suppliable request parameter as sufficient, which allows...

SUSE CVE-2026-85732

oras-go is a Go library for managing OCI artifacts. Prior to 2.6.2, the parseLink function in registry/remote/utils.go accepts an absolute URL from a registry-controlled Link response header without validating its scheme, host, or port. Tags, Referrers, and Repositories pagination operations then...

SUSE CVE-2026-90125

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix request buffer leak in smb2newreadreq smb2newreadreq allocates the request buffer with smb2plainreqinit but only publishes it to the caller with buf = req at the very end of the function. Two error returns sit in...

SUSE CVE-2026-90343

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: stop PMSR before P2P and NAN teardown PMSR request teardown must abort active measurements while the wirelessdev is still present in the driver. cfg80211leavelocked and cfg80211stoppd already do this before invoki...

PT-2026-95419

Name of the Vulnerable Software and Affected Versions gedelumbung HospitalManagement versions up to c2d45543789a3887067d3915f69d44cfc2cf76a8 Description A weakness allows for cross-site request forgery, which can be initiated remotely. Cross-site request forgery is a type of attack that tricks a...

PT-2026-95388

Name of the Vulnerable Software and Affected Versions NUUO Network Video Recorder version 2.0.0 Description An arbitrary file read issue exists in the 'up.php' endpoint. The application receives the url parameter via a POST request and uses the fopen function to open the specified URL in binary...

PT-2026-95259

Name of the Vulnerable Software and Affected Versions Hide My WP Ghost versions prior to 7.0.11 Description The plugin fails to verify if a request is a genuine WooCommerce request before disabling its firewall, threat-detection, and login/URL-hiding protections. An unauthenticated attacker can...

PT-2026-95609

IBM WebSphere Application Server 8.5 is affected by an HTTP request smuggling vulnerability due to improper handling of Content-Length headers...

CVE-2026-84077: Cross-Site Request Forgery (CSRF)

IBM Guardium Data Protection 12.2 could allow a remote attacker to bypass security restrictions due to a cross-site request forgery vulnerability...

CVE-2026-11722: Inconsistent Interpretation of HTTP Requests

IBM WebSphere Application Server 8.5 and 9.0, and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 are affected by an HTTP request smuggling vulnerability...

CVE-2026-86796: Protection Mechanism Failure

The Hide My WP Ghost WordPress plugin before 7.0.11 does not verify that a request is a genuine WooCommerce request before disabling its firewall, threat-detection and login/URL-hiding protections, treating the mere presence of an attacker-suppliable request parameter as sufficient, which allows...

CVE-2026-11548: Inconsistent Interpretation of HTTP Requests

IBM WebSphere Application Server 8.5 and 9.0, and and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 are affected by an HTTP request smuggling vulnerability...

PT-2026-95423

Name of the Vulnerable Software and Affected Versions Netty affected versions not specified Description A flaw in the HTTP/1.1 decoder allows a remote attacker to bypass Transfer-Encoding header validation. By splitting the Transfer-Encoding field across multiple headers and ensuring the last fie...

PT-2026-95287

Name of the Vulnerable Software and Affected Versions WP Multi Store Locator Pro versions prior to 4.5.2 Description An issue exists where unauthenticated attackers can perform SQL Injection by appending additional queries to existing ones to extract sensitive database information. This occurs...

CVE-2026-11710: Inconsistent Interpretation of HTTP Requests

IBM WebSphere Application Server 8.5 is affected by an HTTP request smuggling vulnerability due to improper handling of Content-Length headers...

PT-2026-95607

IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by an HTTP request smuggling vulnerability...

PT-2026-95612

Name of the Vulnerable Software and Affected Versions IBM WebSphere Application Server affected versions not specified IBM WebSphere Application Server Liberty affected versions not specified Description IBM WebSphere Application Server and WebSphere Application Server Liberty are subject to HTTP...

Tenda CX12L Wi-Fi Router DoS

The vulnerability of the fromNatStaticSetting function /goform/NatStaticSetting in the Tenda CX12L Wi-Fi router software is related to buffer overflow in the stack. Exploiting this vulnerability could allow an attacker to trigger a service failure by sending a specially crafted POST request...