PT-2026-115475

Name of the Vulnerable Software and Affected Versions Smush WordPress plugin versions prior to 4.3.4 Description An issue exists where changes to a network-wide access setting are not restricted to network administrators. This allows an administrator of a single site within a multisite network to...

PT-2026-115469

Name of the Vulnerable Software and Affected Versions Visual Form Builder WordPress plugin versions prior to 3.2 Description The plugin fails to perform an authorization check before displaying recent form submission data within a dashboard widget. This allows any authenticated user with the...

PT-2026-115598

Name of the Vulnerable Software and Affected Versions YITH PayPal Express Checkout for WooCommerce versions prior to 1.61.0 Description A missing authorization issue exists due to incorrectly configured access control security levels. Recommendations Update YITH PayPal Express Checkout for...

PT-2026-115481

Name of the Vulnerable Software and Affected Versions WX Subscribe 微信支付付费订阅 WordPress plugin versions prior to 1.2.2 Description An issue exists where a parameter is not properly sanitized and escaped before being used in a SQL statement. This allows unauthenticated attackers to perform SQL...

PT-2026-116023

Name of the Vulnerable Software and Affected Versions Umbraco CMS versions prior to 17.7.1 Umbraco CMS versions prior to 18.2.1 Description Missing authorization allows unauthenticated clients to connect to the backoffice 'PreviewHub' and 'BackofficeHub' SignalR hubs. By completing the SignalR...

PT-2026-115997

Improper verification of the source of a communication channel in the IPv6 Router Advertisement handler in Amazon FreeRTOS-Plus-TCP before V4.4.2 might allow a remote third-party to influence an endpoint's IPv6 default gateway, on-link prefix, and address configuration via a crafted Router...

PT-2026-116431

These are all security issues fixed in the libXtst-devel-1.2.5-3.1 package on the GA media of openSUSE Tumbleweed...

PT-2026-116024

Name of the Vulnerable Software and Affected Versions 10up Distributor versions prior to 2.3.2 Description A missing authorization issue exists in the ajax push function. This allows users with Contributor-level permissions in a multisite environment to publish posts on other sites within the...

PT-2026-116105

99AI through 4.3.0 contains a missing authentication vulnerability in the POST /api/chatLog/exportExcel route that allows unauthenticated attackers to export all users' chat logs. Attackers can send requests with controlled page, size, and optional email fields to download xlsx files containing...

PT-2026-115508

Mattermost versions 11.10.x = 11.10.0, 11.7.x = 11.7.9, 11.9.x = 11.9.1, 11.8.x = 11.8.5 fail to properly restrict private teams from public team search results, which allows an authenticated user without permission to list private teams to disclose the ID, name, and display name of private teams...

PT-2026-115923

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the mariadb.service unit used /run/mysqld/wsrep-new-cluster during the next service restart. A database user with FILE privilege and a secure-file-priv...

PT-2026-115859

GitLab has remediated an issue in GitLab CE/EE affecting all versions before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed a user to poison cached responses for raw repository files, causing targeted users' CI/CD pipelines to execute special...

PT-2026-115525

Name of the Vulnerable Software and Affected Versions Social Share Buttons versions prior to 1.31 Description Insufficient input sanitization and output escaping allow authenticated attackers with subscriber-level access and above to perform Stored Cross-Site Scripting. This occurs via the share...

PT-2026-115430

The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 0.1.4.1 This is due to the plugin registering its admin page via add management page using a role name returned by InstaWP Setting::get allowed rol...

PT-2026-115490

The WSP MCP AI Agents Connector plugin for WordPress is vulnerable to Sensitive Information Disclosure in versions up to, and including, 2.9.5. This is due to the wsp get posts MCP tool being registered with an empty capability requirement while the MCP endpoint's authenticate method accepts any...

PT-2026-115431

The Mang Board plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content' parameter in all versions up to, and including, 2.4.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and...

PT-2026-115429

The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the copy file function in all versions up to, and including, 4.9.3 This makes it possible for authenticated attackers, with Sales...

PT-2026-115537

An SQL injection vulnerability has been discovered in TSG Profleet. The vulnerability could allow an attacker to retrieve, create, update and delete data from the database by sending a GET request using the ‘Identificación’ parameter of the ‘/cgi-bin/index.php’ endpoint...

