PT-2026-115642

pupnp is an SDK for development of UPnP device and control point applications. Prior to 2.0.2, ixmlNode compare in ixml/src/node.c passes the nullable nodeValue, namespaceURI, prefix, and localName fields directly to strcmp. Non-namespaced attributes created by ixmlDocument createAttribute...

PT-2026-115497

Name of the Vulnerable Software and Affected Versions GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress versions prior to 2.8.193 Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Authenticat...

PT-2026-115468

Name of the Vulnerable Software and Affected Versions Visual Form Builder versions prior to 3.2 Description The plugin fails to perform authorization or nonce checks when reordering form fields. This allows any authenticated user with the Subscriber role or higher to modify the field structure of...

PT-2026-115652

countly-server is the server-side part of Countly, a product analytics solution. Prior to 24.05.50 and 25.03.44, public image and screenshot routes implemented in frontend/express/app.js, plugins/star-rating/frontend/app.js, and plugins/dashboards/frontend/app.js concatenate attacker-controlled...

PT-2026-115656

Name of the Vulnerable Software and Affected Versions Dockhand versions prior to 1.0.34 Description The in-browser container terminal endpoint '/api/containers//exec' fails to enforce authentication during the WebSocket upgrade request. An unauthenticated attacker with network access and knowledg...

PT-2026-115394

Frappe Framework before 15.120.0 and 16.x before 16.33.0 does not enforce the per-user restrict ip allowlist for non-session authentication methods, including API key, OAuth, and header-based authentication. Attackers holding valid credentials of these types can authenticate from IP addresses...

PT-2026-115408

Wheels 4.0.0 through 4.1.2 before 4.2.0 replaces incoming scope conditions with a primary-key condition in findByKey and existskey=. For existskey=, production with error information disabled returns true for an out-of-scope key instead of throwing. Applications relying on scopes for ownership or...

PT-2026-115890

JupyterHub through 6.0.1 contains an identifier collision vulnerability that allows authenticated users to overwrite another user's named-server OAuth client by registering a hyphenated username. Attackers holding a name like alice-prod can overwrite the client for alice's server prod, breaking...

PT-2026-115905

MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. From 3.2.0 until 3.2.5, 3.3.4, 3.4.7, and 3.5.4, applications that enable permitSetMultiParamEntries can pass objects whose keys are expanded into a SQL SET clause without being processe...

PT-2026-115409

Wheels 4.0.0 through 4.1.2 exposes password-less development tools under /wheels/ to remote clients when enablePublicComponent=true, as it is by default in development. Before 4.1.2 these tools have no local-access restriction; in 4.1.2 the restriction trusts client-supplied headers without...

PT-2026-116115

Arkon through 0.9.2 contains a broken access control vulnerability that allows authenticated employees to read and modify other departments' sources because by-id routes in app/routers/sources.py skip can access document. Attackers can call the plan, progress, PATCH, retry and approve-extraction...

PT-2026-115425

The Modula Image Gallery – Photo Grid & Video Gallery plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.0.11 via the 'id post ID in /wp-json/wp/v2/modula-gallery/id or none for collection route' parameter. This makes it possible for...

PT-2026-115492

Name of the Vulnerable Software and Affected Versions WP Mail Logging versions prior to 1.17.1 Description The plugin is subject to sensitive information exposure through the email address parameter. Authenticated attackers with administrator-level access can extract logged mail rows of other...

PT-2026-116045

SurveyKing before 1.13.0 contains a missing authorization vulnerability that allows unauthenticated attackers to download any stored file by id through GET /api/public/preview/attachmentId. Attackers who know or derive time-ordered snowflake file ids can bypass shared, owner, and project checks i...

PT-2026-115488

Name of the Vulnerable Software and Affected Versions The Photo Engine Media Organizer & Lightroom versions prior to 6.5.7 Description An authorization bypass exists because the plugin fails to properly verify user permissions before performing actions. Unauthenticated attackers can permanently...

PT-2026-116107

WhaTicket Community through commit cf04795 contains an authentication bypass vulnerability that allows unauthenticated attackers to self-register as administrators via POST /auth/signup. Attackers can omit the profile field or set it to admin, gaining user management, settings, and access to all...

