PT-2026-67325

luci-app-https-dns-proxy contains a stored cross-site scripting vulnerability in the resolver url parameter that allows authenticated users to inject active HTML. When an administrator views the HTTPS DNS Proxy status page, the resolver URL is rendered as raw HTML and executes JavaScript in the...

PT-2026-66997

The Theme Editor plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.1. This is due to missing nonce validation on the ms update AJAX action. This makes it possible for unauthenticated attackers to modify child theme CSS styles via a forged...

PT-2026-67042

The Pixel Tag Manager for WooCommerce WordPress plugin before 2.2.1 does not perform an authorization check on one of its AJAX actions, allowing unauthenticated users to submit forged e-commerce conversion events to the site's configured server-side advertising conversion APIs using the site's...

PT-2026-66998

The Bit Form WordPress plugin before 3.1.4 does not sanitise one of its conversational-form display settings before rendering it on the public-facing form, allowing high-privilege users such as administrators, who do not hold the unfiltered html capability on multisite to store JavaScript that...

PT-2026-67323

Name of the Vulnerable Software and Affected Versions ArcadeDB versions prior to 26.7.2 Description Authenticated users can retrieve the arcadedb.ha.clusterToken value in cleartext because the software fails to properly redact the cluster token in the 'GET /api/v1/server' endpoint. An attacker ca...

PT-2026-67282

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 3.29.0 Description The rdpecam camera redirection client contains a divide-by-zero issue. The function ecam dev process start streams request parses a server-controlled CAM MEDIA TYPE DESCRIPTION from a...

PT-2026-67123

The WPvivid Backup & Migration plugin for WordPress is vulnerable to SQL Injection via the export data parameter in versions up to, and including, 0.9.131. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. The values...

PT-2026-67036

The Podlove Podcast Publisher WordPress plugin before 4.5.3 does not perform nonce validation on some of its administrative create and delete actions, allowing attackers to create rogue records or delete legitimate ones via a forged request CSRF when a logged-in administrator is tricked into...

PT-2026-67131

The User Access Manager plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.3.15 via the 'uamgetfile' parameter parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain...

PT-2026-67252

Name of the Vulnerable Software and Affected Versions libheif versions prior to 1.23.1 Description A flaw exists in the HEIF and AVIF file format decoder and encoder where a specially crafted file containing a clean aperture box can cause an image dimension to be reduced to zero. This occurs when...

PT-2026-67196

The Jeg Kit for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.1.1 via the enqueue scripts method in class/dashboard/class-dashboard.php. The plugin injects a JkitDashboardOption JavaScript object containing full plugin...

PT-2026-67253

Name of the Vulnerable Software and Affected Versions libheif versions 1.19.0 through 1.23.0 Description A flaw exists in the way uncompressed HEIF images using generic zlib unci full-item compression are handled. When an application decodes an advertised tile using the heif image handle decode...

PT-2026-67276

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 3.29.0 Description A denial of service issue exists in the RDPEI server channel handler. The component fails to validate the maximum PDU Protocol Data Unit body length before allocating the stream. A malicious RDP...

PT-2026-67076

The Powerkit – Supercharge your WordPress Site plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'style' Shortcode Attribute in all versions up to, and including, 3.1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

PT-2026-67071

The User Profile Builder WordPress plugin before 3.16.4 does not correctly bind the automatic login performed after user registration to the newly created account, allowing unauthenticated attackers to obtain an authenticated session for an arbitrary existing user, including administrators, on...

PT-2026-67291

Name of the Vulnerable Software and Affected Versions Budibase versions prior to 3.38.1 Description A server-side request forgery SSRF issue exists in the REST datasource integration. The system fails to validate HTTP redirects against the IP blacklist, allowing users with the Builder role to...

PT-2026-67045

The DynamicKit for Elementor WordPress plugin before 1.0.3 does not validate the host of a user-supplied URL used as the base of the password-reset link it emails, allowing unauthenticated attackers to send a target user a legitimately-formatted reset email whose link points to an...

