PT-2026-97173

The Easy Hide Login WordPress plugin before 1.7 does not fully enforce its hidden-login protection, allowing an unauthenticated attacker to reach the standard login page through certain password-reset request parameters and to recover the site's configured secret login slug from the returned page...

PT-2026-97201

Name of the Vulnerable Software and Affected Versions NP Quote Request for WooCommerce WordPress plugin versions prior to 2.4.16 Description An issue exists where the software fails to verify order ownership before rendering order details. This allows unauthenticated attackers to view the orders ...

CVE-2026-93528: Exposure of Sensitive Information to an Unauthorized Actor

The NP Quote Request for WooCommerce WordPress plugin before 2.4.16 does not verify order ownership before rendering an order's details, allowing unauthenticated attackers to view another customer's order using the order's key...

Linux Distros Unpatched Vulnerability : CVE-2026-94108

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - getID3 through 1.9.26 contains an XML external entity injection vulnerability in the XML2array helper function that fails to properly disable entity loading on...

CVE-2026-77756: Inconsistent Interpretation of HTTP Requests

Inconsistent Interpretation of HTTP Requests 'HTTP Request/Response Smuggling' vulnerability in Apache Tomcat caused by processing the transfer-encoding header for an HTTP/1.0 request may allow an attacker to cause one request from another user to fail when Tomcat is located behind a reverse prox...

CVE-2026-78437: Incomplete Cleanup

Incomplete cleanup vulnerability in Apache Tomcat allows a malformed request to potentially depends on timing cause one request from another user to fail. This issue affects Apache Tomcat: from 11.0.19 through 11.0.25, from 10.1.53 through 10.1.59, from 9.0.116 through 9.0.121. Users are...

CVE-2026-95602: Authorization Bypass Through User-Controlled Key

Authorization Bypass Through User-Controlled Key vulnerability in YITH YITH WooCommerce Request A Quote allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects YITH WooCommerce Request A Quote: from n/a before 4.46.1...

CVE-2026-84168: Exposure of Sensitive Information to an Unauthorized Actor

The Easy Hide Login WordPress plugin before 1.7 does not fully enforce its hidden-login protection, allowing an unauthenticated attacker to reach the standard login page through certain password-reset request parameters and to recover the site's configured secret login slug from the returned page...

PT-2026-97275

The Paymob for WooCommerce WordPress plugin before 4.1.14 does not verify the request signature on one branch of its payment webhook, allowing unauthenticated attackers to mark arbitrary WooCommerce orders as paid without any payment...

PT-2026-97687

Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 13.11 through 19.2.6 GitLab CE/EE versions 19.3 through 19.3.2 GitLab CE/EE versions 19.4 Description An issue exists where improper sanitization of path components in the merge request diff viewer could allow an...

CVE-2026-96446: Missing Authorization

A flaw was found in the Pushed Authorization Request PAR implementation of Keycloak. The issue occurs when the silent authentication path prompt=none is used, which allows the authorization process to skip certain steps if a user is already logged in. Due to this bypass, the security rule that...

CVE-2026-76086: Missing Authorization

Formie is a Craft CMS plugin for creating forms. Prior to 2.2.23 and 3.1.31, Formie's formie/integrations/form-settings control panel action in IntegrationsController::actionFormSettings is reachable without the required form integration permissions and passes request-supplied settings to a...

CVE-2026-92284: Allocation of Resources Without Limits or Throttling

Caddy is an extensible server platform that uses TLS by default. In version 2.11.3 and earlier, in modules/caddyhttp/replacer.go, resolving http.request.body reads the complete request body with an unbounded io.Copy before request-body middleware limits apply, allowing memory exhaustion and proce...

PT-2026-97553

Name of the Vulnerable Software and Affected Versions sfturing hosp order versions up to 627f426331da8086ce8fff2017d65b1ddef384f8 Description A remote attack can lead to cross-site request forgery, which occurs when a malicious site tricks a user's browser into performing an unwanted action on a...

PT-2026-97490

Authorization Bypass Through User-Controlled Key vulnerability in YITH YITH WooCommerce Request A Quote allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects YITH WooCommerce Request A Quote: from n/a before 4.46.1...

CVE-2025-63564

The Moodle Socialwall plugin versions v.3.0 through v.3.3 are affected by a SQL injection vulnerability. An attacker can exploit this flaw by sending crafted HTTP requests , which may lead to the execution of arbitrary code . The vulnerability is classified with a CRITICAL base severity score of ...

Linux Distros Unpatched Vulnerability : CVE-2026-95362

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Cross-site request forgery in DevTools. CVE-2026-95362 Note that Nessus relies on the presence of the package as reported by the vendor. %NASLMINLEVEL 80900 C...

PT-2026-97287

Name of the Vulnerable Software and Affected Versions Keycloak affected versions not specified Description A flaw exists in the Pushed Authorization Request PAR implementation. When the silent authentication path prompt=none is used, the authorization process may skip specific steps for users who...

Linux Distros Unpatched Vulnerability : CVE-2026-62987

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Fabio is an HTTPS and TCP router for deploying applications managed by consul. From 1.6.6 until 1.7.2, the CVE-2025-48865 fix in proxy/httpheaders.go uses...

Goproxy Proxy Server Bypass Unauthorized Access

The vulnerability of the Goproxy proxy server’s HTTP request processing module lies in the ability to bypass authentication by using an alternative path or channel. Exploiting this vulnerability allows a malicious actor to circumvent existing security mechanisms and gain unauthorized access to...