.NET: .NET: Network Spoofing Vulnerability

A flaw was found in .NET. An authorized attacker can exploit this vulnerability by leveraging improper encoding or escaping of output. This allows the attacker to perform spoofing over a network, potentially deceiving users or systems into believing they are interacting with a trusted entity...

PT-2026-61687

Name of the Vulnerable Software and Affected Versions LimeSurvey versions 6.x through 6.17.10 LimeSurvey versions 7.x through 7.0.4 Description Authenticated users can trigger a server-side request forgery SSRF by providing a manipulated Host header. This occurs due to the unsanitized use of the...

PT-2026-61528

The LearnPress WordPress plugin before 4.4.1 does not escape a search parameter before reflecting it into an HTML attribute, leading to Reflected Cross-Site Scripting that executes in the browser of a logged-in instructor or administrator who is tricked into opening a crafted link...

PT-2026-61690

Name of the Vulnerable Software and Affected Versions HyperDX versions prior to 2.31.0 Description Authenticated team members can perform a server-side request forgery SSRF, which occurs when a server is tricked into making requests to an unintended destination. By providing a caller-controlled...

PT-2026-61626

dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core processing and framework rules, before and including version 25.07.3, a Standard user can enumerate other users' names and email addresses...

PT-2026-61526

The Kirki WordPress plugin before 6.0.12 does not sanitise or escape the email subject and body values supplied in a request before including them in the password-reset email it sends as HTML, allowing unauthenticated users to inject arbitrary HTML into the message delivered to a registered user,...

CVE-2026-63751: Incorrect Authorization

SurrealDB versions before 3.1.0 contain a field-level permission bypass vulnerability in JSON Patch operations that allows authenticated users to read protected fields. Attackers can use UPDATE PATCH with an empty from pointer in copy or move operations to duplicate all record fields, including...

CVE-2026-60030: Improper Access Control

Joomla Extension - themexpert.com - Broken Access Control for media management in Quix Page Builder 6.2.1 - The Joomla extension Quix Page Builder Pro is vulnerable to an improper access control. Authenticated users could upload media files regardless of their media management permissions...

CVE-2026-63102: Improperly Controlled Modification of Dynamically-Determined Object Attributes

rConfig Core before 8.2.8 contains a privilege escalation vulnerability that allows authenticated users to assign arbitrary roles to any account by submitting an unvalidated role field through the Users API during user creation or profile updates. Attackers can exploit the missing allowlist...

CVE-2026-63745: Authorization Bypass Through User-Controlled Key

SurrealDB versions before 3.1.0 contain an authorization bypass vulnerability where authenticated users can spoof composite record-id field values by writing to editable body fields. Attackers can bypass permission rules that gate access on id components like tenant isolation by setting same-name...

CVE-2026-63734: Improper Input Validation

SurrealDB versions before 3.2.0 contain a denial of service vulnerability in the SurrealML header parser that allows authenticated Owner-role users to crash the server by uploading a malformed .surml file to the /ml/import endpoint. Attackers can supply non-numeric input-dimensions or other...

PT-2026-61677

The Joomla extension Quix Page Builder Pro is vulnerable to an improper access control. Authenticated users could upload media files regardless of their media management permissions...

PT-2026-61574

Name of the Vulnerable Software and Affected Versions SurrealDB versions prior to 3.1.0 Description An authorization bypass exists in the KILL statement that allows authenticated database users to terminate LIVE SELECT subscriptions belonging to other users. This occurs because the system fails t...

PT-2026-61605

Name of the Vulnerable Software and Affected Versions FileBrowser Quantum versions prior to 1.4.3-beta Description The subtitlesHandler endpoint GET /api/media/subtitles contains path traversal flaws due to insufficient sanitization of the path and name query parameters. The path parameter is...

PT-2026-61567

SurrealDB versions before 3.1.0 contain a field-level permission bypass vulnerability in JSON Patch operations that allows authenticated users to read protected fields. Attackers can use UPDATE PATCH with an empty from pointer in copy or move operations to duplicate all record fields, including...

PT-2026-61553

Name of the Vulnerable Software and Affected Versions SurrealDB versions prior to 3.1.5 Description Authenticated users can cause a denial of service by submitting queries containing long chains of operators. This occurs when tens of thousands of chained operators create unbounded expression tree...

PT-2026-61521

The All in One SEO WordPress plugin before 4.9.9 does not correctly restrict access to some of its AI integration REST API endpoints, allowing users with low-level privileges such as Contributors to overwrite or reset the site-wide AI integration state...

PT-2026-61708

Name of the Vulnerable Software and Affected Versions VSee Clinic version 7.1.26 VSee API version 1.3.0 Description An Insecure Direct Object Reference IDOR occurs in the '/v1.3.0/api/files' endpoint. An authenticated attacker can manipulate the remark request parameter to enumerate, retrieve, an...

PT-2026-61689

HyperDX before 2.31.0 contains a server-side request forgery vulnerability that allows authenticated team members to direct the server to make requests to arbitrary internal network destinations by supplying a caller-controlled URL to the webhook test endpoint. Attackers can bypass the insufficie...

PT-2026-61550

Name of the Vulnerable Software and Affected Versions SurrealDB versions prior to 3.2.0 Description A denial of service issue exists in the SurrealML header parser. Authenticated users with the Owner role can crash the server by uploading a malformed .surml file to the '/ml/import' endpoint. By...