PT-2026-67044

The Authora : Easy login with mobile number WordPress plugin before 1.7.7 does not keep its one-time login code confidential, returning the code and a valid verification token in the response of an unauthenticated action, allowing unauthenticated attackers to log in as any user whose registered...

PT-2026-67348

These are all security issues fixed in the php8-8.5.9-1.1 package on the GA media of openSUSE Tumbleweed...

PT-2026-67284

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 3.29.0 Description A null pointer dereference occurs during the cleanup of smartcard device control requests when reader-state decoding fails. An attacker can trigger a process crash by sending malformed smartcard IRP...

PT-2026-67027

The CubeWP Framework plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.1.30 via the 'cubewp get svg content' function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain...

PT-2026-66998

The Bit Form WordPress plugin before 3.1.4 does not sanitise one of its conversational-form display settings before rendering it on the public-facing form, allowing high-privilege users such as administrators, who do not hold the unfiltered html capability on multisite to store JavaScript that...

PT-2026-67078

The Powerkit – Supercharge your WordPress Site plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes in all versions up to, and including, 3.1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, wit...

PT-2026-67277

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 3.29.0 Description The software fails to enforce the RESPONSE SIZE LIMIT when processing HTTP responses using Transfer-Encoding: chunked within the http response recv body function. An attacker controlling a malicious...

PT-2026-67025

The Everest Toolkit WordPress plugin through 1.2.3 does not validate the type of files uploaded during demo-content import the WordPress file-type test is disabled, allowing high-privilege users Administrator by default, including non-super-admin site administrators on multisite to upload...

PT-2026-67574

Name of the Vulnerable Software and Affected Versions Node.js versions 22.x Node.js versions 24.x Node.js versions 26.x Description A flaw in the node:sqlite module allows a stale StatementSyncIterator created via the DatabaseSynccreateTagStore function to continue executing a cached prepared...

PT-2026-67134

Name of the Vulnerable Software and Affected Versions N-able N-central versions prior to 2026.1 Description An authentication bypass issue exists that allows an attacker to gain unauthorized access to administrative accounts by using an alternate path or channel. Recommendations Update N-able...

PT-2026-67066

The HUSKY WordPress plugin before 1.4.1 does not sanitize a stored setting value against directory traversal before concatenating it into a file inclusion path, allowing users with the shop manager capability to cause the inclusion and execution of arbitrary local files, which is then triggered o...

PT-2026-67120

The Pronamic Pay plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 10.1.0 This is due to the maybe update user role function passing an attacker-controlled Gravity Forms field value $lead$feed-user role field id directly into WP User::set role withou...

PT-2026-67039

The Booking for Appointments and Events Calendar WordPress plugin before 2.4.4 does not restrict which fields can be written through its customer import, allowing a user with the Amelia Manager role to modify arbitrary columns of any stored user record by supplying them in the import request...

PT-2026-67129

The Kadence Blocks — Page Builder Toolkit for Gutenberg Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Identity Block Inner Image Content in all versions up to, and including, 3.7.8.1 due to insufficient input sanitization and output escaping. This makes it possible...

PT-2026-67035

The Dynamic Pricing With Discount Rules for WooCommerce WordPress plugin before 5.0.0 does not validate a nonce or user capabilities on one of its AJAX actions and reflects unsanitised user input in the response, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting against...

PT-2026-67026

The Buckaroo Woocommerce Payments Plugin WordPress plugin before 4.9.0 does not perform any capability check or nonce validation on an AJAX action that processes payment capture refunds, allowing any authenticated user, including Subscribers, to trigger refunds against captured orders...

PT-2026-67036

The Podlove Podcast Publisher WordPress plugin before 4.5.3 does not perform nonce validation on some of its administrative create and delete actions, allowing attackers to create rogue records or delete legitimate ones via a forged request CSRF when a logged-in administrator is tricked into...

PT-2026-67576

Name of the Vulnerable Software and Affected Versions Node.js versions 22.x and earlier Node.js versions 24.x and earlier Node.js versions 26.x and earlier Description A flaw in the Node.js HTTP client can lead to request desynchronization in Node.js-based forwarding proxies. This occurs when...

PT-2026-67265

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 3.29.0 Description Weaknesses in TLS certificate identity validation occur within the tls verify certificate, tls match hostname, and x509 utils get dns names functions. The software uses custom Common Name and DNS SA...

PT-2026-67286

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 3.29.0 Description An out-of-bounds read exists in the RDP6 planar RLE bitmap decoder functions planar decompress plane rle and planar decompress plane rle only within libfreerdp/codec/planar.c. The system only perfor...

PT-2026-67272

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 3.29.0 Description A buffer over-disclosure issue exists in the gateway WebSocket transport within the libfreerdp/core/gateway/websocket.c file. The client uses a fixed 1024-byte response stream for Pong replies witho...

PT-2026-67133

Name of the Vulnerable Software and Affected Versions Data::Entropy versions prior to 0.010 Description Remote entropy sources are accessed over plain HTTP, which allows an on-path attacker to substitute the response. This enables the attacker to control the bytes returned by the rand bits and ra...

PT-2026-67270

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 3.29.0 Description A heap out-of-bounds read occurs in the TSMF FFmpeg decoder when parsing AVC1 MPEG2VIDEOINFO media types that have insufficient ExtraData. A remote attacker can trigger a crash by sending malformed...

PT-2026-67052

The YOP Poll WordPress plugin before 7.0.6 does not validate the connection's origin IP address and instead trusts client-controlled forwarding headers when enforcing its per-IP vote restriction, allowing unauthenticated attackers to bypass the vote limit and cast unlimited votes on a public poll...

