PT-2026-120501

The Simple Shopping Cart WordPress plugin before 5.3.3 does not verify submitted product prices against a value only the site owner can set, allowing users with the Contributor role and above to register attacker-chosen prices for existing products, which any visitor can then use to add those...

PT-2026-120579

Trudesk through 1.2.11 contains an authorization bypass vulnerability that allows authenticated users to read tickets outside their groups via GET /api/v1/tickets/:uid. Attackers can enumerate sequential ticket uids to read every ticket's subject, issue, comments, owner and assignee, because the...

PT-2026-120571

SchedulePress before 5.3.5 contains a missing authorization vulnerability that allows authenticated Contributor-level users to change any post's status and publish date via the wpsp el editor form AJAX action. Attackers can reuse the wpsp-el-editor nonce from the Elementor modal to unpublish or...

PT-2026-120511

Deserialization of Untrusted Data vulnerability in GS Plugins WordPress Team Members – GS Plugins gs-team-members allows Object Injection.This issue affects WordPress Team Members – GS Plugins: from n/a through 2.8.2...

PT-2026-120537

Apache bRPC versions before 1.18.0 validate the server certificate chain when client TLS peer verification is enabled, but do not bind the certificate to an expected DNS name or IP address. A network attacker who can redirect or intercept a connection and who possesses a certificate issued by a C...

PT-2026-120565

Improper authorization in Apache bRPC versions 1.18.0 on all platforms allows remote attackers to access builtin services through the public port. Root Cause: ServerOptions.internal port is documented to make builtin services and Tabbed services reachable only from the internal port, and the...

PT-2026-120581

Trudesk through 1.2.11 contains an authorization bypass vulnerability that allows authenticated users to post content attributed to other users by supplying user-controlled owner IDs. Attackers can set ownerId or owner in postComment, postInternalNote, and ticket create requests to forge...

PT-2026-120599

The callback URL parameter in WSO2 API Manager fails to validate user-supplied input, allowing it to be controlled by malicious actors. Exploitation of this vulnerability could lead to users being redirected to attacker-controlled web pages. This can be used in conjunction with social engineering...

PT-2026-120659

Name of the Vulnerable Software and Affected Versions Lagoon versions prior to 2.33.2 Description A flaw in the ssh service within Lagoon core allows an attacker with a valid Lagoon user account to execute arbitrary code, potentially resulting in elevated administrative permissions. Detection of...

PT-2026-120602

The product failed to enforce validation constraints on user-supplied input in URL parameters, allowing sensitive data to be passed to flows where it was not intended to be processed. Although the product did not utilize this data, its acceptance could lead to logging. If a user mistakenly sends...

PT-2026-120583

Trudesk through 1.2.11 contains a server-side JavaScript injection vulnerability that allows authenticated users to inject code into a MongoDB $where clause via the search parameter. Attackers can close the regular expression in GET /api/v1/tickets/search to loop mongod for denial of service or...

PT-2026-120600

The Authentication Endpoint accepts user-supplied input without sufficient encoding, allowing for the injection of malicious JavaScript payloads. This vulnerability can be triggered by submitting crafted input to the Authentication Endpoint. Successful exploitation allows an attacker to redirect...

PT-2026-120623

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Brainstorm Force SureCart surecart allows Stored XSS.This issue affects SureCart: from n/a through 4.9.5...

PT-2026-120645

A flaw was found in the PathResourceManager component of the Undertow web server. This component is responsible for serving static files from the file system. The issue occurs because the mechanism used to verify if a symbolic link points to a safe location only checks if the target path starts...

PT-2026-120543

Resource exhaustion in Apache bRPC version 1.18.0 on all platforms: multiple parsers that accept wire-controlled input bound no limit on the sizes declared by the client or on decompressed output, which attackers can use to drive disproportionate memory use and crash the process. Root Cause: 1 Th...

PT-2026-120572

A weakness has been identified in dhikshitha29 Insurance-Management-System 91de5edda5baa109ad8e9baf03ce6a3ceda84183/125362cc21dca20d74091a4913a5096bb58dd837. Affected by this issue is some unknown functionality of the file /Admin/includes/Admin-Register-inc.php of the component Add New Admin Form...

PT-2026-120544

Missing authentication in the streaming RPC path of Apache bRPC version 1.18.0 on all platforms allows a remote attacker to bypass server authentication and inject or deliver streaming frames, when a server is configured with an Authenticator. Root Cause: When authentication is configured,...

