EUVD-2026-50136

An insecure direct object reference vulnerability in Koollab LMS allowed an authenticated user to query the course completion progress of any other user without authorisation, disclosing private learning progress information...

CVE-2026-63241

Koollab LMS is affected by an insecure direct object reference vulnerability that allows an authenticated user to query the course completion progress of other users without proper authorization, leading to disclosure of private learning progress information. The root cause is an insecure direct ...

CVE-2026-63241 Insecure direct object reference vulnerability

An insecure direct object reference vulnerability in Koollab LMS allowed an authenticated user to query the course completion progress of any other user without authorisation, disclosing private learning progress information...

CVE-2026-58347

A flaw was found in Moodle. Authenticated users could cause a Denial of Service DoS by providing an excessively long user profile description. This vulnerability is due to the absence of a defined maximum length for user profile descriptions, which could lead to resource exhaustion...

CVE-2026-17162

The WowStore – Store Builder & Product Blocks for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'currentPostId' Block Attribute in all versions up to, and including, 4.4.24 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-17161

The CVE-2026-17161 entry documents a Stored Cross-Site Scripting vulnerability in the WowStore – Store Builder & Product Blocks for WordPress plugin. Affected: WordPress plugin WowStore (Product Blocks) up to version 4.4.24. Vulnerable component: the filterMobileText Block Attribute; root cause i...

CVE-2026-17162 WowStore <= 4.4.24 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'currentPostId' Block Attribute

The WowStore – Store Builder & Product Blocks for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'currentPostId' Block Attribute in all versions up to, and including, 4.4.24 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-12144 Wholesale for WooCommerce <= 2.0.5 - Authenticated (Author+) Privilege Escalation via 'user_role_set' Parameter

The Wholesale for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.0.5. This is due to the saverequestsmeta function applying only sanitizetextfield to the userroleset POST parameter before passing it directly to WPUser::addrole, with ...

CVE-2026-12938 Newsletters <= 4.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'target' Shortcode Attribute

The Newsletters Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'target' attribute of the newsletterspost shortcode in versions up to and including 4.15. This is due to insufficient input sanitization and output escaping in the postssingle function which propagates...

PT-2026-65782

The Booking System Trafft plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the bookingWebsiteUrl setting in all versions up to, and including, 1.0.17 due to a missing capability check on the set options AJAX action when the plugin is operating in agency mode. The...

Linux Distros Unpatched Vulnerability : CVE-2026-67194

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Courier IMAP before 6.0.1 and Courier Mail Server before 2.0.2 allow authenticated IMAP users to crash the imapd process via deeply nested parenthesized SEARCH...

PT-2026-65810

MWDB Core versions =2.0.0 and 2.19.0 contain a missing authorization vulnerability in the deprecated config and blob upload endpoints. These endpoints accept the undocumented POST method, which bypasses the capability checks applied to the documented PUT method. This allows any authenticated user...

PT-2026-65784

The Extra Checkout Options addon for Extra Product Options & Add-Ons for WooCommerce plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.3.2. This is due to missing authorization and nonce validation in the eco save settings function, which allows...

PT-2026-65890

Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 16.6 through 19.0.4 GitLab CE/EE versions 19.1 through 19.1.2 GitLab CE/EE versions 19.2 through 19.2.0 Description A missing authorization check allows an unauthorized user to view project import source information under...

PT-2026-65868

Name of the Vulnerable Software and Affected Versions IBM WebSphere Application Server - Liberty versions 17.0.0.3 through 26.0.0.8 Description Cross-site request forgery allows an attacker to execute malicious and unauthorized actions by transmitting requests from a user that the website trusts...

PT-2026-65743

Name of the Vulnerable Software and Affected Versions Apache Atlas versions 0.8 through 2.5.0 Description Missing authorization in admin endpoints allows any authenticated user to perform administrative operations, regardless of their assigned role. Recommendations Upgrade to version 2.6.0...

PT-2026-65842

Name of the Vulnerable Software and Affected Versions Quay affected versions not specified Description A flaw exists where a user configured in GLOBAL READONLY SUPER USERS can view robot account tokens for repositories they are not members of. This allows an attacker with read-only superuser...

PT-2026-65788

Name of the Vulnerable Software and Affected Versions open-iscsi versions prior to 668ca1df9c9a1e9bdd5c999ae1d67c9c8909237e Description An incorrect authorization issue allows unprivileged local users to access and use the isscsiuio control socket. Recommendations Update to a version later than...

Arbitrary Code Injection

Overview Affected versions of this package are vulnerable to Arbitrary Code Injection via the selecteval custom field type. An attacker can execute arbitrary Ruby code on the server by supplying a malicious expression in the field options command parameter, which is evaluated through instanceeval...

GHSA-V8VM-CQH8-Q87Q NocoBase: Sensitive Data Exposure via SQL Blacklist Bypass

Security Vulnerability Report: Sensitive Data Exposure via SQL Blacklist Bypass Summary The checkSQL function in plugin-collection-sql implements a keyword-based blacklist to prevent dangerous SQL queries from being executed through the SQL Collection feature. However, the blacklist is incomplete...