PT-2026-67324

Name of the Vulnerable Software and Affected Versions ArcadeDB versions prior to 26.7.2 Description An issue exists where the system fails to enforce the UPDATE SCHEMA database permission during ALTER TYPE ... CUSTOM and ALTER TYPE ... BUCKETSELECTIONSTRATEGY SQL operations. These operations map ...

PT-2026-67225

Name of the Vulnerable Software and Affected Versions ueberauth guardian versions 1.0.0 through 2.4.0 Description Improper verification of cryptographic signatures allows an unauthenticated attacker to revoke a victim's session using a forged token. The Guardian.revoke/3 function in lib/guardian....

PT-2026-67194

Name of the Vulnerable Software and Affected Versions Zephyr affected versions not specified Description Zephyr's Bluetooth host incorrectly handles security permission checks when sending notifications or indications. When a Characteristic Declaration attribute is used, the host evaluates the...

PT-2026-67086

The Icegram Mailer plugin for WordPress is vulnerable to SQL Injection via the 'fields' parameter in versions up to, and including, 1.0.12. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query in the Icegram Mailer Logs...

PT-2026-67038

The Fluent Support WordPress plugin before 2.3.1 does not perform a per-ticket access check before reassigning a ticket's customer, allowing a restricted support agent to change the assigned customer of any ticket in the system, including tickets outside their granted scope...

PT-2026-67058

The MailChimp Subscribe Form, Optin Builder, PopUp Builder, Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Form Field Values in all versions up to, and including, 4.3.3 due to insufficient input sanitization and output escaping. This makes it possible for...

PT-2026-67033

The Participants Database WordPress plugin before 2.7.8.4 does not properly sanitize and escape a user-supplied parameter before using it in a SQL query, allowing unauthenticated attackers to perform SQL injection attacks...

PT-2026-67289

Name of the Vulnerable Software and Affected Versions Traefik versions 3.7.0 through 3.7.7 Description A path traversal issue exists in the Kubernetes Ingress NGINX provider's RewriteTarget middleware, which is generated from the nginx.ingress.kubernetes.io/rewrite-target annotation. When an...

PT-2026-67015

The wpForo Forum WordPress plugin before 3.1.2 does not sanitize and escape a user profile field before outputting it inside an HTML attribute on the public participant profile page, allowing users with a subscriber-level account to inject JavaScript that executes in the browser of any visitor wh...

PT-2026-67271

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 3.29.0 Description A heap out-of-bounds read exists in the update process glyph fragments and glyph cache fragment put functions within libfreerdp/cache/glyph.c. The issue occurs during the handling of a GLYPH FRAGMEN...

PT-2026-66892

The Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.9.0 via the processAttachment function. This makes it possible for unauthenticated attackers to read the...

PT-2026-66996

The WooCommerce PayPal Payments plugin for WordPress is vulnerable to Sensitive Information Disclosure due to an Insecure Direct Object Reference in all versions up to, and including, 3.3.2 via the enqueue paypal insights script on order received function due to missing validation on a user...

PT-2026-66894

The Subscriptions for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 2.0.0. This is due to the save meta boxes function persisting the wps plan user role membership plan meta from $ POST without an allowlist that excludes privileged roles ...

PT-2026-67119

The GSheetConnector – CF7 Google Sheets Connector with Real-Time Sync plugin for WordPress is vulnerable to generic SQL Injection via the 's' parameter in all versions up to, and including, 5.2.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the...

PT-2026-67268

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 3.29.0 Description A null pointer dereference occurs in smartcard cache request decoders when they accept NULL NDR pointers for LookupName during SCARD IOCTL READCACHEA and SCARD IOCTL WRITECACHEA operations. If...

PT-2026-67128

The PixelYourSite – Your smart PIXEL TAG & API Manager plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 11.2.1 via the getWooPurchaseEventParams. This makes it possible for unauthenticated attackers to extract WooCommerce purchase metadata...