PT-2026-115852

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.0 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user with access to GitLab Pages log data to obtain access tokens and other secrets, due to...

PT-2026-115451

Name of the Vulnerable Software and Affected Versions Salon Booking System – Appointment Booking for Salons, Barbershops & Spas versions prior to 10.32.0 Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting XSS, a...

PT-2026-115577

Name of the Vulnerable Software and Affected Versions rdiffweb version 7.1.1 Description An improper path containment check allows an authenticated user to perform browse, restore, history, and delete operations on paths outside the intended repository. This occurs because the system uses a strin...

PT-2026-115848

Gitea's container registry served blob downloads with a Content-Type taken from the media type declared in pushed image manifests, without a Content-Disposition or restrictive content security policy. A user who can push container images can publish a blob containing HTML and JavaScript with a...

PT-2026-116020

TDuck Survey Form through 5.3 contains a missing authorization vulnerability that allows any authenticated user to read other owners' raw form settings via GET /user/form/setting/key. Attackers can supply the 8-character form key from a public fill link to obtain the form write password, owner...

PT-2026-115446

The Simply Schedule Appointments plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'status' parameter in all versions up to, and including, 1.6.12.35 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

PT-2026-116080

EFAK through 5.1.0 contains a missing authorization vulnerability that allows authenticated low-privilege users to manage accounts because the /api/users endpoints lack administrator role checks. Attackers can send POST, PUT, or DELETE requests to UserController to grant themselves ROLE ADMIN,...

PT-2026-115456

Name of the Vulnerable Software and Affected Versions SiteOrigin CSS versions prior to 1.6.8 Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored DOM-Based Cross-Site Scripting. This occurs via the href parameter, enabling the injection...

PT-2026-115419

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to, and including, 1.58.1. This is due to the forminator replace quiz form data helper invoking do shortcode on the fully expanded notificatio...

PT-2026-115436

The NotificationX plugin for WordPress is vulnerable to Missing Authorization leading to arbitrary content injection in versions up to, and including, 3.3.3 The /notificationx/v1/popup-submit REST route is registered with permission callback = ' return true', and the handler at...

PT-2026-116121

LingGuo-Drama through commit 8a6924a contains an insecure direct object reference vulnerability that allows registered users to access other users' projects because projects.Get lacks an owner check. Self-registered attackers can iterate numeric IDs via GET, PUT and DELETE /admin/v1/projects/:id ...

PT-2026-115506

Name of the Vulnerable Software and Affected Versions Mattermost version 11.10.0 Mattermost versions 11.7.x through 11.7.9 Mattermost versions 11.9.x through 11.9.1 Mattermost versions 11.8.x through 11.8.5 Description An issue exists where the software fails to verify the integrity of the SAML...

PT-2026-115406

Wheels 4.0.6 through 4.1.2 lets an unauthenticated client switch a request into a separate test application context, including in production, by supplying an X-Wheels-Test-Context header or WHEELS TEST CONTEXT cookie with any value, or including a test-runner path anywhere in the URL, even the...

PT-2026-115903

MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. From 3.3.0 until 3.5.4, the zero-configuration TLS fingerprint-validation path calls Ed25519PasswordAuth.hash through Authentication.validateFingerPrint, but Ed25519PasswordAuth.hash...

PT-2026-115579

Name of the Vulnerable Software and Affected Versions MAIO WordPress plugin versions prior to 7.3.22 Description Insufficient access restrictions to analytics data allow unauthenticated attackers to retrieve the stored crawl-analytics log. This occurs because the plugin treats a credential value...

PT-2026-115404

The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'media:thumbnail@url' parameter in all versions up to, and including, 5.2.11 due to insufficient input sanitization and output...

PT-2026-115396

The Popup Box plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions 6.4.1 to 6.4.2. This is due to the ays popup get user ip function reading the client-controlled Client-IP / X-Forwarded-For / Forwarded / X-Forwarded / Forwarded-For request headers, sanitizing them only...

PT-2026-116157

Name of the Vulnerable Software and Affected Versions ERPNext versions prior to 15.121.0 ERPNext versions prior to 16.34.0 Description Certain endpoints for status modification fail to enforce proper authorization checks. A low-privileged authenticated user can invoke state-changing whitelisted...

