PT-2026-1879

Name of the Vulnerable Software and Affected Versions QloApps versions 1.7.0 and earlier Description An unrestricted file upload issue exists in the hotel review feature. This allows remote, unauthenticated attackers to execute code on the system. The issue involves the ability to upload arbitrar...

PT-2026-1892

Name of the Vulnerable Software and Affected Versions Arraytics Timetics versions n/a through 1.0.46 Description The software contains an authentication bypass issue allowing authentication abuse through an alternate path or channel. Recommendations Update Arraytics Timetics to a version later th...

PT-2026-2192

Name of the Vulnerable Software and Affected Versions Bulk Landing Page Creator for WordPress LPagery versions through 2.4.9 Description The software contains a missing authorization issue, allowing exploitation of incorrectly configured access control security levels. Recommendations Update to a...

PT-2026-1698

Name of the Vulnerable Software and Affected Versions e-plugins ListingHub versions through 1.2.6 Description The software contains a flaw due to improper neutralization of input during web page generation, leading to a Reflected Cross-site Scripting XSS condition. This allows an attacker to inje...

PT-2026-1696

Name of the Vulnerable Software and Affected Versions magentech Rozy - Flower Shop versions through 1.2.25 Description The software contains a flaw related to improper control of filename for include/require statements, specifically a PHP Local File Inclusion issue. This allows for the inclusion ...

PT-2026-1741

Name of the Vulnerable Software and Affected Versions THEMELOGI Navian versions through 1.5.4 Description A flaw exists in THEMELOGI Navian that allows for PHP Local File Inclusion due to improper control of filename for include/require statements. This issue is related to a PHP Remote File...

Google Chrome Security Update (stable-channel-update-for-desktop-2026-01) - Linux

Google Chrome is prone to an insufficient policy enforcement vulnerability. SPDX-FileCopyrightText: 2026 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Ubuntu: Security Advisory (USN-7943-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2026 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

openSUSE Security Advisory (SUSE-SU-2026:0036-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2026 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian: Security Advisory (DLA-4435-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2026 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian: Security Advisory (DSA-6095-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2026 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

PT-2026-1928

Name of the Vulnerable Software and Affected Versions hands01 e-shops e-shops-cart2 versions through 1.0.4 Description The software contains an Improper Neutralization of Input During Web Page Generation issue, leading to a DOM-Based Cross-Site Scripting XSS condition. The issue allows for the...

PT-2026-2141

Name of the Vulnerable Software and Affected Versions Greenshot versions 1.3.310 and below Description Greenshot is a Windows screenshot utility. Versions 1.3.310 and below are susceptible to an OS Command Injection issue due to inadequate sanitization of filenames. The FormatArguments method...

Huawei EulerOS: Security Advisory for glibc (EulerOS-SA-2026-1007)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2026 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Ubuntu: Security Advisory (USN-7945-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2026 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

WordPress Block Slider plugin <= 2.2.3 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by theviper17 in WordPress Plugin Block Slider versions = 2.2.3...

Preact has JSON VNode Injection issue

Impact Vulnerability Type: HTML Injection via JSON Type Confusion Affected Versions: Preact 10.26.5 through 10.28.1 Severity: Low to Medium see below Who is Impacted? Applications using affected Preact versions are vulnerable if they meet all of the following conditions: 1. Pass unmodified,...

n8n Vulnerable to Unauthenticated File Access via Improper Webhook Request Handling

Impact A vulnerability in n8n allows an attacker to access files on the underlying server through execution of certain form-based workflows. A vulnerable workflow could grant access to an unauthenticated remote attacker. This could result in exposure of sensitive information stored on the system...

CVE-2026-22535

CVE-2026-22535 concerns an attacker with network access and valid credentials who can write to the server topics that control MQTT communications due to unencrypted MQTT protocol. The issue is described across multiple feeds (Red Hat, NVD, CIRCL, CVE lists, EUVD/ENISA, CNNVD, etc.) as a vulnerabi...

CVE-2025-15058

The Responsive Pricing Table plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tablecurrency' parameter in all versions up to, and including, 5.1.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...