PT-2026-120603

When a WSO2 product is configured to use an external user store, the system fails to adequately obscure the existence or validity of usernames during authentication attempts. This oversight allows an attacker to repeatedly query the authentication mechanism with different username guesses, enabli...

PT-2026-120639

Name of the Vulnerable Software and Affected Versions NTPsec ntpd versions 1.1.4 through 1.2.5 Description A reachable exit in the daemon allows a remote attacker to cause a termination of the service. This occurs when the system processes an NTS Network Time Security request containing an...

PT-2026-120595

A BIND resolver that is configured with both a "redirect" zone and "qname-minimization strict" may abort with an assertion failure while processing the redirect. This issue affects BIND 9 versions 9.16.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.16.8-S1 through 9.18.50-S1...

PT-2026-120500

The Simple Shopping Cart WordPress plugin before 5.3.3 does not verify that a PayPal payment notification is for a payment received by the site owner's PayPal account in its default configuration, allowing unauthenticated attackers to have their orders marked as paid using a payment made to an...

PT-2026-120496

In Eclipse OpenJ9 versions up to 0.63.0, the JITServer component is vulnerable to denial of service due to improper boundary checks during protocol message and reply handling. An unauthenticated remote attacker or malicious JITServer can transmit malformed network payloads that cause out-of-bound...

PT-2026-120503

The Contest Gallery WordPress plugin before 34.0.1 does not reliably validate the visitor identity used to enforce its one-vote-per-entry restriction, trusting a client-supplied request header and an unbound client-generated token, which allows unauthenticated users to bypass the restriction and...

PT-2026-120534

The Redis protocol implementation in Apache bRPC allowed inline command parsing to allocate and copy the full connection buffer before a complete CRLF-terminated command was available. A remote attacker with access to a Redis-protocol bRPC service could send long inline inputs without a terminati...

PT-2026-120582

Trudesk through 1.2.11 contains an authorization bypass vulnerability in apiMessages.send that allows authenticated users to post messages as other users due to an incomplete CVE-2022-1931 fix. Attackers can supply arbitrary owner and cId values to POST /api/v1/messages/send to inject spoofed...

PT-2026-120538

An integer underflow in the mcpack2pb component of Apache bRPC version 1.18.0 on all platforms allows remote attackers to crash a bRPC server by sending a request containing a string field with a zero value size. The UnparsedValue::as string function computes size - 1 without validating size; whe...

PT-2026-120576

Chamilo LMS from 2.0.0-alpha.4 before 2.0.0-RC.3 contains a missing authorization vulnerability in AiController::openAnswerGrade that allows any authenticated user to obtain AI grading of other students' exam attempts. Attackers can enumerate exeId and questionId values sent to the open answer...

PT-2026-120554

A security flaw has been discovered in dhikshitha29 Insurance-Management-System 91de5edda5baa109ad8e9baf03ce6a3ceda84183/125362cc21dca20d74091a4913a5096bb58dd837. Affected by this vulnerability is the function mysqli query of the file /Agent/ManagePolicy/EditPolicyHolder.php. Performing a...

PT-2026-120556

CISA's Oct 20 ICS batch included WAGO CC100/PFC100/PFC200 G2 controllers: OS command injection CVE-2026-80466 CVSS 8.8, fixed in firmware 4.10.0. No known exploitation. CISA has since pulled the advisory page. CISA https://t.co/TsmiXvyZGV ICS...

PT-2026-120531

Integer underflow and out-of-bounds read in the HTTP/2 server DATA frame parser in Apache bRPC allows an unauthenticated remote attacker to cause denial of service by sending a malformed DATA frame with the PADDED flag set and a zero-length payload. Root Cause: The HTTP/2 DATA frame handler...

PT-2026-120588

Trudesk through 1.2.11 contains a regular expression injection vulnerability that allows unauthenticated attackers to enumerate usernames by submitting regex patterns to POST /api/v1/login. Attackers can send alternations or prefixes like admin|root or a. and distinguish 'Invalid User' from...

PT-2026-120634

A vulnerability has been found in itsourcecode Sales-and-Inventory-System up to 0a3c45a78aaff3601b8cf9ce8ba82ff5c345caac. Impacted is an unknown function of the file /pages/cust del.php. Such manipulation of the argument ID leads to sql injection. The attack can be launched remotely. The exploit...

PT-2026-120644

A vulnerability was identified in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. This affects the function Login of the file admin class.php. The manipulation of the argument username/password leads to sql injection. Remote exploitation of the attack is...

