CVE-2026-17162

The CVE concerns WowStore – Store Builder & Product Blocks for WooCommerce (WordPress). It describes a Stored Cross-Site Scripting vulnerability via the currentPostId Block Attribute, affecting all versions up to and including 4.4.24 due to insufficient input sanitization and output escaping. Exp...

CVE-2026-12144

CVE-2026-12144 affects the Wholesale for WooCommerce plugin for WordPress (all versions up to and including 2.0.5). The root cause is in save_requests_meta(): the user_role_set POST parameter is sanitized only with sanitize_text_field(), then passed directly to WP_User::add_role() without an allo...

CVE-2026-17166

The CVE concerns The Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar (WordPress) with an authorization bypass in all versions up to and including 5.3.7. The root cause is that the plugin does not properly verify that a user is authorized to perform ...

CVE-2026-12939

The CVE-2026-12939 entry describes a Stored Cross-Site Scripting vulnerability in the WordPress Newsletters Lite plugin (versions up to 4.15). The issue stems from the post_thumbnail() function in helpers/shortcode.php, which concatenates the user-controlled $link attribute directly into an href ...

CVE-2026-12938

The CVE-2026-12938 entry describes a Stored XSS in the WordPress Newsletters Lite plugin (versions up to 4.15). The vulnerability stems from insufficient input sanitization and output escaping in the posts_single() function (injects attacker-controlled target into $wpml_target) and in the shortco...

CVE-2026-15735

The vulnerability CVE-2026-15735 affects the WordPress plugin Contact Form to Any API (all versions up to 3.0.6). It is a Stored Cross-Site Scripting (XSS) flaw in the Post Meta field named cf7anyapi_form_field , caused by insufficient input sanitization and output escaping. Authenticated attacke...

CVE-2026-62943

CVE-2026-62943 is linked to the btrbk backup tool for btrfs. Fedora advisories for both Fedora 43 and Fedora 44 report that upgrading btrbk to version 0.32.7 fixes this CVE (RHBZ#2502632). The Nessus plugin corroborates a vulnerability in an installed btrbk package, with the advisory advising the...

CVE-2026-58086

CVE-2026-58086 is tied to FreeBSD ktrace: a privilege validation issue in jails allowed an unprivileged in-jail user to modify jailed root’s ktrace flags or disable tracing. Impact: jailed root users could not reliably trace unprivileged processes. The advisory fixes this by correcting privilege ...

CVE-2025-69943

The CVE-2025-69943 entry concerns the Hospital Management System 4.0. A SQL Injection vulnerability exists in get_doctor.php, exploitable via the parameters doctor and specilizationid. Affected software/components are specified only as the Hospital Management System 4.0; the vulnerability type is...

CVE-2025-67403

CVE-2025-67403 affects Sourcecodester CASAP Automated Enrollment System 1.0. The connected documents clearly state a SQL Injection in update_class.php via the parameter class_name (root cause is unparameterized input leading to injection). The CVSS 3.1 vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C...

CVE-2026-18264

NoMachine’s PT-2026-65932 describes a getstat command injection that enables remote code execution. The document identifies the vulnerability class as a Command Injection leading to RCE, affecting NoMachine, but provides no specific affected versions or remediation details. No exploitation detail...

CVE-2025-65340

CVE-2025-65340 affects Kishan0725 Hospital Management System 4.0: a SQL injection vulnerability in /betweendates-detailsreports.php. The CVSS v3.1 base score is 9.8 (CRITICAL) with high impact on confidentiality, integrity, and availability. Connected sources confirm the vulnerability but do not ...

CVE-2026-16637

OPeNDAP Hyrax is vulnerable to Server-Side Request Forgery (SSRF) and credential disclosure via unvalidated HTTP redirects that bypass the allowed-hosts allowlist. When a redirect is followed, the system may transmit user-related headers (including Echo-Token) to attacker-controlled endpoints, po...

CVE-2025-67404

CVE-2025-67404 affects Sourcecodester CASAP Automated Enrollment System 1.0. The flaw is SQL Injection in save_stud.php through fname, lname, and student_class, enabling likely total impact on confidentiality, integrity, and availability (CVSS v3.1 base score 9.8). Exploitation is possible (poc n...

CVE-2026-18303

CVE-2026-18303 is a reserved placeholder with no public details in the initial document. The connected PT-2026-65960 entry identifies a GIMP TIF file parsing stack-based buffer overflow leading to remote code execution, indicating an exploitable vulnerability in GIMP's TIFF handling. Details on a...

CVE-2025-67406

CVE-2025-67406 concerns an SQL Injection in Advocate office management system 1.0. The vulnerability resides in activate_case.php (parameter id, accessed via GET http://localhost/advocate/kortex_lite/control/activate_case.php?id=1) where unsanitized user input is interpolated into an SQL query. D...

