PT-2026-81871

A Stored XSS vulnerability in forum reward comments in GazellePW GazellePosterWall commit 86c4bedf727691b5a97af42a4864869d18446449 allows remote attackers to inject arbitrary JavaScript via the c parameter in /forums.php?action=ajax get jf which is later rendered in the data-tooltip attribute in...

CVE-2026-38467

A SQL injection vulnerability in the tags manager in GazellePW GazellePosterWall commit 86c4bedf727691b5a97af42a4864869d18446449 allows remote authenticated users with usersmod privileges to execute arbitrary SQL commands via the tagid or type parameter in a crafted POST request to...

CVE-2026-38469

A Stored XSS vulnerability in the custom bonus title feature in GazellePW GazellePosterWall commit 86c4bedf727691b5a97af42a4864869d18446449 allows remote authenticated users to inject arbitrary JavaScript via the title parameter in /bonus.php and /user.php?action=stafftool...

CVE-2026-38472

A Stored XSS vulnerability in forum reward comments in GazellePW GazellePosterWall commit 86c4bedf727691b5a97af42a4864869d18446449 allows remote attackers to inject arbitrary JavaScript via the c parameter in /forums.php?action=ajaxgetjf which is later rendered in the data-tooltip attribute in...

UBUNTU-CVE-2026-63076

Issue summary: OpenSSL CMP password based protection verification only checks whether the protectionAlg parameter was not NULL and not its ASN.1 type, before treating it as a PBMParameter. A crafted message can contain a parameter of a different type, which is then dereferenced as an invalid...

PT-2026-81126

Adminer before 5.5.0 contains a server-side request forgery vulnerability in the login form's server field validator, which only inspects leading integers for privileged ports and fails to reject non-numeric port values. Attackers can inject PDO DSN keys like host= and port= into the server...

PT-2026-81890

Name of the Vulnerable Software and Affected Versions Doorkeeper OpenID Connect versions prior to 1.10.4 Description The Dynamic Client Registration DCR endpoint persists client-supplied scopes without validating them against the server's configured scope set. In the...

PT-2026-81190

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to DOM-Based Reflected Cross-Site Scripting via the 'error description' parameter in all versions up to, and including, 1.57.0 due to insufficient input sanitization and output escaping. Thi...

JetBrains TeamCity < 2022.04.2 Multiple Vulnerabilities

The version of JetBrains TeamCity installed on the remote host is prior to 2022.04.2. It is, therefore, affected by multiple vulnerabilities: - In JetBrains TeamCity before 2022.04.2 the private SSH key could be written to the build log in some cases CVE-2022-36321 - In JetBrains TeamCity before...

Linux Distros Unpatched Vulnerability : CVE-2026-78679

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GitPython before 3.1.59 contains an arbitrary file read vulnerability in TagReference.create where a positional reference parameter bypasses the unsafe option...

Linux Distros Unpatched Vulnerability : CVE-2026-77635

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - CakePHP is a rapid development framework for PHP. Prior to versions 5.1.10, 5.2.15, and 5.3.7 on their respective release lines, FunctionsBuilder::jsonValue wit...

The vulnerability of the register.php component in the phpMyFAQ web application allows a hacker to circumvent existing security restrictions.

The vulnerability of the register.php component in the phpMyFAQ web application is related to the lack of authentication when processing the security.enableRegistration parameter. Exploiting this vulnerability allows a malicious actor to bypass existing security restrictions by sending a speciall...

PT-2026-81426

Webkul QloApps does not validate request parameters before a database query. A remote, authenticated attacker with administrative privileges could send a crafted SQL query to the 'bo query' parameter in the 'Address.php' file. Fixed in 123c97c...

CVE-2026-38469

A Stored XSS vulnerability in the custom bonus title feature in GazellePW GazellePosterWall commit 86c4bedf727691b5a97af42a4864869d18446449 allows remote authenticated users to inject arbitrary JavaScript via the title parameter in /bonus.php and /user.php?action=stafftool...

PT-2026-81400

The FluentCRM Pro – Email Newsletter, Automation, Email Marketing, Email Campaigns, Optins, Leads, and CRM Solution plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 3.1.12 due to insufficient escaping on the user supplied parameter and lack of sufficient...

Important: kernel

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: NFSv4/flexfiles: reject zero filehandle version count CVE-2026-53392 In the Linux kernel, the following vulnerability has been resolved: nfsd: reset write verifier on deferred writeback errors CVE-2026-53393 In th...

Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.15-2026-113 (ALASKERNEL-5.15-2026-113)

The version of kernel installed on the remote host is prior to 5.15.213-150.251. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.15-2026-113 advisory. In the Linux kernel, the following vulnerability has been resolved: NFSv4/flexfiles: reject zero...

CVE-2026-38466

A Stored XSS vulnerability in the torrent remaster custom title feature in GazellePW GazellePosterWall commit 86c4bedf727691b5a97af42a4864869d18446449 allows remote authenticated users to inject arbitrary JavaScript via the remastercustomtitle parameter, which is stored during torrent upload or...

CVE-2026-38472

A Stored XSS vulnerability in forum reward comments in GazellePW GazellePosterWall commit 86c4bedf727691b5a97af42a4864869d18446449 allows remote attackers to inject arbitrary JavaScript via the c parameter in /forums.php?action=ajaxgetjf which is later rendered in the data-tooltip attribute in...

CVE-2026-38466

A Stored XSS vulnerability in the torrent remaster custom title feature in GazellePW GazellePosterWall commit 86c4bedf727691b5a97af42a4864869d18446449 allows remote authenticated users to inject arbitrary JavaScript via the remastercustomtitle parameter, which is stored during torrent upload or...