PT-2026-109667

Name of the Vulnerable Software and Affected Versions OpenRefine versions prior to 3.10.2 Description A cross-site request forgery CSRF flaw exists in the get-rows command. This issue allows remote attackers to lure a user to a malicious page that issues a cross-origin GET request with a crafted...

PT-2026-109884

Name of the Vulnerable Software and Affected Versions JeecgBoot versions prior to 3.9.6 Description An authorization flaw exists in the deleteBatch handler of the SysLogController. This issue allows any authenticated user, including those with low privileges, to delete system audit log entries. B...

PT-2026-109555

ZTE Z80 Ultra contains an information disclosure vulnerability, through which third-party applications can read relevant information by hooking system APIs...

PT-2026-109553

The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to time-based SQL Injection via the 'current month' parameter in all versions up to, and including, 2.1.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQ...

PT-2026-109614

ZTE Z80 Ultra has a local information disclosure vulnerability. Third-party applications can capture data returned by system interfaces to obtain device-related information...

PT-2026-109638

ZTE Z80 Ultra's system interfaces do not have robust invocation authentication, with inadequate access control. Third-party apps may call the interfaces through reflection and retrieve relevant information...

PT-2026-109470

ExifTool for photo and video 5.0.1-gms by CellHubs constructs shell command strings from file paths and invokes /system/bin/sh -c. In the CSV-export path, the selected media path is merely surrounded with single quotes; embedded single quotes are not escaped...

PT-2026-109476

ZTE Z80 Ultra has a system interface permission verification defect. The interface lacks necessary access control, and relevant information can be read by reflectively invoking the interface...

CVE-2026-105889: Improper Neutralization of Special Elements used in an SQL Command

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Tickera Tickera tickera-event-ticketing-system allows Blind SQL Injection.This issue affects Tickera: from n/a through 3.6.0.6...

CVE-2026-108553: Cross-Site Request Forgery (CSRF)

OpenRefine through 3.10.1 contains a cross-site request forgery vulnerability in the get-rows command that allows remote attackers to execute Jython facet expressions. Attackers can lure a user to a malicious page issuing a cross-origin GET with a crafted engine parameter, executing operating...

CVE-2026-108506: Improper Privilege Management

ZTE Z80 Ultra's system interfaces do not have robust invocation authentication, with inadequate access control. Third-party apps may call the interfaces through reflection and retrieve relevant information...

CVE-2026-108505: Improper Privilege Management

ZTE Z80 Ultra has a local information disclosure vulnerability. Third-party applications can capture data returned by system interfaces to obtain device-related information...

CVE-2026-108502: Improper Privilege Management

ZTE Z80 Ultra contains an information disclosure vulnerability, through which third-party applications can read relevant information by hooking system APIs...

CVE-2026-107712: Improper Neutralization of Special Elements used in an SQL Command

The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to time-based SQL Injection via the 'currentmonth' parameter in all versions up to, and including, 2.1.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...

CVE-2026-108501: Improper Privilege Management

ZTE Z80 Ultra has a system interface permission verification defect. The interface lacks necessary access control, and relevant information can be read by reflectively invoking the interface...

CVE-2026-103365: Exposure of Sensitive Information to an Unauthorized Actor

The Bookly – Online Scheduling and Appointment Booking System plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 28.4 via the classic booking form's Details step. The endpoint booklyrenderdetails is registered for both wpajax and wpajaxnopriv, t...

Debian dsa-6551 : tor - security update

The remote Debian 13 host has packages installed that are affected by a vulnerability as referenced in the dsa-6551 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6551-1 [email protected] https://www.debian.org/security/ Moritz...

CVE-2026-108264

Wizarr is an advanced user invitation and management system for Jellyfin, Plex, Emby, and other media servers. Prior to 2026.9.1, wizard step Markdown supplied through the editor or imported bundles was evaluated by app/blueprints/wizard/routes.py in the application's non-sandboxed Jinja2...

EUVD-2026-95983

Jexactyl is a customisable game management panel and billing system. From 4.0.0 until 4.0.5, the POST /api/client/billing/free/process endpoint accepts a client-controlled serverid and loads the server without restricting the lookup to servers owned by the authenticated account. On installations...

Security Bulletin: Due to use of Apache Http Server, IBM Cloud Pak System is affected by HTTP Response splitting [CVE-2024-24795]

Summary HTTP Response splitting vulnerability has been identified in Apache HTTP Server. This vulnerability was addressed by IBM Cloud Pak System 2.3.6.2 Vulnerability Details CVEID:CVE-2024-24795 DESCRIPTION: HTTP Response splitting in multiple modules in Apache HTTP Server allows an attacker th...