PT-2026-106384

Subscriber Privilege Escalation in WP User Profiles = 2.7.3 versions...

PT-2026-107146

An operating system OS command injection vulnerability in CloudVision CUE backup management may allow an authenticated Super User to submit a crafted backup request and execute arbitrary commands with the privileges of the affected service...

CVE-2026-32572: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in WP User Frontend Pro = 4.2.13 versions...

CVE-2026-105788: Improper Neutralization of Special Elements used in an OS Command

Microsoft UFO is an open-source framework for intelligent automation across devices and platforms. Prior to 3.0.10, the typetext and launchapp tools in ufo/client/mcp/httpservers/mobilemcpserver.py pass the authenticated caller-controlled text and packagename parameters into adb shell command...

CVE-2026-102160: Improper Neutralization of Special Elements used in an OS Command

An operating system OS command injection vulnerability in CloudVision CUE backup management may allow an authenticated Super User to submit a crafted backup request and execute arbitrary commands with the privileges of the affected service...

PT-2026-106321

A security vulnerability has been detected in uptrace up to 2.1.0-beta.8. Affected by this vulnerability is the function Login of the file pkg/org/user handler.go. The manipulation leads to information exposure through error message. It is possible to initiate the attack remotely. The exploit has...

PT-2026-106530

In the Linux kernel, the following vulnerability has been resolved: Input: zero ff effect before compat copy in input ff effect from user In the compat path input ff effect from user aliases the caller's native struct ff effect with the smaller struct ff effect compat and copies only the compat...

CVE-2026-104034: Expired Pointer Dereference

A flaw was found in SSSD. A use-after-free vulnerability exists in the Kerberos Credential Manager KCM responder during Kerberos ticket-granting ticket TGT renewal, where a deferred callback accesses memory that has already been released. An authenticated local user with a renewable Kerberos tick...

PT-2026-106315

Name of the Vulnerable Software and Affected Versions chillzhuang SpringBlade versions prior to 5.0.2 Description An improper authorization issue exists in the User Detail Endpoint within the file blade-service/blade-system/src/main/java/org/springblade/system/controller/RoleController.java. A...

PT-2026-106823

Name of the Vulnerable Software and Affected Versions @quasar/ssl-certificate versions prior to 2.1.0 @quasar/cli versions prior to 5.0.4 @quasar/app-vite versions prior to 3.3.0 Description The @quasar/ssl-certificate utility caches a combined private key and certificate PEM without applying...

CVE-2026-106104: Inefficient Regular Expression Complexity

Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 2.23.3, Platform.parseSSR passed an unbounded User-Agent request header to getMatch in ui/src/plugins/platform/Platform.js, whose browser-detection expressions combined greedy captures with repeated...

PT-2026-107196

Name of the Vulnerable Software and Affected Versions HPE Networking ClearPass Policy Manager Android client application affected versions not specified Description An improper access control issue allows application functionality to be invoked by untrusted sources. This could enable an...

PT-2026-106754

SimpleChat is a secure AI conversation application with personal and group workspaces for document-grounded interactions. In versions 0.261.003 and 0.261.027, an authorization ordering flaw in POST /api/user/plugins allows an authenticated low-privileged user to omit the top-level MCP type so tha...

PT-2026-107264

Name of the Vulnerable Software and Affected Versions Backstage versions prior to 4.1.0 Description The @backstage/plugin-scaffolder-backend package contains incorrect authorization in the scaffolder task listing. This allows an authenticated internal user to view metadata for scaffolder tasks th...

PT-2026-106797

Name of the Vulnerable Software and Affected Versions @payloadcms/plugin-multi-tenant versions prior to 3.90.0 @payloadcms/plugin-multi-tenant canary versions prior to 4.0.0-canary.34 Description An authenticated user restricted to a single tenant can create a record within another tenant, provid...

PT-2026-106400

Name of the Vulnerable Software and Affected Versions WP User Frontend Pro versions prior to 4.2.14 Description An unauthenticated Cross Site Scripting XSS issue exists, which allows an attacker to execute malicious scripts in the browser of a user without requiring prior authentication...

PT-2026-106852

Name of the Vulnerable Software and Affected Versions Devolutions Server versions prior to 2026.3.7.1 Description Missing authorization in the global vault allows an authenticated user who possesses only the global vault view permission to modify and delete global contact and folder entries...

CVE-2026-105058: Incorrect Privilege Assignment

Subscriber Privilege Escalation in WP User Profiles = 2.7.3 versions...

PT-2026-106286

A flaw was found in SSSD. A use-after-free vulnerability exists in the Kerberos Credential Manager KCM responder during Kerberos ticket-granting ticket TGT renewal, where a deferred callback accesses memory that has already been released. An authenticated local user with a renewable Kerberos tick...

CVE-2026-105703: Incorrect Authorization

A vulnerability was determined in PHPGurukul User Registration & Login and User Management System 3.3. The impacted element is an unknown function of the file loginsystem/admin/change-password.php of the component Change Password Handler. This manipulation of the argument currentpassword causes...