PT-2026-67323

Name of the Vulnerable Software and Affected Versions ArcadeDB versions prior to 26.7.2 Description Authenticated users can retrieve the arcadedb.ha.clusterToken value in cleartext because the software fails to properly redact the cluster token in the 'GET /api/v1/server' endpoint. An attacker ca...

PT-2026-67325

luci-app-https-dns-proxy contains a stored cross-site scripting vulnerability in the resolver url parameter that allows authenticated users to inject active HTML. When an administrator views the HTTPS DNS Proxy status page, the resolver URL is rendered as raw HTML and executes JavaScript in the...

PT-2026-66997

The Theme Editor plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.1. This is due to missing nonce validation on the ms update AJAX action. This makes it possible for unauthenticated attackers to modify child theme CSS styles via a forged...

PT-2026-67131

The User Access Manager plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.3.15 via the 'uamgetfile' parameter parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain...

PT-2026-67042

The Pixel Tag Manager for WooCommerce WordPress plugin before 2.2.1 does not perform an authorization check on one of its AJAX actions, allowing unauthenticated users to submit forged e-commerce conversion events to the site's configured server-side advertising conversion APIs using the site's...

PT-2026-67282

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 3.29.0 Description The rdpecam camera redirection client contains a divide-by-zero issue. The function ecam dev process start streams request parses a server-controlled CAM MEDIA TYPE DESCRIPTION from a...

PT-2026-67098

The Kali Forms — Contact Form & Drag-and-Drop Builder plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.4.20 via the save data function. This is due to insufficient validation of the 'thisPermalink' field value before it overwrites a trusted...

PT-2026-67010

The Gutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.9.0. This is due to the plugin not properly verifying that a user is authorized to perform an actio...

PT-2026-67252

Name of the Vulnerable Software and Affected Versions libheif versions prior to 1.23.1 Description A flaw exists in the HEIF and AVIF file format decoder and encoder where a specially crafted file containing a clean aperture box can cause an image dimension to be reduced to zero. This occurs when...

PT-2026-67075

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Path Traversal Zip Slip in all versions up to, and including, 6.0.13 via the extract zip file function. This makes it possible for authenticated attackers, with custom-level access and above, to...

PT-2026-67194

Name of the Vulnerable Software and Affected Versions Zephyr affected versions not specified Description Zephyr's Bluetooth host incorrectly handles security permission checks when sending notifications or indications. When a Characteristic Declaration attribute is used, the host evaluates the...

PT-2026-67086

The Icegram Mailer plugin for WordPress is vulnerable to SQL Injection via the 'fields' parameter in versions up to, and including, 1.0.12. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query in the Icegram Mailer Logs...

PT-2026-67038

The Fluent Support WordPress plugin before 2.3.1 does not perform a per-ticket access check before reassigning a ticket's customer, allowing a restricted support agent to change the assigned customer of any ticket in the system, including tickets outside their granted scope...

PT-2026-67058

The MailChimp Subscribe Form, Optin Builder, PopUp Builder, Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Form Field Values in all versions up to, and including, 4.3.3 due to insufficient input sanitization and output escaping. This makes it possible for...

PT-2026-67224

Name of the Vulnerable Software and Affected Versions ueberauth guardian versions 2.0.0 through 2.4.0 Description An allocation of resources without limits or throttling in the Guardian.Permissions module allows a denial of service via BEAM atom-table exhaustion. The Guardian.Permissions mixin...

PT-2026-67049

The Event Tickets and Registration WordPress plugin before 5.29.0.1 does not properly verify authorization on some of its seating actions, allowing users with contributor-level access and above to overwrite the seating layout, ticket inventory, and attendee seat assignments of events they do not...

PT-2026-67033

The Participants Database WordPress plugin before 2.7.8.4 does not properly sanitize and escape a user-supplied parameter before using it in a SQL query, allowing unauthenticated attackers to perform SQL injection attacks...

PT-2026-67128

The PixelYourSite – Your smart PIXEL TAG & API Manager plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 11.2.1 via the getWooPurchaseEventParams. This makes it possible for unauthenticated attackers to extract WooCommerce purchase metadata...

PT-2026-67289

Name of the Vulnerable Software and Affected Versions Traefik versions 3.7.0 through 3.7.7 Description A path traversal issue exists in the Kubernetes Ingress NGINX provider's RewriteTarget middleware, which is generated from the nginx.ingress.kubernetes.io/rewrite-target annotation. When an...

PT-2026-67015

The wpForo Forum WordPress plugin before 3.1.2 does not sanitize and escape a user profile field before outputting it inside an HTML attribute on the public participant profile page, allowing users with a subscriber-level account to inject JavaScript that executes in the browser of any visitor wh...

PT-2026-67005

The RealHomes Memberships plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.0.9. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with...

PT-2026-67271

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 3.29.0 Description A heap out-of-bounds read exists in the update process glyph fragments and glyph cache fragment put functions within libfreerdp/cache/glyph.c. The issue occurs during the handling of a GLYPH FRAGMEN...

PT-2026-66892

The Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.9.0 via the processAttachment function. This makes it possible for unauthenticated attackers to read the...

PT-2026-66996

The WooCommerce PayPal Payments plugin for WordPress is vulnerable to Sensitive Information Disclosure due to an Insecure Direct Object Reference in all versions up to, and including, 3.3.2 via the enqueue paypal insights script on order received function due to missing validation on a user...

PT-2026-66894

The Subscriptions for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 2.0.0. This is due to the save meta boxes function persisting the wps plan user role membership plan meta from $ POST without an allowlist that excludes privileged roles ...

PT-2026-67287

Name of the Vulnerable Software and Affected Versions Wazuh versions 5.0.0-beta1 through 5.0.0-beta2 Description The software fails to validate or override the cluster name and cluster node fields in inventory-sync Start FlatBuffer messages, validating only the agentid against the authenticated...