PT-2026-115390

Nezha 1.0.0 before 2.3.15 contains a memory exhaustion vulnerability in the dashboard file manager WebSocket endpoint because fmStream never calls SetReadLimit, leaving message size unbounded. Authenticated users with file manager scopes can send one oversized binary message to /api/v1/ws/file/:i...

PT-2026-115389

Nezha from 2.0.13 before 2.3.15 contains a resource exhaustion vulnerability that allows authenticated users to open unbounded concurrent connections to the /api/v1/ws/transfer WebSocket endpoint. Attackers can hold thousands of subscriptions created by ServerTransferClass.Subscribe without limit...

PT-2026-115391

Name of the Vulnerable Software and Affected Versions Nezha versions 2.1.0 through 2.3.14 Description The mintTransferTool component fails to validate the Host header when constructing fs.download url and fs.upload url transfer URLs. This allows an attacker to control the Host header in a victim'...

PT-2026-115437

The Mail Mint plugin for WordPress is vulnerable to SQL Injection via the 'filters' parameter of the /wp-json/mrm/v1/segments/contacts REST endpoint in versions up to, and including, 1.31.4 This is due to insufficient escaping on the user supplied filter 'value' before it is appended to a SQL que...

PT-2026-115438

The Nexter Extension – Security, Performance, Code Snippets & Site Toolkit plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.7.11 The vulnerability exists because the /?reset-view handler in role switcher to view admin as performs no nonce or...

PT-2026-116083

🚨 CVE-2026-111684 Magistrala through 1.0.0 contains an authorization bypass vulnerability that allows authenticated workspace members to view, issue, and revoke other tenants' device certificates by supplying foreign serials or entity ids. Attackers can call RevokeBySerial, RevokeAll, ViewCert,...

PT-2026-115861

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user with Developer role to execute CI/CD pipelines on protected branches without...

PT-2026-115911

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the mariadb.service unit used /run/mysqld/wsrep-new-cluster during the next service restart. A database user with FILE privilege and a secure-file-priv...

PT-2026-115899

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the mariadb.service unit used /run/mysqld/wsrep-new-cluster during the next service restart. A database user with FILE privilege and a secure-file-priv...

PT-2026-115381

Name of the Vulnerable Software and Affected Versions FreeRDP versions 3.0.0 through 3.31.0 Description The Windows RAIL client contains an out-of-bounds read issue where malicious RDP servers can trigger heap over-reads by sending window titles that are not NUL-terminated. This occurs when a...

PT-2026-115382

FreeRDP from 3.30.0 before 3.32.0 contains a heap out-of-bounds read vulnerability in the Windows client's CliprdrStream New that allows malicious RDP servers to trigger invalid memory reads via short clipboard responses. Attackers can answer a FILECONTENTS SIZE request with a cbRequested of fewe...

PT-2026-116173

Name of the Vulnerable Software and Affected Versions Text::CSV XS versions prior to 1.65 Description The parse function incorrectly handles input that ends with a separator followed by a lone carriage return CR. In such cases, the parser treats the end of the input as the subsequent character an...

PT-2026-116170

Name of the Vulnerable Software and Affected Versions Text::CSV XS versions prior to 1.65 Description An issue exists in the print function where the end of a record and its line ending are dropped when a UTF-8 flagged field precedes invalid UTF-8 bytes. During buffer flushes, the system holds ba...

PT-2026-116171

Name of the Vulnerable Software and Affected Versions Text::CSV XS versions prior to 1.65 Description An issue exists where record splitting can occur when writing strings used as numbers without quotes in the combine function. The combine and print functions fail to verify if a field requires...

PT-2026-116168

Name of the Vulnerable Software and Affected Versions Text::CSV XS versions prior to 1.65 Description An issue exists where the getline function fails to free the array or the fields parsed before a syntax error occurs. While the function normally returns a reference to the record array upon...

PT-2026-116166

Name of the Vulnerable Software and Affected Versions Text::CSV XS versions prior to 1.65 Description An issue exists where memory exhaustion can occur due to the allocation of one entry per index of an RFC 7111 selector within the fragment function. The fragment function expands row= or col=...

