PT-2026-81855

A SQL injection vulnerability in the country-code lookup endpoint in GazellePW GazellePosterWall commit 86c4bedf727691b5a97af42a4864869d18446449 allows remote authenticated users with users view ips privileges to execute arbitrary SQL commands via the ip parameter in a crafted request to...

PT-2026-81395

Name of the Vulnerable Software and Affected Versions Kaltura HTML5 player mwEmbed / html5lib versions 2.x and earlier Description A local file disclosure issue exists due to improper validation of the ServiceUrl parameter in the 'mwEmbedLoader.php' endpoint. This parameter, intended as the base...

PT-2026-81868

A Stored XSS vulnerability in the torrent remaster custom title feature in GazellePW GazellePosterWall commit 86c4bedf727691b5a97af42a4864869d18446449 allows remote authenticated users to inject arbitrary JavaScript via the remaster custom title parameter, which is stored during torrent upload or...

PT-2026-81127

Adminer versions 5.3.0 through 5.4.2 with the sql-log plugin enabled contain an arbitrary file write vulnerability in the ns parameter of plugins/sql-log.php. An authenticated user can supply path traversal sequences in the ns parameter to write arbitrary .sql files with attacker-controlled conte...

Remote Code Execution and Arbitrary File Read Vulnerabilities in Kaltura Servers

Overview The Kaltura HTML5 Player V2 Library mwEmbed / html5lib contains two vulnerabilities, both involving the same insecure deserialization flaw, that enable arbitrary file read and remote code execution. Affected versions include html5lib v2.45, v2.103 and earlier, and other v2.x releases tha...

PT-2026-81128

Adminer before 5.4.3 contains an arbitrary file deletion vulnerability in SQLite mode where the database-list drop action fails to validate file extensions before deletion. An authenticated attacker can submit arbitrary relative file paths in the db parameter to delete any files writable by the P...

PT-2026-81158

Name of the Vulnerable Software and Affected Versions NLTK versions prior to 3.10.0 Description An unsafe pickle deserialization issue exists in the TransitionParser.parse function. The function utilizes pickle load with the restricted parameter set to False, which directs deserialization through...

Linux Distros Unpatched Vulnerability : CVE-2026-65053

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Horde IMP's AppleDouble MIME viewer writes an attacker-controlled attachment name into an HTML status block without escaping it. In...

PT-2026-81154

Name of the Vulnerable Software and Affected Versions GitPython versions prior to 3.1.59 Description An arbitrary file read issue exists in the TagReference.create function. A positional reference parameter allows the bypass of the unsafe option guard, enabling attackers to provide a reference...

PT-2026-81251

The Readabler plugin for WordPress is vulnerable to SQL Injection in all versions up to 2.0.18 exclusive due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append...

CVE-2026-63076

Issue summary: OpenSSL CMP password based protection verification only checks whether the protectionAlg parameter was not NULL and not its ASN.1 type, before treating it as a PBMParameter. A crafted message can contain a parameter of a different type, which is then dereferenced as an invalid...

OpenSSL 3.0.0 < 3.0.22 Multiple Vulnerabilities

The version of OpenSSL installed on the remote host is prior to 3.0.22. It is, therefore, affected by multiple vulnerabilities as referenced in the 3.0.22 advisory. - Issue summary: OpenSSL CMP password based protection verification only checks whether the protectionAlg parameter was not NULL and...

OpenSSL 3.4.0 < 3.4.7 Multiple Vulnerabilities

The version of OpenSSL installed on the remote host is prior to 3.4.7. It is, therefore, affected by multiple vulnerabilities as referenced in the 3.4.7 advisory. - Issue summary: OpenSSL CMP password based protection verification only checks whether the protectionAlg parameter was not NULL and n...

CVE-2026-38468

A SQL injection vulnerability exists in the country-code lookup endpoint (tools.php?action=get_cc ) of GazellePW (GazellePosterWall), as of commit 86c4bed. Remote authenticated users holding the users_view_ips privilege can execute arbitrary SQL commands by crafting a malicious value in the ip pa...

CVE-2026-38472

A Stored XSS vulnerability in forum reward comments in GazellePW GazellePosterWall commit 86c4bedf727691b5a97af42a4864869d18446449 allows remote attackers to inject arbitrary JavaScript via the c parameter in /forums.php?action=ajaxgetjf which is later rendered in the data-tooltip attribute in...

PT-2026-81871

A Stored XSS vulnerability in forum reward comments in GazellePW GazellePosterWall commit 86c4bedf727691b5a97af42a4864869d18446449 allows remote attackers to inject arbitrary JavaScript via the c parameter in /forums.php?action=ajax get jf which is later rendered in the data-tooltip attribute in...

CVE-2026-38467

A SQL injection vulnerability in the tags manager in GazellePW GazellePosterWall commit 86c4bedf727691b5a97af42a4864869d18446449 allows remote authenticated users with usersmod privileges to execute arbitrary SQL commands via the tagid or type parameter in a crafted POST request to...

CVE-2026-38469

A Stored XSS vulnerability in the custom bonus title feature in GazellePW GazellePosterWall commit 86c4bedf727691b5a97af42a4864869d18446449 allows remote authenticated users to inject arbitrary JavaScript via the title parameter in /bonus.php and /user.php?action=stafftool...

PT-2026-81426

Webkul QloApps does not validate request parameters before a database query. A remote, authenticated attacker with administrative privileges could send a crafted SQL query to the 'bo query' parameter in the 'Address.php' file. Fixed in 123c97c...

CVE-2026-38469

A Stored XSS vulnerability in the custom bonus title feature in GazellePW GazellePosterWall commit 86c4bedf727691b5a97af42a4864869d18446449 allows remote authenticated users to inject arbitrary JavaScript via the title parameter in /bonus.php and /user.php?action=stafftool...