PT-2026-120520

Sensitive information disclosure and manipulation due to improper authorization checks. The following products are affected: Acronis Cyber Infrastructure ACI before build 6.0.1-112, Acronis Cyber Infrastructure ACI before build 6.1.1-64, Acronis Cyber Infrastructure ACI before build 6.2.1-71...

PT-2026-120577

Chamilo LMS from 2.0.0-alpha.1 before 2.0.0-RC.3 contains a missing authorization vulnerability in legacy AJAX handlers under public/main/inc/ajax/ that exposes user names and certificates. Unauthenticated or low-privileged users can call actions like get users by group course, user by all roles,...

PT-2026-120542

Uncontrolled resource consumption in the HTTP/2 h2 receive path of Apache bRPC version 1.18.0 on all platforms allows a remote unauthenticated attacker to crash the server or grow its memory without bound by sending crafted HTTP/2 frames. Root Cause: The h2 parser, enabled by default on every bRP...

PT-2026-120555

e107 CMS before 2.3.13 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious HTML by manipulating the author GET parameter in search.php, which is parsed with parse str and concatenated unescaped into a rendered input tag via the form...

PT-2026-120476

In OpenStack Manila before 23.0.1, multiple Manila API operations on public shares do not verify that the caller owns the share. The API controllers authorize operations against the caller's own project context, then load a foreign public share without re-authorizing against the share's actual...

PT-2026-120457

The SmartyParcel WordPress plugin before 1.23.4 does not perform authorisation checks when deleting shipping label records, allowing any authenticated user such as a subscriber to delete the shipping label and tracking records of arbitrary orders store-wide...

PT-2026-120847

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.4.4 Splunk Enterprise versions prior to 10.2.8 Splunk Enterprise versions prior to 10.0.11 Splunk Enterprise versions prior to 9.4.16 Description A user without admin or power roles can cause a denial of...

PT-2026-120852

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.4.4 Splunk Enterprise versions prior to 10.2.8 Splunk Enterprise versions prior to 10.0.11 Splunk Enterprise versions prior to 9.4.16 Description A user without admin or power roles can move field...

PT-2026-120670

Missing authorization in the REST and COM administration APIs of Progressive Robot hMailServer 6.0.0 through 6.3.6 allows a remote authenticated user whose credential is confined to named domains to change mail routing and domain configuration beyond those domains on a multi-tenant server. A doma...

PT-2026-120489

The Cart Abandonment Recovery for WooCommerce WordPress plugin before 2.2.0 does not verify the integrity of its cart-recovery token before acting on it and still accepts an unsigned legacy token format, allowing unauthenticated attackers who know a victim's cart session identifier to modify that...

PT-2026-120849

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.4.4 Splunk Enterprise versions prior to 10.2.8 Splunk Enterprise versions prior to 10.0.11 Splunk Enterprise versions prior to 9.4.16 Description A user with a role possessing the schedule search capabili...

PT-2026-120842

A vulnerability was determined in oretnom23 php-travel-agency-system. Affected by this issue is some unknown functionality of the file admin/session.php of the component Session Handler. Executing a manipulation of the argument user id can lead to missing authentication. It is possible to launch...

PT-2026-120483

The Wava Payment Plugin WordPress plugin before 0.3.10 does not perform any authorisation, nonce or origin verification on one of its public REST endpoints, allowing unauthenticated attackers to overwrite the stored credential that identifies the merchant account the store's payments are created...

PT-2026-120669

A security vulnerability has been detected in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. Affected by this vulnerability is the function readfile of the file download.php of the component File Download. Such manipulation of the argument ID leads to sql...

PT-2026-120838

Name of the Vulnerable Software and Affected Versions Laravel versions 12.45.0 through 12.67.0 Laravel version 13.26.0 and earlier Description A crafted relationship inclusion on a read-only endpoint can trigger a destructive database operation on a related table instead of retrieving data. This...

PT-2026-120771

A security vulnerability has been detected in ProjectWorlds Advanced Library Management System 1.0. This impacts the function mysqli query of the file profile.php. The manipulation of the argument admin id leads to sql injection. The attack is possible to be carried out remotely. The exploit has...

PT-2026-120815

Name of the Vulnerable Software and Affected Versions itsourcecode Online Cake Ordering System version 1.0 Description A remote SQL injection is possible due to improper handling of the ID argument within the '/deleteproduct.php' endpoint. SQL injection is a technique where an attacker inserts...