PT-2026-116198

Name of the Vulnerable Software and Affected Versions Fastcache by Host.it versions prior to 1.7.6 Description An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. Authenticated attackers with subscriber-level access or...

PT-2026-116378

Name of the Vulnerable Software and Affected Versions Rank Math SEO PRO version 3.0.123 Description A supply-chain compromise occurred where a subset of packages distributed between October 15, 2026, and October 16, 2026, contained embedded malware. This issue has been actively exploited in the...

PT-2026-116379

Name of the Vulnerable Software and Affected Versions Fancy Comments WordPress versions prior to 1.2.22 Description Improper neutralization of input during web page generation allows Reflected Cross-site Scripting XSS in the Heateor Support Fancy Comments WordPress fancy-facebook-comments...

PT-2026-116352

Name of the Vulnerable Software and Affected Versions LearnPress versions prior to 4.4.11 Description An unauthenticated attacker can perform PHP Object Injection by sending untrusted input through the checkout-email request parameter during the checkout AJAX action. The input is processed by...

PT-2026-116435

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in PAYCOMET PAYCOMET for WooCommerce paytpv-for-woocommerce allows Reflected XSS.This issue affects PAYCOMET for WooCommerce: from n/a through 5.45...

PT-2026-116476

phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains a cross-site request forgery vulnerability in the Elasticsearch and OpenSearch administration API endpoints, which do not validate a CSRF token for the create, drop, and import actions. Attackers can lure a user with CONFIGURATION...

PT-2026-116465

Name of the Vulnerable Software and Affected Versions phpMyFAQ versions 3.2.1 through 4.1.8 phpMyFAQ versions 4.2.0-alpha through 4.2.0-alpha Description Authenticated content authors can perform stored cross-site scripting by embedding iframes with data:text/html sources within FAQ or News...

PT-2026-116456

Name of the Vulnerable Software and Affected Versions phpMyFAQ versions 4.2.0-alpha through 4.2.0-alpha Description An authorization flaw exists in the deleteGroup function of the GroupController. Authenticated administrators who possess the GROUP DELETE privilege but are not SuperAdmins can...

PT-2026-116455

phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta does not require the current password when changing an account e-mail in the user control panel UserController::updateData, api/user/data/update, checking only the session and CSRF token. An attacker with a hijacked session can set the e-mai...

PT-2026-116466

phpMyFAQ 3.2.0 before 4.0.0 and 4.0.2 before 4.2.0-beta contains an authentication bypass in its Microsoft Entra ID login flow, which links users by the mutable preferred username claim and whose AuthEntraId::create ignores the duplicate-login exception while continuing with the existing local...

PT-2026-116464

phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains a privilege escalation vulnerability in GroupController::saveCategoryRestrictions that lets delegated administrators assign categories outside their own scope. Category-restricted administrators can POST to /admin/api/group/category-restrictions wit...

PT-2026-116394

Name of the Vulnerable Software and Affected Versions Gantry 5 Framework versions prior to 5.6.4 Description The Gantry 5 Framework allows the retrieval of embedded sensitive data through the generation of error messages that contain sensitive information. Recommendations Update Gantry 5 Framewor...

PT-2026-116453

FreeRDP from 3.14.1 before 3.32.0 contains an integer underflow in the WinPR BMP writer, where a mismatched stride calculation passes SIZE MAX - 3 to Stream Zero for sub-byte images. A malicious RDP clipboard peer can return a crafted 1-bpp BMP processed by clipboard synthesize image format to bm...

PT-2026-116483

Admidio from 5.0.0 before 5.0.16 contains an authorization bypass vulnerability that allows authenticated users to export lists despite export restrictions by requesting mode=pdfl. The groups roles export check in modules/groups-roles/lists show.php omits pdfl, which later runs the pdf export,...

PT-2026-116461

phpMyFAQ from 4.2.0-alpha.2 before 4.2.0-beta contains a privilege escalation vulnerability in UserController::updateUserRights that drops per-right language restrictions when rights are re-granted. Administrators holding USER EDIT can submit language-scoped rights to the update-rights API,...

