PT-2026-78891

The Admin and Site Enhancements ASE WordPress plugin before 9.0.1 does not sanitise uploaded SVG files on every route it accepts them through, allowing users with a role the site owner granted upload access to store a file containing JavaScript which then executes in the browser of anyone who ope...

PT-2026-78882

A flaw has been found in DeDeCMS 3. Affected by this vulnerability is an unknown functionality of the file /include/dialog/select media post.php. Executing a manipulation of the argument uploadfile can lead to unrestricted upload. The attack can be executed remotely. The exploit has been publishe...

PT-2026-78981

Unauthenticated Cross Site Scripting XSS in NotificationX Pro = 3.1.4 versions...

PT-2026-78937

n8n before 1.123.69, 2.x before 2.33.4, and 2.34.x before 2.34.1 contains a regular expression denial of service ReDoS vulnerability in the Filter and Switch nodes, which compile user-supplied regex patterns with new RegExp and execute them synchronously on the worker thread without complexity...

PT-2026-78910

An unauthenticated remote attacker can retrieve sensible files from the FDS Web server, such as the backup archive at /FdsBackup.zip and additional files under /downloads/, directly over HTTP without a valid session. These files disclose detailed railway signaling and track layout information tha...

PT-2026-78904

A high privileged remote attacker can upload a .php file and then request it directly from /uploads/.php to achieve arbitrary code execution due to improper file type validation which could result in full system compromise...

PT-2026-78908

An unauthenticated remote attacker in possession of a valid session identifier is able to continue using the session after it should have expired. This increases the risk associated with stolen, leaked, shared, or unattended sessions and may enable unauthorized continued access to the FDS web...

PT-2026-78874

A security vulnerability has been detected in DeDeCMS 53 1 UTF8. This vulnerability affects unknown code of the file /plus/advancedsearch.php. Such manipulation of the argument sql leads to sql injection. The attack can be launched remotely. The exploit has been disclosed publicly and may be used...

PT-2026-78894

The Kirki WordPress plugin before 6.2.3 does not properly validate the files contained in archives uploaded by users with the Editor role, and does not remove all unwanted files after extracting them, allowing such users to upload arbitrary files to a web accessible directory, leading to Stored X...

PT-2026-78896

The application generates uploaded file names using a weak and predictable method based on the request timestamp. This allows a remote attacker to accurately guess or brute-force the generated filename within a short time window. An attacker can successfully locate and access uploaded files, whic...

PT-2026-78889

The Royal Addons for Elementor WordPress plugin before 1.7.1066 does not correctly sanitise custom widget markup before writing it to a file that is later executed, allowing users with the manage options capability and, on WordPress Multisite, non-super subsite administrators who do not otherwise...

PT-2026-78913

Joomla Extension - yootheme.com - Unauthenticated tag modifications in Zoo 4.1.65 - The comment controller endpoint lacked ACL checks, allowing unauthorized tag modifications by unauthenticated users...

PT-2026-78892

The GutenKit WordPress plugin before 2.5.0 does not sanitise uploaded SVG files on all of the upload paths it enables, allowing users with the file upload capability, such as Author, to upload a malicious SVG and perform Stored Cross-Site Scripting attacks against any user opening it, including...

PT-2026-78911

A low-privileged remote attacker can enumerate all configured users and identify which accounts hold elevated privileges using the endpoint /api/user/fetch-all.php...

PT-2026-78897

In affected versions of Octopus Server under certain circumstances it is possible for sensitive variables to be printed in the deployment variable snapshot in clear-text...

PT-2026-79007

A vulnerability has been found in code-projects Simple Inventory System 1.0. Affected by this issue is some unknown functionality of the file /delete.php. Such manipulation of the argument ID leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public...

PT-2026-78924

n8n before 2.33.4 and 2.34.x before 2.34.1 contain a remote code execution vulnerability in the @n8n/workflow-sdk node-schema loader used for MCP node-schema loading. The loader derives a node's schema module path directly from the attacker-supplied node type string without validating...

PT-2026-78941

Unauthenticated Local File Inclusion in Shuffle = 1.8 versions...

PT-2026-78978

Subscriber Broken Authentication in Leyka = 3.32.3 versions...

PT-2026-78950

Unauthenticated Local File Inclusion in Golo Framework 1.7.5 versions...

PT-2026-78963

Subscriber Cross Site Scripting XSS in Media LIbrary Assistant = 3.39 versions...

PT-2026-78944

Unauthenticated Broken Access Control in Altair = 5.2.2 versions...

PT-2026-78956

Unauthenticated SQL Injection in rtMedia for WordPress, BuddyPress and bbPress = 4.7.11 versions...

PT-2026-78886

Multiple SEIKO EPSON printers and scanners contain revoked root certificates. A man-in-the-middle attack may allow an attacker to obtain communication data transmitted by the product. As for the details of the affected products and versions, refer to the vendor's information...

PT-2026-78940

n8n before 2.34.1 and 2.33.x before 2.33.4 contains an SSRF protection bypass in the SearXNG Agent tool. The tool sent requests to the user-supplied API URL using a raw HTTP client that did not route through n8n's centralized SSRF protection. On instances with N8N SSRF PROTECTION ENABLED=true, an...