PT-2026-67285

Name of the Vulnerable Software and Affected Versions FreeRDP Windows client versions prior to 3.29.0 Description A heap buffer overflow occurs in the clipboard virtual channel when processing CLIPRDR FILE CONTENTS RESPONSE PDUs Protocol Data Units because the server-provided size is not validate...

PT-2026-67221

Name of the Vulnerable Software and Affected Versions ueberauth guardian versions 0.1.0 through 2.4.0 Description An allocation of resources without limits or throttling allows a denial of service via unbounded atom creation from attacker-influenced binary input. The Guardian.Plug.Keys module...

PT-2026-67095

The Icegram Engage – Popups, Optins, CTAs & Lead Generation plugin for WordPress is vulnerable to second-order SQL Injection via 'messagesid' Parameter in all versions up to, and including, 3.1.42 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on th...

PT-2026-67074

The Nex Forms – Ultimate Form Builder – Lite plugin for WordPress is vulnerable to arbitrary file deletion via path traversal in versions up to, and including, 9.2.3. This is due to the delete file AJAX handler retrieving a file path from the database and passing it directly to unlink with no...

PT-2026-67097

The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'gamipress rank' Shortcode in all versions up to, and including, 7.9.9.1 due to insufficient input sanitization and output...

PT-2026-67063

The Codeless Page Builder WordPress plugin through 1.1.4 does not sanitize or validate a shortcode attribute before using it as an HTML tag name when rendering content, allowing users with contributor-level access and above to inject arbitrary HTML and JavaScript that executes in the session of a...

PT-2026-67222

These are all security issues fixed in the python313-asteval-1.0.9-1.1 package on the GA media of openSUSE Tumbleweed...

PT-2026-67041

The Chat On Desk Order Notifications WordPress plugin before 1.0.9 does not verify that the one-time password has been validated before processing a password-reset request, allowing unauthenticated attackers to reset the password of arbitrary users, including administrators, and take over their...

PT-2026-66891

The SendPulse Email Marketing Newsletter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via sp form code Post Meta in all versions up to, and including, 2.2.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

PT-2026-67287

Name of the Vulnerable Software and Affected Versions Wazuh versions 5.0.0-beta1 through 5.0.0-beta2 Description The software fails to validate or override the cluster name and cluster node fields in inventory-sync Start FlatBuffer messages, validating only the agentid against the authenticated...

PT-2026-67010

The Gutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.9.0. This is due to the plugin not properly verifying that a user is authorized to perform an actio...

PT-2026-67224

Name of the Vulnerable Software and Affected Versions ueberauth guardian versions 2.0.0 through 2.4.0 Description An allocation of resources without limits or throttling in the Guardian.Permissions module allows a denial of service via BEAM atom-table exhaustion. The Guardian.Permissions mixin...

PT-2026-67075

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Path Traversal Zip Slip in all versions up to, and including, 6.0.13 via the extract zip file function. This makes it possible for authenticated attackers, with custom-level access and above, to...

PT-2026-67049

The Event Tickets and Registration WordPress plugin before 5.29.0.1 does not properly verify authorization on some of its seating actions, allowing users with contributor-level access and above to overwrite the seating layout, ticket inventory, and attendee seat assignments of events they do not...

PT-2026-67005

The RealHomes Memberships plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.0.9. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with...

PT-2026-67098

The Kali Forms — Contact Form & Drag-and-Drop Builder plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.4.20 via the save data function. This is due to insufficient validation of the 'thisPermalink' field value before it overwrites a trusted...

PT-2026-67003

Name of the Vulnerable Software and Affected Versions affected versions not specified Description The DHCPv4 client helper function net dhcpv4 msg type name in subsys/net/lib/dhcpv4/dhcpv4.c contains a faulty bounds check when indexing a static 8-element name table. The check incorrectly uses...