PT-2026-4239

Improper Neutralization of Script-Related HTML Tags in a Web Page Basic XSS vulnerability in mwtemplates DeepDigital deepdigital allows Code Injection.This issue affects DeepDigital: from n/a through = 1.0.2...

PT-2026-4229

Missing Authorization vulnerability in Proptech Plugin Apimo Connector apimo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Apimo Connector: from n/a through = 2.6.4...

PT-2026-3976

Name of the Vulnerable Software and Affected Versions cozythemes HomeLancer versions through 1.0.1 Description An authorization issue exists in cozythemes HomeLancer, allowing exploitation of incorrectly configured access control security levels. Recommendations Update to a version later than 1.0...

PT-2026-4014

Name of the Vulnerable Software and Affected Versions Myour versions through 1.5.1 Description The software contains an Improper Control of Filename for Include/Require Statement issue, also known as a PHP Remote File Inclusion. This allows for PHP Local File Inclusion. Recommendations Update Myo...

PT-2026-4188

Missing Authorization vulnerability in Leap13 Premium Addons for Elementor premium-addons-for-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Premium Addons for Elementor: from n/a through = 4.11.63...

WordPress plugin DZS Video Gallery has a SQL injection vulnerability

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application extension. The...

PT-2026-4189

Missing Authorization vulnerability in Broadstreet Broadstreet Ads broadstreet allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Broadstreet Ads: from n/a through = 1.52.1...

PT-2026-4077

Name of the Vulnerable Software and Affected Versions Icegram versions through 3.1.35 Description The software contains a missing authorization issue related to incorrectly configured access control security levels. This allows for exploitation of the system. Recommendations Update Icegram to a...

PT-2026-4013

Name of the Vulnerable Software and Affected Versions TheNa versions through 1.5.5 Description The software contains a flaw due to improper handling of user-supplied data when creating web pages, leading to a Reflected Cross-site Scripting XSS condition. This allows an attacker to inject maliciou...

PT-2026-4133

Name of the Vulnerable Software and Affected Versions FooEvents for WooCommerce versions through 1.20.4 Description A flaw exists in FooEvents for WooCommerce that allows for SQL Injection. The issue is due to improper neutralization of special elements within SQL commands. This could potentially...

PT-2026-4099

Name of the Vulnerable Software and Affected Versions WDV One Page Docs versions through 1.2.4 Description An authorization issue exists in vrpr WDV One Page Docs, specifically related to incorrectly configured access control security levels. This allows for unauthorized access. Recommendations...

Azure Linux 3.0 Security Update: kernel (CVE-2024-42238)

The version of kernel installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-42238 advisory. - In the Linux kernel, the following vulnerability has been resolved: firmware: csdsp: Return error if block...

CVE-2026-22801

A flaw was found in libpng, a reference library for PNG Portable Network Graphics raster image files. An integer truncation vulnerability exists in the pngwriteimage16bit and pngwriteimage8bit simplified write API functions. A local attacker could exploit this flaw by providing a negative row...

WordPress WPO365 plugin <= 40.0 - Server Side Request Forgery (SSRF) vulnerability

Server Side Request Forgery SSRF vulnerability discovered by Phat RiO - BlueRock in WordPress Plugin WPO365 versions = 40.0...

WordPress User Registration plugin <= 4.4.6 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Mdr in WordPress Plugin User Registration versions = 4.4.6...

WordPress Nelio Content plugin <= 4.2.0 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Doan Dinh Van in WordPress Plugin Nelio Content versions = 4.2.0...

WordPress Dinatur plugin <= 1.18 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Jarno Vos jrn5151 in WordPress Plugin Dinatur versions = 1.18...

CVE-2026-1202

A security flaw has been discovered in CRMEB up to 5.6.3. The affected element is the function appleLogin of the file crmeb/app/api/controller/v1/LoginController.php. Performing a manipulation of the argument openId results in improper authentication. The attack is possible to be carried out...

WordPress Tutor LMS - eLearning and online course solution plugin <= 3.9.4 - Missing Authorization to Authenticated (Subscriber+) Limited Attachment Deletion vulnerability

WordPress Tutor LMS - eLearning and online course solution plugin = 3.9.4 - Missing Authorization to Authenticated Subscriber+ Limited Attachment Deletion vulnerability discovered by type5afe in WordPress Plugin Tutor LMS versions = 3.9.4...

CVE-2026-1175

A vulnerability was identified in birkir prime up to 0.4.0.beta.0. This impacts an unknown function of the file /graphql of the component GraphQL Directive Handler. Such manipulation leads to information exposure through error message. The attack may be performed from remote. The exploit is...