396022 matches found
PT-2026-104597
A vulnerability was determined in Omega Solution CoinEx Crypto 2025. This affects an unknown function of the file /customer/ of the component Customer Profile API. Executing a manipulation of the argument ID can lead to authorization bypass. The attack may be launched remotely. The exploit has be...
PT-2026-104598
ezBookkeeping 1.2.0 before 2.0.1 contains a privilege escalation vulnerability that allows attackers holding an API token to obtain a full session token via /api/v1/tokens/refresh.json. Because TokenRefreshHandler never checks token type, attackers can exchange short-lived or IP-restricted API...
PT-2026-104603
Vulnerability in NetScaler ADC and NetScaler Gateway. This issue affects ADC: before 14.1-73.41, before 13.1-64.28, before 14.1-73.41 FIPS, and before 13.1-37.282; Gateway: before 14.1-73.41 and before 13.1-64.28...
PT-2026-104601
A vulnerability was identified in Omega Solution CoinEx Crypto 2025. This impacts an unknown function of the file /customer-currency/ of the component Customer Information API. The manipulation of the argument ID leads to authorization bypass. Remote exploitation of the attack is possible. The...
PT-2026-104602
A security flaw has been discovered in Omega Solution CoinEx Crypto 2025. Affected is an unknown function of the file /ticket/customer of the component Support Ticket API. The manipulation of the argument status/page/count results in information disclosure. The attack can be executed remotely. Th...
PT-2026-104489
The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Reflected DOM-Based Cross-Site Scripting via the 'orderby' parameter in all versions up to, and including, 4.4.7 due to insufficient input sanitization and output escaping. This makes it...
PT-2026-104555
🚨 DELL CONTAINER STORAGE MODULES — UNAUTHENTICATED CVSS 10.00 DSA-2026-448 Dell Security Advisory DSA-2026-448, revision 1.0, dated 1 Oct 2026, covers multiple vulnerabilities in Dell Container Storage Modules. Article 000515771. Impact: Critical. Unauthenticated missing authentication, CVSS 10.0...
PT-2026-104554
A flaw has been found in Linux Mint Xreader up to 4.6.5. This issue affects the function setup document content list/g strdup printf of the file backend/epub/epub-document.c of the component EPUB File Handler. This manipulation causes path traversal. The attack is possible to be carried out...
PT-2026-104562
In Bouncy Castle for Java before 1.86, neither copy of PKIXCertPathReviewer - org.bouncycastle.pkix.jcajce.PKIXCertPathReviewer nor the legacy org.bouncycastle.x509.PKIXCertPathReviewer - applied X.509 name constraints to the end-entity certificate. checkNameConstraints walked the path with a loo...
PT-2026-104527
The Kubio AI Page Builder WordPress plugin before 2.9.3 does not validate the URI scheme of a user-supplied value before outputting it as a link target, allowing users with the contributor role and above to store a payload which executes in the browser of anyone who follows the link, including an...
PT-2026-104477
ImageMagick before 7.1.2-32 and 6.9.13-57 contains a policy bypass vulnerability in LoadPolicyCache that silently skips security policy rules when policy.xml uses an alternate DOCTYPE. A valid DOCTYPE not ending in '' makes the parser consume the rest of the file, so no policy rules are applied a...
PT-2026-104490
The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via ppress billing address Filename Parameter in all versions up to, and including, 4.17.4 due to...
PT-2026-104493
The Real Cookie Banner: GDPR & ePrivacy Cookie Consent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment in all versions up to, and including, 5.3.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inje...
PT-2026-104481
The Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment in all versions up to, and including, 3.2.19 due to insufficient input sanitization and output escaping. This makes it possibl...
PT-2026-104486
The Beaver Builder Page Builder – Drag and Drop Website Builder plugin for WordPress is vulnerable to blind SQL Injection via 'fieldsvalue' Parameter in all versions up to, and including, 2.11.0.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on th...
PT-2026-104479
Formbricks before 5.4.4 and 6 before 6.0.1 allows stored XSS. The survey-level Custom Head Scripts feature did not enforce the documented Manage permission boundary. A workspace member holding only readWrite permission could configure Custom Head Scripts on a survey, an operation the documentatio...
