PT-2026-67004

Zephyr's Bluetooth Mesh subnet key management leaks one PSA Crypto key slot on every subnet-key teardown. In subsys/bluetooth/mesh/subnet.c, net keys create imports the Private Beacon Key into a PSA key slot under CONFIG BT MESH PRIV BEACONS enabled by default, but subnet keys destroy guarded the...

PT-2026-67007

The OCPP 1.6 client in subsys/net/lib/ocpp parsed inbound WAMP RPC frames in parse rpc msg subsys/net/lib/ocpp/ocpp j.c using a hand-rolled helper, extract string field, that copied the message's uid and action fields with strncpyout buf, token + 1, outlen - 1 and then scanned the result with...

PT-2026-67012

The Exclusive Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘ exad infobox image’ parameter in all versions up to, and including, 2.7.9.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers...

PT-2026-67006

The Spectra Legacy WordPress plugin before 2.20.0 does not validate or escape several block style attributes before using them to build the CSS it outputs on the front end, allowing users with the Contributor role and above to inject arbitrary CSS into the pages that render the affected block. Th...

PT-2026-67034

The Pixelavo WordPress plugin before 1.5.4 registers an unauthenticated AJAX action, gated only by a nonce that it emits publicly on every front-end page, that forwards client-supplied event data to the configured Facebook Conversions API using the administrator's stored access token. This allows...

PT-2026-67308

Name of the Vulnerable Software and Affected Versions @better-auth/sso versions prior to 1.6.21 Description Multiple authentication bypass issues exist in the handling of SSO providers, allowing attackers to sign in as arbitrary users. This can be achieved through domain verification parsing...

PT-2026-67290

Name of the Vulnerable Software and Affected Versions OpenRemote versions prior to 1.27.0 Description An insecure direct object reference exists in the setAssetLinks endpoint of AlarmResourceImpl. The realm access check only validates a single realm retrieved via realms.stream.findFirst from a...

PT-2026-67070

The Admin Columns for ACF Fields WordPress plugin through 0.3.2 does not escape Advanced Custom Fields values before outputting them in the WordPress admin list-table columns, allowing users with contributor-level access or above to store a payload that executes as JavaScript in the session of...

PT-2026-67288

Wazuh workflows before 44bf114 contain a shell injection vulnerability in GitHub Actions that allows attackers to execute arbitrary commands by submitting pull requests with crafted VERSION.json files. Attackers can inject shell metacharacters into environment variables that are directly...

PT-2026-66895

The SureForms – Contact Form, Payment Form & Other Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'headingWrapper' parameter in all versions up to, and including, 2.8.1 due to insufficient input sanitization and output escaping. This makes it possibl...

PT-2026-67057

The Database Collation Fix plugin for WordPress is vulnerable to time-based SQL Injection via the 'force-collation-algorithm' parameter in all versions up to, and including, 1.2.10 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...

PT-2026-67223

Name of the Vulnerable Software and Affected Versions ueberauth guardian versions 2.0.0 through 2.4.0 Description An allocation of resources without limits or throttling allows a denial of service via unbounded atom creation from attacker-controlled binary input. The...

PT-2026-67088

The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.6.5 This is due to missing or incorrect nonce validation on the reauth for authorize function. This makes it possible for...

PT-2026-67127

The Payment forms, Buy now buttons, and Invoicing System | GetPaid plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.8.56 via the getpaid payment form element function. This makes it possible for authenticated attackers, with administrator-level...

PT-2026-67342

The WooCommerce - Social Login plugin for WordPress is vulnerable to Authentication Bypass in all versions up to and including 2.8.7. This is due to the plugin's Apple login handler accepting the Apple id token and decoding only its base64 payload without verifying the JWT signature against Apple...

PT-2026-67125

The Advanced Views – Display Custom Fields ACF, Pods, MetaBox, Posts, CPT and Woo Products anywhere in Gutenberg, Elementor, Divi, Beaver… plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.9.1 via the register rest routes. This makes it...

PT-2026-67254

Name of the Vulnerable Software and Affected Versions libheif versions prior to 1.23.1 Description A crafted HEIF sequence processed by the heif context read from memory function can result in a context with no registered sequence tracks. This leads to a crash when the heif context get trackctx, ...

PT-2026-67077

The Powerkit – Supercharge your WordPress Site plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'nav' Shortcode Attribute in all versions up to, and including, 3.1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers...

PT-2026-67132

The Kadence Blocks — Page Builder Toolkit for Gutenberg Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'toggleIcon' Block Attribute in all versions up to, and including, 3.7.8 due to insufficient input sanitization and output escaping. This makes it possible for...

PT-2026-67261

The CubeWP Framework plugin for WordPress is vulnerable to SQL Injection in all versions up to and including 1.1.30. This is due to insufficient input sanitization in the cubewp remove relation AJAX function, specifically the use of wp unslash on the relation id parameter before interpolating it...

PT-2026-67080

These are all security issues fixed in the python313-huggingface-hub-1.26.0-1.1 package on the GA media of openSUSE Tumbleweed...

PT-2026-67283

Content removed...

PT-2026-67051

The Mapster WP Maps WordPress plugin before 1.24.0 does not perform any authorization or post-status check on a public REST endpoint, allowing unauthenticated users to retrieve the title and full content of any post regardless of its status, including unpublished draft, pending, private, and...

PT-2026-67096

The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'heading size' Shortcode Attribute in 'gamipress achievement' in all versions up to, and including, 7.9.9.1 due to insufficient inp...

PT-2026-67122

The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'icon' Shortcode Attribute in all versions up to, and including, 3.3.66 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level...

