418640 matches found
PT-2026-116484
Admidio from 5.0.11 before 5.0.16 contains a broken access control vulnerability in modules/inventory/inventory data.php that allows authenticated users to bypass the inventory module enabled restriction. Attackers with any valid login can request the DataTables JSON feed to read every inventory...
PT-2026-125611
TuxCare rebuilt create-next-app to address 9 CVEs. Fixed in 16.0.6-tuxcare.7...
PT-2026-125606
TuxCare rebuilt create-next-app to address 2 CVEs. Fixed in 12.3.7-tuxcare.8...
PT-2026-125964
TuxCare rebuilt @angular/upgrade to address 1 CVE. Fixed in 16.2.7-tuxcare.1...
PT-2026-116499
Name of the Vulnerable Software and Affected Versions Coder versions 2.0.0 through 2.34.7 Description An open redirect issue exists in the handleAPIKeySmuggling function. Attackers can redirect users to external sites by using unsanitized r.URL.Path values. By crafting links on trusted workspace...
PT-2026-116479
phpMyFAQ before 4.1.9 contains a missing authorization vulnerability in the deleteUser API that allows authenticated non-superadmin users with delete user permission to delete superadmin accounts. Attackers can send a DELETE request to /admin/api/user/delete with a superadmin's userId other than ...
PT-2026-116381
The YMC Filter plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'post title' parameter in all versions up to, and including, 3.12.19 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level...
PT-2026-116481
Name of the Vulnerable Software and Affected Versions phpMyFAQ versions 4.0.0 through 4.1.8 Description An authentication bypass exists during the WebAuthn registration process. The registration endpoints allow credentials to be attached to any account without requiring a valid session or challen...
PT-2026-116356
Name of the Vulnerable Software and Affected Versions WP Booking System – Booking Calendar versions prior to 2.1.0.4 Description Authenticated users with subscriber-level access and above can extract private per-event booking descriptions and booking IDs from any calendar managed by the site. Thi...
PT-2026-116377
Name of the Vulnerable Software and Affected Versions ThirstyAffiliates versions prior to 3.12.1 Description An issue exists in the link redirect tracking handler that fails to verify the status or type of the requested object. This allows unauthenticated attackers to disclose destination URLs of...
PT-2026-116498
Name of the Vulnerable Software and Affected Versions Coder versions 2.26.0 through 2.34.7 Description An incorrect authorization flaw exists where the system only verifies workspace read access before fetching group members using an elevated system context. Authenticated users with workspace use...
PT-2026-116496
Coder from 2.0.0 before 2.34.8 contains an incorrect authorization vulnerability in the acl allow rule of coderd/rbac/policy.rego, which does not verify organization membership for per-user ACL entries, and organization member removal does not scrub those entries. Authenticated users removed from...
PT-2026-117681
CVE ID :CVE-2026-108117 Published : Oct. 17, 2026, 10:19 p.m. | 1 hour, 1 minute ago Description :None Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...
PT-2026-116362
Name of the Vulnerable Software and Affected Versions Tutor LMS versions prior to 4.1.1 Description The Tutor LMS plugin for WordPress contains an Insecure Direct Object Reference IDOR flaw. This occurs because the Input::sanitize array function fails to strip attacker-supplied POST keys, allowin...
PT-2026-117669
Name of the Vulnerable Software and Affected Versions Pillow versions prior to 13.0.0 Description The JPEG decoder in Pillow fails to verify the actual output width and component count after a scaling request is made. When an application uses draft or thumbnail to request downscaling of an 8-bit...
PT-2026-116371
Name of the Vulnerable Software and Affected Versions ACF Frontend Admin by DynamiApps versions prior to 3.29.14 Description The plugin fails to perform a capability check on a form-submission action before writing submitted values into the global ACF options store. This allows unauthenticated...
PT-2026-116453
FreeRDP from 3.14.1 before 3.32.0 contains an integer underflow in the WinPR BMP writer, where a mismatched stride calculation passes SIZE MAX - 3 to Stream Zero for sub-byte images. A malicious RDP clipboard peer can return a crafted 1-bpp BMP processed by clipboard synthesize image format to bm...
PT-2026-116372
Name of the Vulnerable Software and Affected Versions ACF Frontend Admin by DynamiApps versions prior to 3.29.14 Description The plugin fails to restrict the PHP classes that can be instantiated during the deserialization of stored post content rendered on public pages. This allows high-privilege...
PT-2026-116368
Name of the Vulnerable Software and Affected Versions Contact Form 7 Signature Addon versions prior to 4.2.3 Description An issue exists where the plugin fails to sanitize a signature field value used to build an email attachment path. This allows unauthenticated users to perform path traversal—a...
PT-2026-125617
TuxCare rebuilt create-next-app to address 1 CVE. Fixed in 12.3.7-tuxcare.10...
PT-2026-126328
A heap-based buffer overflow can occur when processing a specially crafted FAT32 filesystem due to an integer calculation error during buffer allocation. A local attacker could exploit this by enticing a user or automated service to open a malicious filesystem image, resulting in an application...
