PT-2026-125606

TuxCare rebuilt create-next-app to address 2 CVEs. Fixed in 12.3.7-tuxcare.8...

PT-2026-125622

TuxCare rebuilt @next/eslint-plugin-next to address 1 CVE. Fixed in 15.5.25-tuxcare.1...

PT-2026-125619

TuxCare rebuilt create-next-app to address 2 CVEs. Fixed in 13.5.11-tuxcare.18...

PT-2026-125618

TuxCare rebuilt create-next-app to address 1 CVE. Fixed in 15.5.25-tuxcare.3...

PT-2026-125617

TuxCare rebuilt create-next-app to address 1 CVE. Fixed in 12.3.7-tuxcare.10...

PT-2026-125624

TuxCare rebuilt @next/eslint-plugin-next to address 1 CVE. Fixed in 15.5.24-tuxcare.1...

PT-2026-125623

TuxCare rebuilt @next/eslint-plugin-next to address 1 CVE. Fixed in 15.5.23-tuxcare.1...

PT-2026-125620

TuxCare rebuilt @next/eslint-plugin-next to address 1 CVE. Fixed in 14.2.35-tuxcare.9...

PT-2026-125611

TuxCare rebuilt create-next-app to address 9 CVEs. Fixed in 16.0.6-tuxcare.7...

PT-2026-125625

TuxCare rebuilt @next/eslint-plugin-next to address 1 CVE. Fixed in 15.5.26-tuxcare.1...

PT-2026-125626

TuxCare rebuilt @next/eslint-plugin-next to address 1 CVE. Fixed in 14.2.35-tuxcare.11...

PT-2026-125628

TuxCare rebuilt @next/eslint-plugin-next to address 2 CVEs. Fixed in 15.5.24-tuxcare.2...

PT-2026-125612

TuxCare rebuilt create-next-app to address 1 CVE. Fixed in 16.0.6-tuxcare.10...

PT-2026-125615

TuxCare rebuilt create-next-app to address 1 CVE. Fixed in 16.0.6-tuxcare.9...

PT-2026-125621

TuxCare rebuilt @next/eslint-plugin-next to address 1 CVE. Fixed in 14.2.35-tuxcare.10...

PT-2026-125613

TuxCare rebuilt create-next-app to address 5 CVEs. Fixed in 16.0.6-tuxcare.13...

PT-2026-125608

TuxCare rebuilt create-next-app to address 9 CVEs. Fixed in 16.0.6-tuxcare.6...

PT-2026-125609

TuxCare rebuilt create-next-app to address 3 CVEs. Fixed in 14.2.35-tuxcare.6...

PT-2026-125616

TuxCare rebuilt create-next-app to address 1 CVE. Fixed in 16.0.6-tuxcare.4...

PT-2026-125629

TuxCare rebuilt @next/eslint-plugin-next to address 1 CVE. Fixed in 15.5.26-tuxcare.2...

PT-2026-125627

TuxCare rebuilt @next/eslint-plugin-next to address 1 CVE. Fixed in 15.5.25-tuxcare.2...

PT-2026-125614

TuxCare rebuilt create-next-app to address 2 CVEs. Fixed in 13.5.11-tuxcare.16...

PT-2026-125630

TuxCare rebuilt @next/eslint-plugin-next to address 2 CVEs. Fixed in 15.5.23-tuxcare.2...

PT-2026-125610

TuxCare rebuilt create-next-app to address 1 CVE. Fixed in 14.2.35-tuxcare.7...

PT-2026-115511

Mattermost versions 11.10.x = 11.10.0, 11.7.x = 11.7.9, 11.9.x = 11.9.1, 11.8.x = 11.8.5 fail to enforce DM/GM check on server side which allows an authenticated user to quarantine a post belonging to DM or GM via direct API call.. Mattermost Advisory ID: MMSA-2026-00756...

PT-2026-116090

WIMOOR through commit ec86736 contains an authentication bypass vulnerability that allows attackers to impersonate any tenant and privilege level by sending an unsigned X-USERINFO header. Attackers reaching backend service ports directly, bypassing the gateway, can forge companyid and manager or...

PT-2026-116565

CVE-2026-8311 - Rejected reason: This CVE ID has been rejected or CVE ID :CVE-2026-8311 Published : Oct. 15, 2026, 11:19 p.m. | 1 hour, 32 minutes ago Description :Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. Severity: 0.0 | NA Visit the link for mor...

PT-2026-115517

Mattermost versions 11.9.x = 11.9.1, 11.8.x = 11.8.5, 11.7.x = 11.7.10, 11.10.x = 11.10.1 fail to sanitize the active channel field returned by the user status API endpoints, which allows an authenticated user to learn the channel ID of a private channel another user is actively viewing via the...

PT-2026-115628

Name of the Vulnerable Software and Affected Versions Seanime versions 3.7.0 through 3.10.3 Description Improper authorization allows unauthenticated LAN or Tailnet clients to bypass the privileged mediastream settings guard. By setting transcodeHwAccel to custom and providing attacker-controlled...

