EUVD-2026-47932

If the auth responds very slowly and the records expire in between, the capping of TTLs is not enforced for lack of data. This does not happen on regular resolve as then then the child records are used immediately if not expired and thus valid, or the records are expired, and in that case not use...

CVE-2026-52684

If the auth responds very slowly and the records expire in between, the capping of TTLs is not enforced for lack of data. This does not happen on regular resolve as then then the child records are used immediately if not expired and thus valid, or the records are expired, and in that case not use...

CVE-2026-16287 Root Command Injection via Offline Update in TÜBİTAK BİLGEM's pardus-update

Improper neutralization of special elements used in an OS command 'OS command injection' vulnerability in TUBITAK BILGEM Software Technologies Research Institute pardus-update allows OS Command Injection. This issue affects pardus-update: from 0.6.6 before 0.7.0...

CVE-2026-16653 boazsegev facil.io Public Folder http.c http_sendfile2 path traversal

A security flaw has been discovered in boazsegev facil.io up to 0.7.58. This affects the function httpsendfile2 of the file lib/facil/http/http.c of the component Public Folder Handler. Performing a manipulation results in path traversal. Remote exploitation of the attack is possible. The exploit...

PT-2026-63847

Subscriber Broken Access Control in WP ERP = 1.17.5 versions...

PT-2026-63828

Unauthenticated Cross Site Scripting XSS in Sprout Clients = 3.2.3 versions...

PT-2026-63939

Contributor Cross Site Scripting XSS in BSK PDF Manager = 3.8 versions...

PT-2026-63816

Contributor Cross Site Scripting XSS in Hubbub Lite = 1.36.3 versions...

PT-2026-63840

Unauthenticated Cross Site Request Forgery CSRF in ApusListing = 1.2.63 versions...

PT-2026-63827

Unauthenticated Cross Site Scripting XSS in Download Monitor - WPForms Lock = 1.0.4 versions...

PT-2026-63825

Unauthenticated Cross Site Scripting XSS in Coaching = 3.9.2 versions...

PT-2026-63944

Contributor Cross Site Scripting XSS in Smart SEO Tool = 4.1.2 versions...

PT-2026-63945

Author Cross Site Scripting XSS in Custom links in Elementor Image Carousel = 1.1.1 versions...

PT-2026-63855

Unauthenticated PHP Object Injection in Thrive Quiz Builder = 10.9.3.0 versions...

PT-2026-63830

Subscriber Cross Site Scripting XSS in Slider Pro = 4.8.13 versions...

PT-2026-63868

Unauthenticated Broken Access Control in PayU India = 3.8.9 versions...

PT-2026-63858

Unauthenticated Broken Authentication in Ziina = 1.2.21 versions...

CVE-2026-65537: Missing Authorization

Subscriber Broken Access Control in Cyr to Lat reloaded – transliteration of links and file names = 1.3.3 versions...

CVE-2026-59542: Improper Limitation of a Pathname to a Restricted Directory

Subscriber Arbitrary File Deletion in Kali Forms = 2.4.18 versions...

PT-2026-63586

If the auth responds very slowly and the records expire in between, the capping of TTLs is not enforced for lack of data. This does not happen on regular resolve as then then the child records are used immediately if not expired and thus valid, or the records are expired, and in that case not use...