PT-2026-122506

The GeoDirectory WordPress plugin before 2.8.194 does not sanitise and escape some of its map shortcode attributes before outputting them within a style attribute, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks that execute in the context of any...

PT-2026-122518

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Tribulant Software Newsletters newsletters-lite allows SQL Injection.This issue affects Newsletters: from n/a through 4.18.1...

PT-2026-122532

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Igor Funa Ad Inserter ad-inserter allows Reflected XSS.This issue affects Ad Inserter: from n/a through 2.8.18...

PT-2026-122664

A vulnerability was identified in FaveoSuite Faveo Helpdesk 2.0.3. Affected by this issue is the function ForgotPasswordController::sendResetLinkEmail/PasswordController::reset of the file app/Http/Controllers/Auth/ForgotPasswordController.php. The manipulation leads to weak password recovery. Th...

PT-2026-122656

A vulnerability was found in Travisun Opptrix 0.4.0. Affected is the function Buffer.concat of the file /api/channels/webhook/ of the component preParsing handler. Performing a manipulation results in denial of service. The attack can be initiated remotely. The exploit has been made public and...

PT-2026-122521

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Noah Hearle We’re Open! opening-hours allows Reflected XSS.This issue affects We’re Open!: from n/a through 2.6...

PT-2026-122590

Camaleon CMS before 2.9.3 contains a path traversal vulnerability that allows users with only the media permission to write arbitrary files by supplying ../ sequences in the name parameter. Attackers can send a base64 data: URI to the crop url media action to write an ERB template into a theme's...

PT-2026-122501

The Download Monitor WordPress plugin before 5.3.4 does not properly validate that a clicked link belongs to the site before fetching it client-side and rendering part of the response in the page, which allows unauthenticated attackers to execute arbitrary JavaScript in the browser of any user wh...

PT-2026-122587

This week's Wordfence report is straight-up brutal. 497 plugins and themes got hit with vulnerabilities and there's no patch for 69 of them. And I'm seeing people in threads saying "just deactivate it for now" — nah, that's not how this works and it's gonna get someone wrecked. Here's the deal...

PT-2026-122524

Insertion of Sensitive Information Into Sent Data vulnerability in Hai Zheng / Lite Speed Cache LiteSpeed Cache litespeed-cache allows Retrieve Embedded Sensitive Data.This issue affects LiteSpeed Cache: from n/a through 7.9...

PT-2026-122517

Missing Authorization vulnerability in Brainstorm Force SureDash suredash allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SureDash: from n/a through 1.12.2...

PT-2026-122409

MongoDB Compass relies on Electron, a third-party runtime that carries its own TLS root certificate store. This root certificate store has the recoverable eMudhra intermediate CA certificates. Issue is resolved by updating to Compass 1.53.1, which includes Electron 44.9.1...

PT-2026-122608

Python has added a denylist for known compromised certificates to the "ssl" module to ensure user safety even without certificate revocation configured. Known compromised certificates will automatically be rejected regardless of the SSLContext policy configuration...

PT-2026-122610

A flaw has been found in Travisun Opptrix 0.4.0. This affects an unknown function of the file /api/auth/setup of the component Schedule API. This manipulation causes command injection. It is possible to initiate the attack remotely. The exploit has been published and may be used. The project has...

PT-2026-122571

This week's Wordfence report is straight-up brutal. 497 plugins and themes got hit with vulnerabilities and there's no patch for 69 of them. And I'm seeing people in threads saying "just deactivate it for now" — nah, that's not how this works and it's gonna get someone wrecked. Here's the deal...

PT-2026-122531

Stored XSS vulnerability in the “Notes” field of the Checklists in Cervantes version v1.3-beta could allow an attacker to execute arbitrary code in another user's browser with elevated privileges...

PT-2026-122611

A vulnerability has been found in Travisun Opptrix 0.4.0. This impacts an unknown function of the file /api/system-update/import of the component Import Endpoint. Such manipulation leads to code injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public...

PT-2026-122668

A security vulnerability has been detected in Unitree Robotics Unitree Go2 up to 1.1.11.4. The impacted element is the function set volume of the file gpt thread.py of the component chat go. Such manipulation of the argument Value leads to os command injection. The attack can be launched remotely...