PT-2026-116070

Cube-studio through 2026.09.01 contains an insecure direct object reference vulnerability that allows authenticated users to stop, reset, clear or redeploy other users' notebooks and services by id. Attackers can pass sequential ids to lifecycle endpoints in view notebook.py, view...

PT-2026-115493

Name of the Vulnerable Software and Affected Versions WPeMatico RSS Feed Fetcher versions prior to 2.10 Description The plugin is susceptible to Stored Cross-Site Scripting. This occurs because the software removes the wp filter post kses filter from content save pre before executing the wp inser...

PT-2026-115573

Name of the Vulnerable Software and Affected Versions Events Made Easy versions prior to 3.2.23 Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts into pages that execute when a user...

PT-2026-116043

Misaka Danmu Server through 2.8.9 contains a missing authentication vulnerability that allows unauthenticated attackers to access audit, diagnostics, data-check, scan-index and health routes under /api/ui lacking the get current user dependency. Attackers can read audit logs with login IPs, serve...

PT-2026-115478

Name of the Vulnerable Software and Affected Versions Product Delivery Date for WooCommerce versions prior to 3.3.2 Description Insufficient capability checks in the calendar view AJAX actions allow users with the Contributor role to access and view order details belonging to other customers...

PT-2026-116112

Name of the Vulnerable Software and Affected Versions tarteaucitron.js versions prior to 1.37.0 Description A cross-site scripting issue exists because the getElemAttr function resolves attributes prefixed with data-, whereas the https-only guard only validates the unprefixed version of the...

PT-2026-115659

Name of the Vulnerable Software and Affected Versions Mailu versions prior to f05aeb8322e2f61096af6b089d61ba6f40587d96 Description Domain managers can enable spoofing for hosted domains they do not control. This allows a malicious domain administrator to send emails authenticated with DKIM...

PT-2026-115873

GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user to inject specially crafted content into AI agent instructions, potentially causing...

PT-2026-115459

Name of the Vulnerable Software and Affected Versions PilotPress versions prior to 2.0.44 Description An issue allows authenticated users with Subscriber-level access or higher to perform privilege escalation and take over an Administrator account. The flaw occurs in the update cc details AJAX...

PT-2026-115586

Name of the Vulnerable Software and Affected Versions spice-server affected versions not specified Description Multiple migration data handlers fail to perform bounds validation on client-supplied offsets within SPICE MSGC MIGRATE DATA messages. This allows an authenticated SPICE client to perfor...

PT-2026-115612

Name of the Vulnerable Software and Affected Versions Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental versions prior to 3.0.2 Description Insufficient input sanitization and output escaping allow authenticated attackers with subscriber-level access or higher to perform Stored...

PT-2026-115482

Name of the Vulnerable Software and Affected Versions Coinsnap Bitcoin Crowdfunding WordPress plugin versions prior to 1.2.1 Description The plugin fails to restrict access to the secret used to authenticate its payment gateway webhook, allowing unauthenticated users to obtain it. This disclosure...

PT-2026-115572

Name of the Vulnerable Software and Affected Versions NordVPN for Windows versions prior to 8.12 Description A low-privileged local attacker can connect to the named pipe ".pipe ord-securityv1NordVpnServiceServer" by acting as a trusted process. This allows the attacker to invoke the...

PT-2026-116160

Name of the Vulnerable Software and Affected Versions OpenHuman versions prior to 0.56.0 Description Cross-site request forgery is possible via the unauthenticated GET '/auth/telegram' loopback callback. The telegram auth handler function processes an attacker-supplied one-time Telegram login tok...

PT-2026-115433

The Mang Board plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content' parameter in all versions up to, and including, 2.4.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts...

PT-2026-115539

Authorization bypass through User-Controlled key vulnerability in SFM Software Technologies Inc. Costifier allows Exploitation of Trusted Identifiers. This issue affects Costifier: through 2026-10-16. NOTE: The vendor was contacted early about this disclosure but did not respond in any way...

PT-2026-115416

The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.2.1 via the 'password' parameter due to missing validation on a user controlled key...

PT-2026-115592

Name of the Vulnerable Software and Affected Versions The Events Calendar versions prior to 6.18.2 Description Stored Cross-site Scripting XSS occurs due to improper neutralization of input during web page generation. This allows an attacker to inject malicious scripts that are stored on the serv...

PT-2026-115391

Name of the Vulnerable Software and Affected Versions Nezha versions 2.1.0 through 2.3.14 Description The mintTransferTool component fails to validate the Host header when constructing fs.download url and fs.upload url transfer URLs. This allows an attacker to control the Host header in a victim'...

PT-2026-116074

🚨 CVE-2026-111675 Course-tencent-cloud through 2.0.1 contains an improper restriction of authentication attempts vulnerability that allows unauthenticated attackers to brute force 6-digit SMS/email verification codes, which are never invalidated or attempt-limited. Attackers who know a victim's...

PT-2026-116101

ChatOllama through commit 96c3ce5 contains an insecure direct object reference vulnerability that allows remote attackers to access other users' private knowledge bases by supplying sequential ids. Attackers can enumerate ids via GET /api/knowledgebases/id or the knowledgebaseId parameter of POST...