PT-2026-90835

CAPEv2 through commit 471ee4b fails to validate task ownership in REST API endpoints, allowing authenticated users to read and delete analyses submitted by other users. Attackers can enumerate all tasks in the system and delete arbitrary analyses by sending requests to task view and delete...

PT-2026-90950

Name of the Vulnerable Software and Affected Versions cheshire-cat-ai versions prior to 1.9.3 Description An issue exists where the manipulation of the user id argument in the authorize http key function within the core/cat/factory/custom auth handler.py file leads to missing authentication. This...

CVE-2025-63842

A Cross-Site Scripting XSS vulnerability in the web backend for the Repetico app 1.9.7.31 for Android allows a remote authenticated user to execute arbitrary JavaScript code in the app's context via crafted input in the multiple-choice question text field...

PT-2026-90860

Name of the Vulnerable Software and Affected Versions jaychouchannel Tourism-Management-System versions up to 229956e20dbd4a80eeff14535e44d3099502af09 Description Improper privilege management exists in the User Register Endpoint within the file...

CVE-2025-63842

CVE-2025-63842 is a Cross-Site Scripting (XSS) vulnerability in the web backend of the Repetico app 1.9.7.31 for Android . A remote authenticated user can execute arbitrary JavaScript in the app's context by supplying crafted input in the multiple-choice question text field . The CVSS 3.1 score i...

PT-2026-90793

The User Registration & Membership WordPress plugin before 5.2.8 does not check the capability of the user making a membership purchase, and does not validate the payment method or the plan submitted with it, allowing any authenticated user such as a subscriber to be granted the WordPress role...

PT-2026-90792

The User Registration & Membership WordPress plugin before 5.2.8 does not validate the destination of a post-login redirect before redirecting, allowing unauthenticated attackers to redirect visitors to an arbitrary external URL, which can be abused for phishing...

PT-2026-90794

The User Registration & Membership WordPress plugin before 5.2.8 does not verify that the visitor requesting its membership confirmation page owns the account named in the request, nor that any registration or purchase has taken place, allowing unauthenticated users to retrieve another user's ema...

PT-2026-90791

The User Registration & Membership WordPress plugin before 5.2.8 does not properly restrict who may author a membership plan or validate the plan a user attaches to their own account, allowing authenticated users with Author-level access and above to assign themselves an arbitrary role and escala...

PT-2026-90989

A Cross-Site Scripting XSS vulnerability in the web backend for the Repetico app 1.9.7.31 for Android allows a remote authenticated user to execute arbitrary JavaScript code in the app's context via crafted input in the multiple-choice question text field...

CVE-2026-86406: Improper Privilege Management

The User Registration & Membership WordPress plugin before 5.2.8 does not check the capability of the user making a membership purchase, and does not validate the payment method or the plan submitted with it, allowing any authenticated user such as a subscriber to be granted the WordPress role...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: libpq (UTSA-2024-000296)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2024-000296 advisory. A flaw was found in PostgreSQL that allows authenticated database users to execute arbitrary code through missing overflow checks during SQL array value modification...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kexec-tools (UTSA-2026-032932)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-032932 advisory. A flaw was found in the permissions of a log file created by kexec-tools. This flaw allows a local unprivileged user to read this file and leak kernel internal...

CVE-2026-79300

SEP sesam before 5.2.0.24 mishandles user authorization when combined with Active Directory (AD) authentication and enforced multi-factor authentication (MFA) . The root cause is a case-sensitivity mismatch : Active Directory treats usernames as case-insensitive, while SEP sesam distinguishes let...

SUSE CVE-2026-89507

In the Linux kernel, the following vulnerability has been resolved: RDMA/ucma: Lock the handler in ucmawritecmevent ctx-file may only be changed under the handler lock and the xalock, which is what stops uevents being queued for a ctx while ucmamigrateid moves it to another file. The CM core take...

CVE-2026-90536

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to authorize access to the adsInfo API endpoint, allowing unauthenticated attackers to retrieve password-protected video owner identifiers. Attackers can call the adsInfo API with a videosid parameter to obtain the owner's...

EUVD-2026-76851

Flowise before 3.1.4 contains a broken access control vulnerability in GET /api/v1/organizationuser that allows any authenticated organization member to retrieve the organization owner's full user record including bcrypt password hash and temporary tokens. Attackers can query the endpoint with an...

CVE-2026-87759

The Add User Autocomplete WordPress plugin before 1.2 does not perform any capability or nonce check before creating a pending site-membership invitation carrying a caller-supplied role, allowing any authenticated user, such as a subscriber, to grant themselves the administrator role on a multisi...

CVE-2026-87759 Add User Autocomplete < 1.2 - Subscriber+ Privilege Escalation

The Add User Autocomplete WordPress plugin before 1.2 does not perform any capability or nonce check before creating a pending site-membership invitation carrying a caller-supplied role, allowing any authenticated user, such as a subscriber, to grant themselves the administrator role on a multisi...

CVE-2026-87759

The Add User Autocomplete WordPress plugin, in versions before 1.2 , contains a privilege escalation vulnerability. The plugin fails to perform necessary capability or nonce checks when creating pending site-membership invitations. This allows any authenticated user , such as a subscriber, to pro...