CVE-2026-50782

CVE-2026-50782 describes an XML External Entity (XXE) injection in Jinher OA C6. The vulnerability is located at the /c6/JHSoft.Web.HrmAttendance/sp_manager_getUserlist.aspx/GetXmlHttp endpoint, where an unauthenticated attacker can submit a crafted XML payload to read arbitrary files from the se...

CVE-2026-18309

The connected PT-2026-65966 entry identifies a concrete vulnerability affecting GIMP related to APNG file parsing: an integer overflow that leads to Remote Code Execution. Affected component is the APNG parsing path in GIMP; root cause is integer overflow during APNG data handling. The CVE-2026-1...

CVE-2026-51992

CVE-2026-51992 affects ClickHouse Server versions

CVE-2026-18278

PT-2026-65942 details a vulnerability in Sony XAV-9500ES vehicles infotainment hardware: an out-of-bounds read during an L2 decode of a packet (PRH L2). This information disclosure vulnerability is described in connected PT Security documentation; no exploit specifics, affected version ranges, or...

CVE-2026-18299

The connected PT Security entry PT-2026-65956 documents a Use-After-Free Remote Code Execution vulnerability in GStreamer’s rtpsbcdepay element. Affected component: GStreamer rtpsbcdepay. Outcome: remote code execution via use-after-free condition. No additional exploit specifics or versions are ...

CVE-2026-58045

CVE-2026-58045 is reported in the Node.js blog as: a flaw in the node:zlib sync APIs where a spoofed TypedArray byteLength can trigger a reachable assertion, potentially causing a crash and denial of service. Affected release lines include all active Node.js lines: 26.x, 24.x, 22.x . Remediation ...

CVE-2025-71386

Connected document PT-2026-65929 describes a TrendAI Vision One Service Gateway Logs Information Disclosure Vulnerability. The entry indicates an information disclosure issue affecting the Gateway’s log handling, but the provided materials do not specify affected versions, root cause, attack vect...

CVE-2026-58042

The connected Node.js July 2026 security releases document details CVE-2026-58042: a vulnerability in dns.resolveAny() that can abort when DNS responses include more than 256 A records, potentially causing denial of service. Affected release lines are 26.x, 24.x, and 22.x. The advisory indicates ...

CVE-2026-58085

The FreeBSD advisory FreeBSD-SA-26:52.if_wg discloses CVE-2026-58085: wg(4) failed to verify the Poly1305 MAC after decrypt, allowing remote attackers who can send UDP packets to a WireGuard endpoint (within the replay window) to inject or modify transport data. Affected: all supported FreeBSD ve...

CVE-2026-18304

CVE-2026-18304 is linked to a separate PT Security record PT-2026-65961 describing a remote code execution vulnerability in GIMP via integer overflow during TIF file parsing. Affects GIMP’s TIFF/TIF parsing path; overflow could allow arbitrary code execution. The connected document does not speci...

CVE-2026-58083

The CVE listed, CVE-2026-58083, is validated by the connected FreeBSD advisory FreeBSD-SA-26:50.kqueue. The issue is a use-after-free in kqueue copy-on-fork where a timer-based knote could be enqueued on the active list before copy completion, leading to potential kernel corruption. Impact: unpri...

CVE-2026-58088

CVE-2026-58088 maps to a race condition in FreeBSD’s ELF core-dump handling. The kernel’s two-pass approach for counting dumpable VM map entries can be corrupted when a process shares an address space with a dumping process, allowing an unprivileged local user to cause an out-of-bounds heap write...

CVE-2026-18267

PT-2026-65934 documents a firmware-update link-following code execution vulnerability in the Kenwood DNR1007XR. The snippet does not provide explicit root-cause, affected software versions, exploit details, or remediation. No fixes are listed; monitor for vendor/PT Security updates.

CVE-2025-69944

The CVE-2025-69944 entry affects kishan0725 Hospital Management System 4.0. The vulnerability is a SQL Injection in the view-medhistory.php endpoint, exploitable through the viewid parameter. The connected documents confirm the existence of this vulnerability but do not provide explicit impact de...

CVE-2026-18269

CVE-2026-18269 entry is linked to a PT Security advisory PT-2026-65936 describing a bytestream read vulnerability in Kenwood DNR1007XR that results in an out-of-bounds write and code execution. The connected document provides the affected product and vulnerability type but does not specify versio...

CVE-2026-18273

Technical details for CVE-2026-18273 are not publicly available in the provided documents. Monitor for updates.

CVE-2026-18274

PT-2026-65941 details a vulnerability affecting Heimdall Data Database Proxy, described as a Directory Traversal leading to Remote Code Execution via uploadJar. The CVE-2026-18274 entry is reserved with no public details, while the connected document provides concrete technical details about the ...