PT-2026-104483
The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.13.1 This is due to the plugin not properly verifying that a user is authorized to...
PT-2026-104503
Name of the Vulnerable Software and Affected Versions Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More versions prior to 5.5.1.6 Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Reflected...
PT-2026-104506
Name of the Vulnerable Software and Affected Versions Welcart e-Commerce plugin for WordPress versions prior to 2.12.3 Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting. An attacker can inject arbitrary web scrip...
PT-2026-104510
Name of the Vulnerable Software and Affected Versions Transliterator – Multilingual and Multi-script Text Conversion versions prior to 2.5.9 Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting XSS via comment...
PT-2026-104543
The WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.0.18 via the template scope function. This makes it possible for authenticated attackers, with contributor-level access and...
PT-2026-104593
LaraDashboard 1.4.2 before 1.4.8 applies advanced email validation to unauthenticated forgot-password and reset-password requests, triggering DNS lookups and paid AbstractAPI verification calls. Unauthenticated attackers can submit arbitrary addresses to exhaust the verification quota, making...
PT-2026-104573
Name of the Vulnerable Software and Affected Versions Nezha versions 1.8.0 through 2.3.12 Description A lock-order inversion exists within the UpdateGroup and DeleteGroup functions. This flaw allows authenticated users without administrative privileges to cause a deadlock in the alerting subsyste...
PT-2026-104522
The WP Ultimate CSV Importer WordPress plugin before 9.2 does not use a site-specific secret when deriving the storage location of the import logs it writes under the uploads directory, nor does it block direct access to them, allowing unauthenticated attackers to retrieve the personal data of...
PT-2026-104567
In Bouncy Castle for Java before 1.86, the Messaging Layer Security MLS, RFC 9420 implementation did not bind an X.509 credential to a LeafNode's signature key. LeafNode.verify checked a leaf's signature against the signature key carried in the leaf itself, while the credential's X.509 certificat...
PT-2026-104585
Name of the Vulnerable Software and Affected Versions Unlimited Elements For Elementor Free Widgets, Addons, Templates versions prior to 2.0.21 Description An issue involving improper neutralization of input during web page generation allows for Reflected Cross-site Scripting XSS, a technique whe...
PT-2026-104558
🚨 DELL CONTAINER STORAGE MODULES — UNAUTHENTICATED CVSS 10.00 DSA-2026-448 Dell Security Advisory DSA-2026-448, revision 1.0, dated 1 Oct 2026, covers multiple vulnerabilities in Dell Container Storage Modules. Article 000515771. Impact: Critical. Unauthenticated missing authentication, CVSS 10.0...
PT-2026-104577
Name of the Vulnerable Software and Affected Versions OpenAM versions prior to 16.1.3 Description A cross-site scripting defect exists where the SAML message, relay state, and target URL are placed unencoded into the load-balancer cookie bounce auto-submit page. This issue is reachable when...
PT-2026-104511
Name of the Vulnerable Software and Affected Versions Strong Testimonials versions prior to 3.3.12 Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts into pages that execute when a...
PT-2026-104546
Name of the Vulnerable Software and Affected Versions Mail logging – WP Mail Catcher versions prior to 2.1.13 Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting XSS. This occurs via the PHPMailer wp mail failed...
PT-2026-104520
The WP 2FA WordPress plugin before 4.1.0 does not invalidate a time-based one-time passcode once it has been used, allowing an attacker who knows an account's password and has observed a valid code within its validity window to replay it and bypass two-factor authentication, including on...
PT-2026-104498
Name of the Vulnerable Software and Affected Versions All in One SEO versions prior to 5.0.3 Description The plugin allows unauthenticated attackers to execute arbitrary shortcodes because it fails to properly validate a value before running the do shortcode function. This issue occurs when the...
PT-2026-104495
Name of the Vulnerable Software and Affected Versions Ultra Addons Lite for Elementor versions prior to 1.3.3 Description Stored Cross-Site Scripting occurs via the Type Out widget due to insufficient input sanitization and output escaping on user supplied attributes. Authenticated attackers with...
