PT-2026-64038

Vanna through 2.0.2 contains a path traversal vulnerability in the FileSystemConversationStore persistence integration that allows unauthenticated remote attackers to write attacker-controlled JSON files to arbitrary filesystem locations and read conversation metadata from outside the intended...

PT-2026-63923

Contributor Cross Site Scripting XSS in Ultimate Store Kit Elementor Addons = 3.0.5 versions...

PT-2026-64031

Joomla Extension - joomshaper.com - cross-customer order and personal information disclosure in Easy Store extension 1.0.0-2.0.1 - Improper access checks allow logged in users to retreive order and customer information of any order in the system...

CVE-2026-65761: Improper Neutralization of Special Elements used in an SQL Command

Joomla Extension - joomshaper.com - Unauthenticated SQL injection in Easy Store extension 1.0.0-2.0.1 - Improper validation of order parameters lead to an unauthenticated SQL injection in easystore, allowing full DB read access including credentials and sessions...

CVE-2026-65760: Improper Access Control

Joomla Extension - joomshaper.com - cross-customer order and personal information disclosure in Easy Store extension 1.0.0-2.0.1 - Improper access checks allow logged in users to retreive order and customer information of any order in the system...

CVE-2026-65503: Improper Neutralization of Input During Web Page Generation

Contributor Cross Site Scripting XSS in Ultimate Store Kit Elementor Addons = 3.0.5 versions...

PT-2026-63876

Unauthenticated Broken Access Control in Ebook Store = 6.19 versions...

PT-2026-63875

Unauthenticated Broken Access Control in Ebook Store = 6.19 versions...

PT-2026-64032

Name of the Vulnerable Software and Affected Versions Easy Store versions 1.0.0 through 2.0.1 Description Improper validation of order parameters allows an unauthenticated SQL injection, which is a technique used to manipulate database queries. This issue enables full read access to the database,...

CVE-2026-65452: Missing Authorization

Unauthenticated Broken Access Control in Ebook Store = 6.19 versions...

PT-2026-64030

Joomla Extension - joomshaper.com - unauthenticated payment/order forgery in Easy Store extension 1.0.0-2.0.1 - Critical order and payment information, including states, are processed from client side input, enabling unauthenticated attackers to manipulate payment and order states of arbritrary...

CVE-2026-65759: Improper Access Control

Joomla Extension - joomshaper.com - unauthenticated payment/order forgery in Easy Store extension 1.0.0-2.0.1 - Critical order and payment information, including states, are processed from client side input, enabling unauthenticated attackers to manipulate payment and order states of arbritrary...

CVE-2026-65505: Exposure of Sensitive System Information to an Unauthorized Control Sphere

Unauthenticated Sensitive Data Exposure in Ultimate Store Kit Elementor Addons = 3.0.5 versions...

CVE-2026-65453: Missing Authorization

Unauthenticated Broken Access Control in Ebook Store = 6.19 versions...

WordPress Ultimate Store Kit Elementor Addons plugin <= 3.0.5 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Bao - BlueRock in WordPress Plugin Ultimate Store Kit Elementor Addons versions = 3.0.5...

WordPress Ultimate Store Kit Elementor Addons plugin <= 3.0.5 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Nguyen Ba Khanh in WordPress Plugin Ultimate Store Kit Elementor Addons versions = 3.0.5...

CVE-2026-13067 tlsCATrusts Role Restriction Not Enforced via PROXY Protocol v2 on Unix Domain Socket

When PROXY protocol v2 is used on the Unix domain socket path, roles derived from X.509 client certificates may not be validated against the configured tlsCATrusts allow-list. This can result in unintended role assignments following MONGODB-X509 authentication. Affected scenarios require local...

WordPress Ebook Store plugin <= 6.19 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Nabil Irawan in WordPress Plugin Ebook Store versions = 6.19...

WordPress Ebook Store plugin <= 6.19 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by benzdeus in WordPress Plugin Ebook Store versions = 6.19...

The vulnerability of the function nvme_ctrl_dhchap_ctrl_secret_store() in the driver/nvme/host/core.c file of the Linux operating system’s NVME kernel driver, which allows a hacker to cause a service failure.

The vulnerability of the nvmectrldhchapctrlsecretstore function in the drivers/nvme/host/core.c file of the Linux NVME driver is related to improper memory release memory leak. Exploiting this vulnerability could allow an attacker to cause a system failure...