PT-2026-126282
TuxCare rebuilt @vitejs/plugin-react to address 11 CVEs. Fixed in 2.9.18-tuxcare.1...
PT-2026-126262
TuxCare rebuilt @angular/upgrade to address 15 CVEs. Fixed in 15.2.9-tuxcare.2...
PT-2026-126183
TuxCare rebuilt @angular/upgrade to address 1 CVE. Fixed in 10.2.5-tuxcare.7...
PT-2026-126233
TuxCare rebuilt @angular/upgrade to address 1 CVE. Fixed in 18.1.2-tuxcare.1...
PT-2026-126189
TuxCare rebuilt @angular/upgrade to address 1 CVE. Fixed in 13.4.0-tuxcare.8...
PT-2026-126284
TuxCare rebuilt @vitejs/plugin-react to address 6 CVEs. Fixed in 3.2.11-tuxcare.1...
PT-2026-126231
TuxCare rebuilt @angular/upgrade to address 1 CVE. Fixed in 18.2.14-tuxcare.5...
PT-2026-126246
TuxCare rebuilt @angular/upgrade to address 3 CVEs. Fixed in 19.2.21-tuxcare.5...
PT-2026-126244
TuxCare rebuilt @angular/upgrade to address 2 CVEs. Fixed in 9.1.13-tuxcare.12...
PT-2026-125614
TuxCare rebuilt create-next-app to address 2 CVEs. Fixed in 13.5.11-tuxcare.16...
PT-2026-126214
TuxCare rebuilt @angular/upgrade to address 2 CVEs. Fixed in 15.2.9-tuxcare.3...
PT-2026-116497
Coder from 2.30.0 before 2.34.8 contains an authorization bypass vulnerability in the provisioner daemon DownloadFile gRPC handler that allows authenticated provisioner daemons to download other organizations' cached Terraform module archives. Attackers with an org-scoped provisioner key and a...
PT-2026-125636
TuxCare rebuilt @next/eslint-plugin-next to address 1 CVE. Fixed in 16.0.6-tuxcare.9...
PT-2026-125633
TuxCare rebuilt @next/eslint-plugin-next to address 13 CVEs. Fixed in 13.5.11-tuxcare.14...
PT-2026-117678
CVE ID :CVE-2026-107274 Published : Oct. 17, 2026, 10:19 p.m. | 1 hour, 1 minute ago Description :None Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...
PT-2026-117680
CVE ID :CVE-2026-107772 Published : Oct. 17, 2026, 10:19 p.m. | 1 hour, 1 minute ago Description :None Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...
PT-2026-116375
Name of the Vulnerable Software and Affected Versions Patreon WordPress versions prior to 1.10.0 Description The plugin fails to validate user-supplied redirect destinations before performing a redirection. This allows unauthenticated attackers to use a crafted link to redirect visitors to an...
PT-2026-116376
Name of the Vulnerable Software and Affected Versions Patreon WordPress versions prior to 1.10.0 Description The plugin fails to verify a nonce a unique token used to prevent replay attacks when connecting the site to a Patreon account. This allows an attacker to use Cross-Site Request Forgery...
PT-2026-116374
Name of the Vulnerable Software and Affected Versions Patreon WordPress plugin versions prior to 1.10.0 Description The plugin fails to perform authorization checks on certain functionalities. This allows unauthenticated users to enumerate the names of terms within any taxonomy, including...
PT-2026-116363
Name of the Vulnerable Software and Affected Versions User Registration & Membership versions prior to 5.2.9 Description Insufficient input sanitization in the referrer url branch of the UR Smart Tags::process function allows unauthenticated attackers to execute arbitrary registered shortcodes. T...
PT-2026-116493
Name of the Vulnerable Software and Affected Versions Fleet versions prior to 4.83.0 Description An issue exists where unauthenticated attackers can cause a denial of service by exhausting server memory. This is achieved by sending small, highly compressed request bodies using the Content-Encodin...
PT-2026-116378
Name of the Vulnerable Software and Affected Versions Rank Math SEO PRO version 3.0.123 Description A supply-chain compromise occurred where a subset of packages distributed between October 15, 2026, and October 16, 2026, contained embedded malware. This issue has been actively exploited in the...
PT-2026-126212
TuxCare rebuilt @angular/upgrade to address 2 CVEs. Fixed in 5.2.7-tuxcare.5...
PT-2026-126210
TuxCare rebuilt @angular/upgrade to address 14 CVEs. Fixed in 8.0.0-tuxcare.3...
PT-2026-126211
TuxCare rebuilt @angular/upgrade to address 1 CVE. Fixed in 13.3.12-tuxcare.3...
PT-2026-125960
TuxCare rebuilt @angular/upgrade to address 1 CVE. Fixed in 10.2.5-tuxcare.4...
PT-2026-125961
TuxCare rebuilt @angular/upgrade to address 1 CVE. Fixed in 11.2.14-tuxcare.4...