PT-2026-104548
Name of the Vulnerable Software and Affected Versions Nelio Content – Editorial Calendar & Social Media Auto-Posting versions prior to 4.5.1 Description An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. This allows...
PT-2026-104535
The Pie Register WordPress plugin before 3.8.4.14 does not restrict access to an invitation-code report, allowing unauthenticated visitors who know a valid invitation code to obtain the username and email address of every user who registered with that code...
PT-2026-104499
Name of the Vulnerable Software and Affected Versions SEOPress – AI SEO Plugin & On-site SEO plugin for WordPress versions prior to 10.3 Description Insufficient input sanitization and output escaping allow authenticated attackers with subscriber-level access and above to perform Stored Cross-Sit...
PT-2026-104551
The WPC Product Options for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via wpcpo- Array Key via Multipart Field Name in all versions up to, and including, 4.0.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticate...
PT-2026-104516
The WP Ultimate Review WordPress plugin before 2.4.4 does not validate that a submitted review rating is numeric before storing it and later using it in numeric operations when rendering reviews, allowing unauthenticated users to make the reviewed content fail with a fatal error for all visitors...
PT-2026-104523
The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not sanitise file paths inside uploaded archives before extracting them, allowing authenticated users with access to its asset-management feature Administrators by default, or Editors when a non-default Unlimited Elements fo...
PT-2026-104564
In Bouncy Castle for Java before 1.86, a truncated OpenPGP encrypted message was accepted with no error reported, and on the SEIPD version 1 path with no integrity check performed at all. RFC 9580 sec. 13.7 permits an implementation to release the cleartext of the fully authenticated chunks when...
PT-2026-104540
Name of the Vulnerable Software and Affected Versions WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System versions prior to 3.0.20 Description An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. This...
PT-2026-104584
Name of the Vulnerable Software and Affected Versions Themeum Kirki versions prior to 6.3.1 Description Improper validation of the specified quantity in input allows access to functionality not properly constrained by Access Control Lists ACLs, which are security mechanisms that define which user...
PT-2026-104587
SuiteCRM has a public SSRF proof of concept. CVE-2026-69137. The catch everyone's missing: "authenticated" doesn't mean privileged. Any valid user account is enough. 👉 Full breakdown: https://t.co/XtKhwXuTVg SuiteCRM SSRF CyberSecurity AppSec InfoSec WebSecurity https://t.co/U6cfGAFuxo...
PT-2026-104518
The WP Ultimate Review WordPress plugin before 2.4.4 does not escape some of its review overview settings before outputting them in posts, which could allow users with a role as low as author to perform Stored Cross-Site Scripting attacks, when author reviews are enabled...
PT-2026-104500
Name of the Vulnerable Software and Affected Versions Photo Reviews for WooCommerce versions prior to 1.2.31 Description An issue allows unauthenticated attackers to permanently delete arbitrary posts, pages, products, or media attachments. The flaw occurs because the plugin stores...
PT-2026-104589
W vincent-peugnet/wcms through 3.18.0 contains a remote code execution vulnerability that allows authenticated editors to write arbitrary files by abusing the unvalidated path in POST /api/v0/media/upload/:path. Attackers can upload .php files executed by the web server, use encoded ../ sequences...
PT-2026-104521
The WP Ultimate CSV Importer WordPress plugin before 9.2 does not properly validate the file types contained in an uploaded archive nor sanitise their content before storing them in a publicly served location, allowing high privilege users such as administrators to achieve Stored Cross-Site...
PT-2026-104491
The EmbedPress – PDF Embedder, 3D PDF FlipBook, Google Reviews, YouTube Videos, Upload & Embed PDF documents plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'slidesShow' Block Attribute in all versions up to, and including, 4.6.6 due to insufficient input sanitization and...
PT-2026-104539
Name of the Vulnerable Software and Affected Versions WPC Estimated Delivery Date for WooCommerce versions prior to 4.0.2 Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Reflected Cross-Site Scripting. This occurs when an attacker tricks ...