PT-2026-116169

Name of the Vulnerable Software and Affected Versions Text::CSV XS versions prior to 1.65 Description Processing CSV input with carriage return CR only line endings using the getline function can lead to quadratic CPU usage. When the eol variable is unset, the parser treats CR-only input as a...

PT-2026-115386

Name of the Vulnerable Software and Affected Versions FreeRDP versions 3.29.0 through 3.31.0 Description An integer overflow exists in the Apple audin backends audin mac.m, audin ios.m. The issue occurs during the calculation of the audio queue buffer size using the formula FramesPerPacket 2...

PT-2026-116147

Name of the Vulnerable Software and Affected Versions Apache Kylin versions 4.0.4 through 5.0.4 Description An OS Command Injection issue exists due to improper neutralization of special elements used in an OS command. This primarily impacts services directly exposed to the public network, while...

PT-2026-116077

Antiword through 0.37 contains a stack out-of-bounds read vulnerability in vGet8PapInfo and vGet8ChrInfo in prop8.c because FKP run counts and grpprl offsets are not bounded. Attackers can supply a crafted .doc file with malicious FKP pages to read past the 512-byte stack buffer, crashing antiwor...

PT-2026-115845

When migrations ALLOWED DOMAINS was configured, a hostname matching the allow list was accepted without checking its resolved address against the local-network restrictions. A user who can start repository migrations and control the DNS of an allowed hostname could make it resolve to loopback or...

PT-2026-116076

Antiword through 0.37 contains a heap out-of-bounds read vulnerability in vGet8LstInfo in prop8.c caused by an inverted bounds check on the PlcfLst record count. Attackers can supply a crafted Word 8 .doc file claiming up to 0xffff LSTF records in a tiny buffer, causing reads past the heap...

PT-2026-115452

The Vitepos – Point of Sale POS for WooCommerce plugin for WordPress is vulnerable to blind SQL Injection via the 'src by.val.start / src by.val.end operator 'bt'' parameter in all versions up to, and including, 3.6.1 due to insufficient escaping on the user supplied parameter and lack of...

PT-2026-115504

Missing Authorization vulnerability in Gemini Labs Site Reviews site-reviews allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Site Reviews: from n/a through 8.3.4...

PT-2026-115619

Name of the Vulnerable Software and Affected Versions J4Care dcm4chee PACS affected versions not specified Description In the default configuration, the archive accepts DICOM associations from an unregistered calling AE Application Entity. This missing authentication allows a remote peer to use t...

PT-2026-115618

Name of the Vulnerable Software and Affected Versions MP4Parser affected versions not specified Description MP4Parser fails to properly validate MP4 box sizes. This allows a malformed box to cause the parsing process to stall, resulting in no forward progress as the system repeatedly processes th...

PT-2026-116069

🚨 CVE-2026-111670 ClickVisual through 1.1.2 contains a missing authorization vulnerability in the /api/v2/reports handlers that allows authenticated low-privileged users to access ClickHouse instances they were not granted. Attackers can iterate the instance-id parameter in ReportSourceDatabases,...

PT-2026-115588

Name of the Vulnerable Software and Affected Versions WP Event Solution versions prior to 4.1.27 Description Missing authorization allows for the exploitation of incorrectly configured access control security levels. Recommendations Update to a version newer than 4.1.26...

PT-2026-115590

Name of the Vulnerable Software and Affected Versions BookIt versions prior to 2.6.0.6 Description An issue exists where missing authorization allows for the exploitation of incorrectly configured access control security levels. Recommendations Update BookIt to version 2.6.0.6 or later...

PT-2026-115589

Name of the Vulnerable Software and Affected Versions Passster versions prior to 4.3.19 Description A missing authorization issue in the WP Chill Passster content-protector allows for the exploitation of incorrectly configured access control security levels. Recommendations Update to version 4.3....

PT-2026-115574

Name of the Vulnerable Software and Affected Versions GeoDirectory versions prior to 2.8.192 Description Insufficient input sanitization and output escaping allow authenticated attackers with subscriber-level access or higher to perform Stored Cross-Site Scripting. By utilizing the post content...

PT-2026-115847

When Gitea's built-in SSH server is enabled START SSH SERVER = true, the presented public key was looked up with an SQL LIKE comparison of its encoded content, which is case-insensitive on some databases, including the default SQLite. An attacker who can construct a case variant of another user's...