PT-2026-122602

UPDATE 🚨 How to identify eMudhra Certificates With @qualys CVE-2026-111943 and CVE-2026-111944 cybersecurity https://t.co/3FKbfBYkQK...

PT-2026-122509

Name of the Vulnerable Software and Affected Versions WPVR WordPress plugin versions prior to 9.0.3 Description Insufficient sanitization and escaping of tour hotspot content before storage and front-end output allows users with the Contributor role and above to perform Stored Cross-Site Scriptin...

PT-2026-122503

The GeoDirectory WordPress plugin before 2.8.194 does not perform any status or ownership check when rendering a listing's map-popup through one of its single-item REST routes, allowing unauthenticated users to read the title, permalink and card fields of non-public draft, pending, private and...

PT-2026-122514

A weakness has been identified in InternScience InternAgent 1.5.0. This affects the function train of the file tasks/AutoChem/code/experiment.py of the component LoRA Loading. This manipulation of the argument base model name or path causes inclusion of functionality from untrusted control sphere...

PT-2026-122511

The News Kit Addons For Elementor WordPress plugin before 1.4.9 does not perform a capability check on one of its AJAX actions, allowing authenticated users with subscriber-level access and above to install and activate a specific News Kit Addons For Elementor WordPress plugin before 1.4.9 from t...

PT-2026-122588

The aBlocks – Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & Animation Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.17.0 via the /ablocks/v1/form-builder/registration REST endpoint. The vulnerability exists...

PT-2026-122670

A flaw has been found in pig-mesh pig up to 4.1.0. This impacts the function orderItem.getColumn of the file pig-common/pig-common-data/src/main/java/com/pig4cloud/pig/common/data/resolver/SqlFilterArgumentResolver.java. Executing a manipulation of the argument ascs/descs can lead to sql injectio...

PT-2026-122669

A vulnerability was detected in Unitree Robotics Unitree Go2 up to 1.1.13/1.1.14.1/1.1.15.1. This affects the function WebSocketClient.connect of the file websocket.py of the component chat go. Performing a manipulation results in improper certificate validation. The attack may be initiated...

PT-2026-122666

A security vulnerability has been detected in phpIPAM up to 1.8.3. Affected by this vulnerability is an unknown functionality of the file upgrade/index.php. Such manipulation of the argument REQUEST URI leads to cross site scripting. The attack may be launched remotely. The exploit has been...

PT-2026-122667

A vulnerability was detected in phpIPAM up to 1.8.3. Affected by this issue is the function create rack link of the file app/tools/racks/show-rack-popup.php of the component Rack Link Creation. Performing a manipulation of the argument deviceid results in cross site scripting. Remote exploitation...

PT-2026-122525

Deserialization of Untrusted Data vulnerability in paytiumsupport Paytium paytium allows Object Injection.This issue affects Paytium: from n/a through 5.0.5...

PT-2026-122502

The GeoDirectory WordPress plugin before 2.8.194 does not verify that a referenced attachment belongs to the listing being saved, allowing users with Subscriber-level access and above to modify the title, caption, moderation status and featured flag of images belonging to other users' listings, a...

PT-2026-122579

This week's Wordfence report is straight-up brutal. 497 plugins and themes got hit with vulnerabilities and there's no patch for 69 of them. And I'm seeing people in threads saying "just deactivate it for now" — nah, that's not how this works and it's gonna get someone wrecked. Here's the deal...

PT-2026-122607

Deserialization of Untrusted Data vulnerability in Christoph Vielgrader Relevanssi relevanssi allows Object Injection.This issue affects Relevanssi : from n/a through 4.28.4...

PT-2026-122598

Xiaozhi-esp32-server before 0.9.8 contains an insecure direct object reference vulnerability in the manager-api DeviceController.getAddressBook handler that allows authenticated users to read other users' device address books. Attackers with a normal or self-registered account can request...

PT-2026-122585

This week's Wordfence report is straight-up brutal. 497 plugins and themes got hit with vulnerabilities and there's no patch for 69 of them. And I'm seeing people in threads saying "just deactivate it for now" — nah, that's not how this works and it's gonna get someone wrecked. Here's the deal...

