PT-2026-34990

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A reference count error exists in the rxrpc component. The function rxrpc input packet on conn may process a to-client packet after the current client call on the channel has been torn...

PT-2026-31274

Name of the Vulnerable Software and Affected Versions tagDiv Composer versions through 5.4.3 Description An Improper Neutralization of Script-Related HTML Tags in a Web Page Basic XSS issue exists in tagDiv Composer td-composer, allowing Code Injection. This allows for potential code execution...

PT-2026-31456

Name of the Vulnerable Software and Affected Versions PraisonAI versions prior to 4.5.115 Description PraisonAI's Agent-to-User A2U event stream server, prior to version 4.5.115, lacks authentication, exposing all agent activity. The create a2u routes function registers several API endpoints...

CVE-2026-5169: Improper Neutralization of Input During Web Page Generation

The Inquiry Form to Posts or Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Form Header' field in versions up to and including 1.0. This is due to insufficient input sanitization when saving via updateoption and lack of output escaping when displaying the stored...

PT-2026-31200

Name of the Vulnerable Software and Affected Versions ThemeGoods Grand Magazine versions through 3.5.5 Description The software contains a Cross-Site Request Forgery CSRF flaw. This allows attackers to perform actions on behalf of authenticated users. Recommendations Update to a version later tha...

CoolerControl Access Control Vulnerability

CoolerControl is an open-source control software for cooling devices developed by CoolerControl. Versions of CoolerControl prior to 4.0.0 contained a access control vulnerability. This vulnerability stemmed from unvalidated functions, which could allow unauthenticated attackers to view and modify...

PT-2026-31257

Name of the Vulnerable Software and Affected Versions Podigee versions through 1.4.0 Description A Server-Side Request Forgery SSRF vulnerability exists in Podigee. This allows for Server Side Request Forgery. Recommendations Update Podigee to a version later than 1.4.0...

Linux Distros Unpatched Vulnerability : CVE-2026-39865

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Axios is a promise based HTTP client for the browser and Node.js. Starting in version 1.13.0 and prior to 1.13.2, Axios HTTP/2 session cleanup logic contains a...

PT-2026-31209

Server-Side Request Forgery SSRF vulnerability in Global Payments GlobalPayments WooCommerce global-payments-woocommerce allows Server Side Request Forgery.This issue affects GlobalPayments WooCommerce: from n/a through = 1.18.0...

PT-2026-31276

Name of the Vulnerable Software and Affected Versions G5Theme G5Plus April versions through 6.8 Description A missing authorization issue exists in G5Theme G5Plus April, allowing exploitation of incorrectly configured access control security levels. Recommendations Update G5Plus April to a versio...

PT-2026-31245

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Chief Gnome Garden Gnome Package garden-gnome-package allows DOM-Based XSS.This issue affects Garden Gnome Package: from n/a through = 2.4.1...

PT-2026-31233

Cross-Site Request Forgery CSRF vulnerability in Dotstore Extra Fees Plugin for WooCommerce woo-conditional-product-fees-for-checkout allows Cross Site Request Forgery.This issue affects Extra Fees Plugin for WooCommerce: from n/a through = 4.3.3...

PT-2026-31231

CVE-2026-39669 Missing Authorization vulnerability in NitroPack NitroPack nitropack allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects NitroP… https://t.co/FlBAHgMTTZ...

PT-2026-31228

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in telepathy Hello Bar Popup Builder hellobar allows DOM-Based XSS.This issue affects Hello Bar Popup Builder: from n/a through = 1.5.1...

PT-2026-31171

CVE-2026-39606 Missing Authorization vulnerability in Foysal Imran BizReview bizreview allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Biz… https://t.co/TGgxdmzsNS...

LORIS Neuroimaging Platform security vulnerabilities

LORIS Neuroimaging Platform is a neuroimaging platform open source developed by ACElab. Versions of LORIS Neuroimaging Platform from 21.0.0 to 27.0.3, as well as versions before 28.0.1, have security vulnerabilities. These vulnerabilities stem from the backend endpoints not properly verifying...

PT-2026-31120

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Brainstorm Force OttoKit suretriggers allows Blind SQL Injection.This issue affects OttoKit: from n/a through = 1.1.20...

PT-2026-31216

Missing Authorization vulnerability in igms iGMS Direct Booking igms-direct-booking allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects iGMS Direct Booking: from n/a through = 1.3...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-006787)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-006787 advisory. In the Linux kernel, the following vulnerability has been resolved: drm/i915/gt: Reset queuepriorityhint on parking Originally, with strict in order execution, we...

WordPress Wavr plugin <= 0.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via Shortcode Attributes vulnerability discovered by zakaria in WordPress Plugin Wavr versions = 0.2.6...