PT-2026-78928

n8n before 1.123.69, 2.33.4, and 2.34.1 contains a stored cross-site scripting vulnerability in the Form node's completion page. The completion page applied its sandboxing Content-Security-Policy only when respondWith was not set to 'redirect', but responseText was always rendered as raw HTML. An...

PT-2026-78975

Unauthenticated SQL Injection in Directory Pro = 2.5.8 versions...

PT-2026-78996

A security flaw has been discovered in liftoff-sr CIPster 1802525be27d33e19a9a83c163e331a1d13b1892. The impacted element is the function CipAttribute::GetAttrData/CipAttribute::SetAttrData of the file ciptypes.h of the component Generic Attribute Logic. Performing a manipulation results in memory...

PT-2026-78973

Unauthenticated Cross Site Scripting XSS in Form Maker by 10Web = 1.15.46 versions...

PT-2026-78931

n8n before 1.123.69, 2.x before 2.33.4, and 2.34.x before 2.34.1 contain an expression injection vulnerability in resource-locator field link preview rendering. The editor spliced the field's stored value directly into the node type's URL template without checking for expression syntax. An...

PT-2026-78929

n8n versions before 2.34.1 contain a credential validation bypass in the MCP create workflow from code tool when authentication type is set to an expression. Attackers with a valid MCP Bearer API key and knowledge of a target credential ID can persist unauthorized cross-project credential...

PT-2026-78988

Subscriber SQL Injection in eShipper Commerce = 2.16.13 versions...

PT-2026-78935

n8n before 1.123.69, 2.x before 2.33.4, and 2.34.x before 2.34.1 contain an arbitrary file read and write vulnerability in the Snowflake node, which passes free-form Execute Query input, including client-side commands, directly to the Snowflake SDK without applying n8n's file-access restrictions...

PT-2026-78946

HCL IntelliOps Event Management IEM is affected by a race condition. A "timing window" can occur where an attacker can modify the resource causing unpredictable behavior...

PT-2026-78990

Subscriber Arbitrary File Upload in Smart Cleaning = 4.8.6 versions...

PT-2026-78938

n8n is a workflow automation platform. In versions prior to 1.123.69, 2.33.4, and 2.34.1, the JavaScript Code node's VM sandbox did not freeze the sandbox's Function.prototype, allowing an authenticated user with the ability to create and execute workflows to pollute it from within a Code node...

PT-2026-78903

Joomla Extension - phoca.cz - Reflected XSS via the search GET parameter in Phoca Download 5.0.0-6.1.4...

PT-2026-78965

Unauthenticated Cross Site Scripting XSS in Swatchly – WooCommerce Variation Swatches for Products = 1.4.13 versions...

PT-2026-78900

Joomla Extension - icagenda.com - Authenticated Stored XSS in iCagenda 4.0.8 to 4.0.12 - The frontend "Submit an Event" form stores the image and file fields as raw strings with no output-side HTML-attribute escaping...

PT-2026-78921

Joomla Extension - tassos.gr - Client-controlled validation bypass in Convert Forms extension 5.2.5 - The front-end Submissions view did not enforce access control. An unauthenticated visitor could therefore list a form's submissions...

PT-2026-78901

Joomla Extension - phoca.cz - Stored XSS via User-Agent header in Admin Order View in Phoca Cart 5.0.0-6.1.7...

PT-2026-78942

Unauthenticated SQL Injection in Capella = 2.5.5 versions...

PT-2026-78957

Unauthenticated SQL Injection in Security & Malware scan by CleanTalk = 2.184 versions...

PT-2026-79002

A security vulnerability has been detected in liftoff-sr CIPster 1802525be27d33e19a9a83c163e331a1d13b1892. This impacts an unknown function of the file source/src/enet encap/encap.cc of the component TCP Encapsulation Receive Path. The manipulation leads to out-of-bounds read. The attack can be...

PT-2026-79006

@cgauge/yaml npm package contains an arbitrary code execution vulnerability that allows attackers to execute arbitrary JavaScript by embedding a custom !js YAML tag whose construct callback unconditionally calls eval on attacker-supplied string values during document parsing. Any application...

PT-2026-79014

ATutor is vulnerable to a Path Traversal vulnerability in ZIP extraction functionality. An attacker with instructor privileges can upload and extract a specially crafted ZIP archive, causing files to be written outside the intended extraction directory. This allows an attacker to place a...

PT-2026-79017

ATutor is vulnerable to Insecure Direct Object Reference IDOR attack in profile picture related endpoints. Any authenticated user, including a student, can supply another user's member id in a POST request to the profile album endpoint and permanently delete that user's profile picture, including...

PT-2026-79027

aiosmtplib is an asynchronous SMTP client for use with asyncio. Prior to 5.1.2, SMTPProtocol.start tls in src/aiosmtplib/protocol.py consumes the server's 220 response and starts the TLS handshake without clearing SMTPProtocol. buffer. An active network attacker can place attacker-chosen SMTP...

PT-2026-79012

ATutor generates predictable email confirmation tokens due to the use of insufficiently random values in the account confirmation functionality. Due to the use of predictable values related to user registration, an attacker who knows or can predict these values can guess valid account activation...

PT-2026-79020

ATutor is vulnerable to Reflected XSS via popup parameter in preview.php. An authenticated attacker can inject a double quote into the popup parameter, break out of the attribute value, and append a new event handler such as onload. The related preview top.php file sanitises these parameters, but...