PT-2026-115648

pupnp is an SDK for development of UPnP device and control point applications. Prior to 22.0.4, parse hostport in upnp/src/genlib/net/uri/uri.c synchronously calls getaddrinfo while parse uri is processing attacker-supplied hostnames from inbound HTTP request targets in...

PT-2026-116096

HUIZHI ChargeOS cloud through 3.0.9 contains an insecure direct object reference vulnerability in the hcp-mp MeController and OrderController that trusts client-supplied userId, openId and orderNumber parameters. Attackers can enumerate sequential member ids against endpoints like...

PT-2026-115538

Observable response discrepancy vulnerability in IKAS Technology Inc. Ikas E-Commerce Infrastructure allows Account Footprinting. This issue affects ikas E-Commerce Infrastructure: through 2026-07-13...

PT-2026-115480

Name of the Vulnerable Software and Affected Versions Subscribe to Comments WordPress plugin versions prior to 2.3.3 Description The plugin fails to sign or validate a cookie used to identify commenters. This allows unauthenticated attackers to disclose a subscriber's management key and silently...

PT-2026-116116

Arkon through 0.9.2 contains a missing authorization vulnerability in list skill versions that allows authenticated employees to read other departments' skill version metadata by bypassing the can access skill check. Attackers holding the default skill:read permission can request GET...

PT-2026-116125

🚨 CVE-2025-55640 A heap buffer overflow in the stbl AddSize function isomedia/stbl write.c of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service DoS via supplying a crafted MP4 file. 🎖@cveNotify...

PT-2026-116126

Name of the Vulnerable Software and Affected Versions GPAC MP4Box version 2.4 Description A floating point exception occurs in the gf parse lfrac function utils/error.c when processing a specially crafted MP4 file. The issue is triggered by a zero-denominator fraction string, which leads to a...

PT-2026-115601

Name of the Vulnerable Software and Affected Versions Apache Kylin versions 4 through 5.0.4 Description A missing authorization and path-confinement issue exists in a backend metadata dump API. This flaw primarily impacts services directly exposed to the public network, while in-house deployments...

PT-2026-116153

Exposure of SQL Black List to an Unauthorized Actor vulnerability in Apache Kylin. This issue affects Apache Kylin: from 4 through 5.0.4. Users are recommended to upgrade to version 5.0.5, which fixes the issue...

PT-2026-116150

Name of the Vulnerable Software and Affected Versions Apache Kylin versions 4 through 5.0.4 Description Improper Authentication allows an unauthenticated user to access system cleanup actions. This issue primarily impacts services directly exposed to the public network, while in-house deployments...

PT-2026-116149

Name of the Vulnerable Software and Affected Versions Apache Kylin versions 4 through 5.0.4 Description An issue exists that allows the exposure of sensitive information to an unauthorized actor through unauthorized SQL execution to the Spark SQL environment. Recommendations Upgrade to version...

PT-2026-116151

Exposure of Job Discard to an Unauthorized Actor vulnerability in Apache Kylin. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted. This issue affects Apache Kylin: from 4 through 5.0.4. Users are...

PT-2026-115644

pupnp is an SDK for development of UPnP device and control point applications. Prior to 2.0.2, raw to int in upnp/src/genlib/net/http/httpparser.c parses Content-Length with strtol and casts the resulting long to a 32-bit int before the caller stores it as unsigned int. On LP64 systems, values...

PT-2026-115604

Name of the Vulnerable Software and Affected Versions Apache Kylin versions 4 through 5.0.4 Description Improper Control of Generation of Code Code Injection occurs when a special parameter in the JDBC URL allows for the execution of arbitrary code. This issue primarily impacts services directly...

PT-2026-115844

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 2.11.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0, the Argo CD repo-server is vulnerable to command injection when it clones, tests, or fetches an SSH Git repository configured with a proxy URL. The proxy host and port are...

PT-2026-115526

The Vulnity Security plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.4.3 This is due to insufficient protection of the delegated-login pairing credential file on Nginx-based installations, where the plugin's generated server configuration snippe...