PT-2026-104543

Name of the Vulnerable Software and Affected Versions WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System versions prior to 3.0.19 Description The plugin is susceptible to Local File Inclusion, a flaw that allows an attacker to include files from the local server. Authenticated...

CVE-2026-75028: Improper Control of Filename for Include/Require Statement in PHP Program

The WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.0.18 via the template scope function. This makes it possible for authenticated attackers, with contributor-level access and...

CVE-2026-82041

UTMStack before 11.2.16 contains a missing authorization vulnerability in UTMIncidentCommandWebsocket.processCommand, the handler mapped to the /command/hostname STOMP destination, where no role check or command allowlist is applied before forwarding supplied commands. Any authenticated user,...

CVE-2026-75937

A specially crafted HTTP POST request to the web administration interface allows an unauthenticated attacker to execute arbitrary operating system commands with root privileges on the affected device. Disable the web server when not configuring the device...

CVE-2026-75937

A critical OS Command Injection vulnerability (CVE-2026-75937) affects Digi Accelerated Linux (DAL OS) . A specially crafted HTTP POST request sent to the web administration interface allows an unauthenticated attacker to execute arbitrary operating system commands with root privileges on the aff...

CVE-2026-82041 UTMStack < 11.2.16 Missing Authorization via Command WebSocket

UTMStack before 11.2.16 contains a missing authorization vulnerability in UTMIncidentCommandWebsocket.processCommand, the handler mapped to the /command/hostname STOMP destination, where no role check or command allowlist is applied before forwarding supplied commands. Any authenticated user,...

CVE-2026-82041 UTMStack < 11.2.16 Missing Authorization via Command WebSocket

UTMStack before 11.2.16 contains a missing authorization vulnerability in UTMIncidentCommandWebsocket.processCommand, the handler mapped to the /command/hostname STOMP destination, where no role check or command allowlist is applied before forwarding supplied commands. Any authenticated user,...

Security Bulletin: Multiple Vulnerabilities in IBM Cloud Pak System

Summary Multiple vulnerabilities were addressed in IBM Cloud Pak System version 2.3.6.2. Vulnerability Details CVEID:CVE-2020-5258 DESCRIPTION: In affected versions of dojo NPM package, the deepCopy method is vulnerable to Prototype Pollution. Prototype Pollution refers to the ability to inject...

Security Bulletin: Due to Logstash, IBM Cloud Pak System is affected by Improper Limitation of a Pathname to a Restricted Directory [CVE-2026-33466]

Summary Vulnerability was found in Logstash shipped with IBM Cloud Pak System. Vulnerability was addressed in IBM Cloud Pak System version 2.3.6.2. Vulnerability Details CVEID:CVE-2026-33466 DESCRIPTION: Improper Limitation of a Pathname to a Restricted Directory CWE-22 in Logstash can lead to...

Security Bulletin: Due to IBM Tivoli Monitoring, IBM Cloud Pak System is affected by multiple vulnerabilities.

Summary Multiple vulnerabilities were found in IBM Tivoli Monitoring shipped with IBM Cloud Pak System. Multiple vulnerabilities were addressed in IBM Cloud Pak System version 2.3.6.2. Vulnerability Details CVEID:CVE-2026-29167 DESCRIPTION: Use After Free vulnerability in Apache HTTP Server with...

WordPress Helpdesk Support Ticket System for WooCommerce plugin <= 2.1.6 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Ticket Response Deletion vulnerability

Insecure Direct Object Reference to Authenticated Subscriber+ Arbitrary Ticket Response Deletion vulnerability discovered by Saruul in WordPress Plugin Helpdesk Support Ticket System for WooCommerce versions = 2.1.6...

CVE-2026-104625

A security flaw has been discovered in CodeAstro Simple Loan Management System 1.0. Impacted is an unknown function of the file /admin/index.php. Performing a manipulation of the argument gname results in sql injection. The attack may be initiated remotely. The exploit has been released to the...

CVE-2026-92955

A flaw was found in vm2. This vulnerability allows an attacker running untrusted code within the sandbox to achieve arbitrary code execution on the host system. By accessing internal host properties through standard output streams, the untrusted code can manipulate process event handlers and esca...

CVE-2026-104625 CodeAstro Simple Loan Management System index.php sql injection

A security flaw has been discovered in CodeAstro Simple Loan Management System 1.0. Impacted is an unknown function of the file /admin/index.php. Performing a manipulation of the argument gname results in sql injection. The attack may be initiated remotely. The exploit has been released to the...

EUVD-2026-91650

A security flaw has been discovered in CodeAstro Simple Loan Management System 1.0. Impacted is an unknown function of the file /admin/index.php. Performing a manipulation of the argument gname results in sql injection. The attack may be initiated remotely. The exploit has been released to the...

CVE-2026-104625

A security flaw exists in CodeAstro Simple Loan Management System 1.0 within an unknown function of the /admin/index.php file. An attacker can perform a remote SQL injection by manipulating the g_name argument. Public exploits are available and may be used to conduct attacks. No specific remediat...

CVE-2026-104625 CodeAstro Simple Loan Management System index.php sql injection

A security flaw has been discovered in CodeAstro Simple Loan Management System 1.0. Impacted is an unknown function of the file /admin/index.php. Performing a manipulation of the argument gname results in sql injection. The attack may be initiated remotely. The exploit has been released to the...

CVE-2026-104613

A vulnerability was determined in CodeAstro Simple Pharmacy Management System 1.0. This vulnerability affects unknown code of the file /SimplePharmacy-PHP/product/view.php. This manipulation of the argument ID causes sql injection. The attack can be initiated remotely. The exploit has been public...

CVE-2026-104614

A vulnerability was identified in CodeAstro Simple Pharmacy Management System 1.0. This issue affects some unknown processing of the file /SimplePharmacy-PHP/product/delete.php. Such manipulation of the argument ID leads to sql injection. The attack can be launched remotely. The exploit is public...

CVE-2026-104614 CodeAstro Simple Pharmacy Management System delete.php sql injection

A vulnerability was identified in CodeAstro Simple Pharmacy Management System 1.0. This issue affects some unknown processing of the file /SimplePharmacy-PHP/product/delete.php. Such manipulation of the argument ID leads to sql injection. The attack can be launched remotely. The exploit is public...