PT-2026-67577

Name of the Vulnerable Software and Affected Versions Node.js versions 22.x Node.js versions 24.x Node.js versions 26.x Description A flaw in the synchronous node:zlib APIs allows a spoofed byteLength of a TypedArray to trigger a reachable assertion, leading to a process crash. This issue affects...

PT-2026-67575

Name of the Vulnerable Software and Affected Versions Node.js versions 22.x Node.js versions 24.x Node.js versions 26.x Description A flaw exists where the dns.resolveAny function causes the Node.js process to abort when a DNS response contains more than 256 A records. Repeatedly triggering this...

PT-2026-67278

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 3.29.0 Description A heap buffer overflow exists in the server-side RAIL channel handler. The issue occurs within the rail server handle messages function in channels/rail/server/rail main.c when processing a RAIL PDU...

PT-2026-67281

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 3.29.0 Description An out-of-bounds read exists in the async update message proxy for the PolygonSC and PolygonCB primary drawing orders. When the AsyncUpdate feature is enabled, the functions update message PolygonSC...

PT-2026-67264

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 3.29.0 Description An out-of-bounds heap read occurs in the UVC H.264 extension-unit parser when the system fails to validate the descriptor length before accessing the GUID field. A local attacker using a malicious U...

PT-2026-67280

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 3.29.0 Description A client-side heap use-after-free issue exists in the async update message proxy for RAIL WINDOW STATE ORDER and NOTIFY ICON STATE ORDER when AsyncUpdate is enabled. A malicious or compromised RDP...

PT-2026-67273

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 3.29.0 Description An improper certificate hostname validation issue exists where the TLS hostname matcher tls match hostname in libfreerdp/crypto/tls.c incorrectly handles wildcard patterns. Specifically, a pattern...

PT-2026-67274

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 3.29.0 Description Improper validation of the Extended Key Usage EKU purpose occurs during client-side server TLS authentication. Within the x509 utils verify function, if the server-purpose X509 PURPOSE SSL SERVER...

PT-2026-67030

The GenerateBlocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Dynamic Tag Injection in HTML Attributes in all versions up to, and including, 2.3.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

PT-2026-67040

The Download Manager WordPress plugin before 3.3.66 does not properly escape a package's title before outputting it in the front-end package templates, allowing users with the Author role or above to store a title that results in arbitrary JavaScript execution in the browser of any user, includin...

PT-2026-67050

The Login & Register Forms WordPress plugin before 3.2.5 does not properly enforce the rate limit on its password-reset verification-code flow, keying both the verification code and the per-source attempt counter on an unauthenticated, client-controlled value, allowing unauthenticated attackers t...

PT-2026-67275

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 3.29.0 Description Insufficient validation of server-supplied RDPDR paths during drive redirection allows a malicious RDP server to access prefix-sibling paths outside the configured shared root. By sending non-rooted...

PT-2026-67310

@better-auth/scim a better-auth plugin versions = 1.4.0-beta.27 through = 1.7.0-beta.0 through = 1.7.0-beta.9 contain an authorization bypass. SCIM token issuance did not reject provider IDs already used by existing SSO, SAML, OIDC, generic OAuth, or social account providers, and the same logical...

PT-2026-67083

The Support Genix WordPress plugin before 1.4.48 does not prevent directory traversal in its ticket-attachment download route, allowing unauthenticated attackers to read arbitrary files with an allowlisted extension — including other users' private ticket attachments — from the server...

PT-2026-67130

The Wp Responsive Thumbnail Slider plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'id' parameter in versions up to, and excluding, 1.1.53. This is due to insufficient input sanitization and output escaping in the responsive thumbnail image management function, which...

PT-2026-67123

The WPvivid Backup & Migration plugin for WordPress is vulnerable to SQL Injection via the export data parameter in versions up to, and including, 0.9.131. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. The values...

PT-2026-66893

The Pinpoint Booking System – Version 2 plugin for WordPress is vulnerable to blind SQL Injection via the 'field' parameter in all versions up to, and including, 2.9.9.6.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. Thi...

PT-2026-67085

The Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 600+ Patterns, 58 Blocks & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'layoutCircle.alignment' Block Attribute in all versions up to, and including, 2.2.11 due to insufficient input sanitization an...

PT-2026-67009

The Builderall for WordPress plugin before 3.0.2 does not bind the state value of its public OAuth authentication routes to the initiating user session, allowing unauthenticated attackers to complete the connection flow and overwrite the stored third-party integration access token. A durable...

PT-2026-67124

The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'param' in all versions up to, and including, 6.2.8 due to insufficient input sanitization and output escaping. This makes it possibl...

PT-2026-67079

The Advanced Woo Labels – Product Labels & Badges for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'bg color' parameter in all versions up to, and including, 2.48 due to insufficient input sanitization and output escaping. This makes it possible for...

PT-2026-67048

The Event Tickets and Registration WordPress plugin before 5.29.0.1 does not perform any authorization check on one of its order-management REST endpoints, allowing unauthenticated users to change the status of existing orders...

PT-2026-67121

The Easy Property Listings plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'facebook' User Contact Method in all versions up to, and including, 3.5.24 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

PT-2026-67024

The Demo Import WordPress plugin through 1.1.3 does not validate the type of files uploaded during demo-content import the WordPress file-type test is disabled, allowing high-privilege users Administrator by default, including non-super-admin site administrators on multisite to upload executable...

PT-2026-67037

The Brizy WordPress plugin before 2.8.18 does not properly verify authorization on a request handler before returning post content, allowing users with the Contributor role or higher to read the content of arbitrary posts, including other users' private, pending, and draft posts...