CVE-2026-12905

The Bookly plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 27.7 via the appointment method of the Mobile Staff Cabinet API resource=appointment, action=booklymobilestaffcabinet in...

SQL Injection

Overview civicrm/civicrm-core is an open source constituent relationship management for non-profits, NGOs and advocacy organizations. Affected versions of this package are vulnerable to SQL Injection via the contact search RLIKE clause. An attacker can access and extract the entire database by...

Server-side Request Forgery (SSRF)

Overview ghost is a publishing platform Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the ImageSize.fetchImageSizeFromUrl path in core/server/lib/image/image-size.js. An attacker can make Ghost send blind HTTP GET requests to internal hosts by supplying ...

PT-2026-67874

Name of the Vulnerable Software and Affected Versions Ghost versions prior to 6.54.1 Description Staff-level users can leak the hashed passwords of other staff members through the Ghost Admin API. This could allow an attacker to perform an offline password-guessing attack to potentially take over...

CVE-2026-15761 Tickera <= 3.6.0.1 - Authenticated (Staff+) SQL Injection via 'tc_event_filter' Parameter

The Tickera – Sell Tickets & Manage Events plugin for WordPress is vulnerable to generic SQL Injection via the 'tceventfilter' parameter in all versions up to, and including, 3.6.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...

PT-2026-63790

The Tickera – Sell Tickets & Manage Events plugin for WordPress is vulnerable to generic SQL Injection via the 'tc order status filter' parameter in all versions up to, and including, 3.6.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the...