PT-2026-122583

This week's Wordfence report is straight-up brutal. 497 plugins and themes got hit with vulnerabilities and there's no patch for 69 of them. And I'm seeing people in threads saying "just deactivate it for now" — nah, that's not how this works and it's gonna get someone wrecked. Here's the deal...

PT-2026-122601

BookStack before 26.09.2 contains an incorrect authorization vulnerability in AttachmentController that allows authenticated users to access other users' draft page attachments by ID. Attackers with attachment permissions can enumerate sequential attachment IDs to download, rename, relink, or...

PT-2026-122495

Name of the Vulnerable Software and Affected Versions Prime Mover versions prior to 2.2.2 Description An unauthenticated attacker can perform PHP Object Injection by submitting a crafted, base64-encoded serialized object through the standard comment-submission endpoint 'wp-comments-post.php', whi...

PT-2026-122533

BOLA Allows Cross-Project Target Tampering in Cervantes version v1.3-beta could allow an attacker modify or delete targets belonging to other projects without authorization, compromising the integrity of penetration testing scopes, results, and associated security reports...

PT-2026-122605

Missing Authorization vulnerability in Knit Pay UPI QR Code Payment Gateway for WooCommerce upi-qr-code-payment-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects UPI QR Code Payment Gateway for WooCommerce: from n/a through 1.6.3...

PT-2026-122499

The MAS Videos WordPress plugin through 1.3.4 does not perform any capability or ownership check when handling its front-end video and playlist deletion requests, and the nonce it verifies is tied only to a static action rather than to the targeted object, allowing any authenticated user with a...

PT-2026-122574

This week's Wordfence report is straight-up brutal. 497 plugins and themes got hit with vulnerabilities and there's no patch for 69 of them. And I'm seeing people in threads saying "just deactivate it for now" — nah, that's not how this works and it's gonna get someone wrecked. Here's the deal...

PT-2026-122513

BigFix Platform uses Mozilla CA certificate bundle PEM. Versions of the bundle dated before 2026/10/20 still trust certificates whose private keys have been compromised. When BigFix Platform validates servers using such a bundle, an on-path attacker can impersonate remote servers and tamper with...

PT-2026-122497

The Pixel Tag Manager for WooCommerce WordPress plugin before 2.2.3 does not perform a capability check in one of its AJAX actions, and exposes the nonce protecting it to any user able to access the admin dashboard, allowing users with a role as low as Contributor to overwrite the Pixel Tag Manag...

PT-2026-122498

The Advanced Twenty Seventeen WordPress plugin through 1.3.1 does not perform any capability or nonce check on the action that creates and activates its bundled child , allowing any authenticated user such as a subscriber to switch the site's active site-wide, and allowing the same action to be...

PT-2026-122593

Ghidra before 12.2 contains a numeric truncation vulnerability in PackedDecode::skipAttribute and skipAttributeRemaining in marshal.cc that stores 64-bit string lengths in 32-bit variables. Attackers can supply a crafted packed stream, such as a malicious .sla file, to inject attributes into the...

PT-2026-122576

This week's Wordfence report is straight-up brutal. 497 plugins and themes got hit with vulnerabilities and there's no patch for 69 of them. And I'm seeing people in threads saying "just deactivate it for now" — nah, that's not how this works and it's gonna get someone wrecked. Here's the deal...

PT-2026-122504

The GeoDirectory WordPress plugin before 2.8.194 does not validate a user-supplied image URL before using it as a local file path when saving a front-end listing, allowing users with Subscriber-level access and above to read files from outside the web root and to delete files on the server, limit...

PT-2026-122578

This week's Wordfence report is straight-up brutal. 497 plugins and themes got hit with vulnerabilities and there's no patch for 69 of them. And I'm seeing people in threads saying "just deactivate it for now" — nah, that's not how this works and it's gonna get someone wrecked. Here's the deal...

PT-2026-122505

The GeoDirectory WordPress plugin before 2.8.194 does not perform status, ownership or password checks when loading listings for one of its unauthenticated AJAX handlers, allowing unauthenticated users to disclose the content of non-public draft, pending and private listings by supplying their ID...

PT-2026-121803

The CGM CLININET application stores the production database login and password, as well as RabbitMQ broker credentials, in the SysIO.pl configuration file. Insecure file permissions make this file readable by any local account. This issue was fixed in version 2026.MS3...