CVE-2026-52782: Authorization Bypass Through User-Controlled Key

OpenProject is open-source, web-based project management software. Prior to 17.3.3 and 17.4.1, there is an IDOR through /projects/ /settings/projectstorages/ via PATCH parameter "storagesprojectstorageprojectfolderid" leads to Access to Unauthorized Resources. A project-admin in one project can...

PT-2026-52715

Name of the Vulnerable Software and Affected Versions Eagle Booking versions prior to 1.3.4.4 Description An unauthenticated Cross Site Request Forgery CSRF issue exists, which allows an attacker to induce a user to perform actions they did not intend to execute. Recommendations Update Eagle...

PT-2026-52792

Contributor Broken Access Control in SEOPress PRO = 9.1.1 versions...

PT-2026-52732

Unauthenticated Backdoor in Enable CORS = 2.0.3 versions...

PT-2026-52661

Name of the Vulnerable Software and Affected Versions Rapid7 InsightConnect Markdown Plugin versions prior to 3.1.5 Description Server-Side Cross-Site Scripting XSS and Server-Side Request Forgery SSRF exist in the markdown to pdf action. These issues occur because the PDF rendering engine fails ...

CVE-2026-54352: Improper Limitation of a Pathname to a Restricted Directory

Budibase is an open-source low-code platform. Prior to 3.39.9, POST /api/pwa/process-zip at packages/server/src/api/routes/static.ts:24 accepts a builder-uploaded .zip, extracts it with [email protected] into a temp directory, then for each entry listed in icons.json validates the icon path, open...

CVE-2025-64152: Improper Limitation of a Pathname to a Restricted Directory

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Apache IoTDB. This issue affects Apache IoTDB: from 1.0.0 before 1.3.6, from 2.0.0 before 2.0.7. Users are recommended to upgrade to version 1.3.6 and 2.0.7, which fixes the issue...

PT-2026-52742

Subscriber Server Side Request Forgery SSRF in utm.codes = 1.9.0 versions...

PT-2026-52770

Unauthenticated Broken Access Control in MailChimp Block = 1.1.15 versions...

PT-2026-52663

The Printcart Web to Print Product Designer for WooCommerce WordPress plugin through 2.4.8 is vulnerable to path traversal which makes it possible for the attacker to retrieve the directory listing for arbitrary directories on the server...

WordPress Groundhogg — CRM, Newsletters, and Marketing Automation plugin <= 4.5.5 - Authenticated (Marketer+) SQL Injection vulnerability

Authenticated Marketer+ SQL Injection vulnerability discovered by ? in WordPress Plugin Groundhogg versions = 4.5.5...

PT-2026-52751

Unauthenticated Multiple Vulnerabilities in BitFire Security = 5.0.3 versions...

CVE-2025-10268: Undefined Security Weakness

The Printcart Web to Print Product Designer for WooCommerce WordPress plugin through 2.4.8 is vulnerable to path traversal which makes it possible for the attacker to retrieve the directory listing for arbitrary directories on the server...

PT-2026-52787

Name of the Vulnerable Software and Affected Versions H5P versions prior to 1.17.8 Description A flaw allows a user with contributor privileges to perform arbitrary file deletion on the system. Recommendations Update to a version newer than 1.17.7...

PT-2026-52746

Unauthenticated Privilege Escalation in Paytium = 5.0.2 versions...

PT-2026-52774

Unauthenticated SQL Injection in JetEngine = 3.8.10.2 versions...

PT-2026-52763

Subscriber PHP Object Injection in RealHomes = 4.5.3 versions...

PT-2026-52814

Contributor SQL Injection in Restaurant Menu by MotoPress = 2.4.10 versions...

PT-2026-52766

Subscriber Arbitrary File Upload in Travel Booking = 2.2.5 versions...

PT-2026-52832

Name of the Vulnerable Software and Affected Versions Contest Gallery versions prior to 30.0.1 Description A SQL Injection issue exists that allows attackers with contributor-level permissions to execute unauthorized database queries remotely. Recommendations Update to a version newer than 30.0.0...