CVE-2025-65337

CVE-2025-65337 affects Sourcecodester’s Fantastic Blog CMS 1.0 . The vulnerability is a Cross Site Scripting (XSS) flaw in the file pageEditMember.php triggered via the address field. The documented impact is user-facing XSS; no exploitation details or confirmed mitigations are provided in the su...

CVE-2026-18261

Technical details for CVE-2026-18261 are not publicly provided in the supplied documents. Monitor for updates from relevant advisories or vendors.

CVE-2025-69945

The vulnerability is CVE-2025-69945 affecting Kishan0725 Hospital Management System 4.0, with a SQL Injection flaw in the web endpoint /doctor/edit-patient.php?editid=1. According to the provided data, the CVSS v3.1 base score is 7.3 (HIGH) with Network attack vector, Low confidentiality/integrit...

CVE-2025-71387

Technical details are not publicly available in the provided documents. Monitor for updates.

CVE-2026-58041

In Node.js, CVE-2026-58041 affects the node:sqlite SQLTagStore path. A stale StatementSyncIterator created via DatabaseSync#createTagStore() can continue to execute a cached prepared statement after it has been reset and rebound with new parameters. The reset uses sqlite3_reset() directly, bypass...

CVE-2026-18282

Connected document PT-2026-65946 details a heap-based buffer overflow in Sony XAV-9500ES AVRCP Br Response Parser that leads to remote code execution. Affected component: AVRCP Br Response Parser in the Sony XAV-9500ES system. Root cause: heap-based overflow. Impact: remote code execution possibl...

CVE-2026-18307

Summary (Mode C): The connected PT-2026-65964 entry describes a vulnerability in GIMP related to TIF file parsing that causes a heap-based buffer overflow and leads to remote code execution. The documentation does not specify affected GIMP versions, exact vulnerable component/function, or exploit...

CVE-2026-18302

Concrete detail found: PT-2026-65959 describes a vulnerability in GIMP (GNU Image Manipulation Program) affecting the TIF file parsing path, specifically a heap-based buffer overflow that enables remote code execution. The issue stems from heap corruption during TIF parsing, allowing an attacker ...

CVE-2026-18305

PT-2026-65962 describes a remote code execution vulnerability in GIMP tied to TIFF file parsing, caused by an integer overflow. The issue affects the TIFF parsing path and can lead to RCE. The connected document does not provide explicit exploit details, affected versions, or remediation steps. M...

CVE-2026-18270

PT-2026-65937 documents a Local Privilege Escalation in Kenwood DNR1007XR udhcpd caused by Incorrect Permission Assignment. Affected component is udhcpd; impact is elevated privileges on the device. The PT entry cites Pwn2Own as the context. No remediation or patch details are provided in the con...

CVE-2026-18268

The connected PT security entry PT-2026-65935 describes a local privilege escalation via command injection in Kenwood DNR1007XR JKGenService. This CVE (CVE-2026-18268) is currently reserved in the Initial document; the connected entry provides concrete details about the affected product, componen...

CVE-2026-18297

CVEs in Connected Docs : PT-2026-65954 describes a stack-based buffer overflow in GStreamer’s OGG file parsing that causes remote code execution. The vulnerability arises during OGG file parsing; impact is remote code execution. The provided documents do not specify affected versions, exploitatio...

CVE-2026-58084

CVE-2026-58084 is addressed by the FreeBSD security advisory FreeBSD-SA-26:51.ktimer. The issue affects FreeBSD 15.0 and 15.1 (stable/15, 15.1-STABLE, releng/15.1 and 15.0 releases). A local unprivileged attacker can disclose uninitialized kernel stack memory by creating a POSIX timer with CLOCK_...

CVE-2026-18283

PTSecurity PT-2026-65947 documents a vulnerability affecting Sony XAV-9500ES involving a udev USB rules authorization bypass. The root cause is described as an authorization bypass in the udev USB rules functionality, enabling bypass of USB rules authorization. The available details do not specif...

CVE-2026-58044

CVE-2026-58044 is addressed in the July 2026 Node.js security releases. The issue is described as HTTP parser header truncation can enable request smuggling in Node.js HTTP client, potentially misframing requests. The release notes list the affected release lines (26.x, 24.x, 22.x) and provide fi...

CVE-2026-18260

Technical details for CVE-2026-18260 are not publicly available in the provided documents. The connected records reference unrelated Drupal contrib issues and indicate security concerns without specifics or fixes. Monitor for updates.

CVE-2025-67405

CVE-2025-67405 affects Sourcecodester CASAP Automated Enrollment System 1.0. The vulnerability is a SQL Injection in update_password.php via the parameter new_password . This is the root cause, allowing unintended database queries. Documented impact shows low confidentiality, integrity, and avail...