PT-2026-116471

phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an uncontrolled resource consumption vulnerability in the unauthenticated faqs and search API endpoints. Attackers can send concurrent GET requests that load and process all database records into PHP memory, exhausting CPU and memory to crash the...

PT-2026-116463

phpMyFAQ 4.2.0-alpha before 4.2.0-beta lacks effective rate limiting on the unauthenticated user/password/update and user/password/reset endpoints. Unauthenticated attackers can send unlimited reset requests to flood a registered user's inbox with reset emails, exhausting mailer and server...

PT-2026-116459

phpMyFAQ from 4.0.0 before 4.1.9 contains an incorrect authorization vulnerability that allows delegated admins lacking the editnews right to modify news by calling PUT /admin/api/news/update, which checks NEWS DELETE instead of NEWS EDIT. Attackers holding addnews and delnews can read the...

PT-2026-116484

Admidio from 5.0.11 before 5.0.16 contains a broken access control vulnerability in modules/inventory/inventory data.php that allows authenticated users to bypass the inventory module enabled restriction. Attackers with any valid login can request the DataTables JSON feed to read every inventory...

PT-2026-116474

phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an information disclosure vulnerability that allows unauthenticated attackers to read hidden open questions due to an inverted api.onlyPublicQuestions check in OpenQuestionController. Attackers can send GET requests to the /api/v4.0/open-questions...

PT-2026-116473

phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains a stored cross-site scripting vulnerability in SvgSanitizer that allows users with FAQ EDIT permission to bypass sanitization using XML DTD custom entities. Attackers can upload an SVG defining an entity that expands to javascript in an anchor href,...

PT-2026-116468

phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an authorization bypass vulnerability that allows category-restricted editors to manage attachments of FAQs outside their categories by supplying arbitrary record IDs. Attackers in medium permission mode can send upload or delete requests with a...

PT-2026-116485

Name of the Vulnerable Software and Affected Versions Admidio versions prior to 5.0.16 Description An information disclosure issue exists where unauthenticated attackers can view role-restricted weblinks. This occurs because the 'rss/links.php' endpoint omits the category view role-visibility...

PT-2026-116480

Name of the Vulnerable Software and Affected Versions phpMyFAQ versions prior to 4.1.9 phpMyFAQ versions 4.2.0-alpha through 4.2.0-beta Description An authorization bypass exists in the 'attachment.php' endpoint. This issue allows low-privileged users with the dlattachment right, or anonymous use...

PT-2026-116470

Name of the Vulnerable Software and Affected Versions phpMyFAQ versions prior to 4.1.9 phpMyFAQ versions 4.2.0-alpha through 4.2.0-beta Description An improper authorization issue exists in the attachment.php file. The system fails to verify if the parent FAQ of an attachment is published or...

PT-2026-116475

Name of the Vulnerable Software and Affected Versions phpMyFAQ versions 3.2.0 through 4.1.8 phpMyFAQ versions 4.2.0-alpha through 4.2.0-alpha Description An insecure direct object reference exists in the 'GET /admin/api/user/data/userId' endpoint. The system returns the complete faquserdata row f...

PT-2026-116458

Name of the Vulnerable Software and Affected Versions phpMyFAQ versions prior to 4.1.9 phpMyFAQ versions prior to 4.2.0-beta Description An account enumeration issue allows unauthenticated attackers to confirm registered display names and emails. By submitting guest comments to the comment create...

PT-2026-116478

phpMyFAQ 4.0.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains a broken object-level authorization vulnerability in the PUT /api/v3.1/faq/update endpoint, which checks only the global edit faq permission and does not verify access to the target FAQ. Authenticated users with edit faq...

PT-2026-116505

A weakness has been identified in nemoTyrant manong up to 7c9e5228e133b9267ad3a415833bc9bb53193bb4. This impacts the function cache/del cache/arr2sql of the file func.php. This manipulation causes sql injection. The attack may be initiated remotely. This product uses a rolling release model to...

PT-2026-116358

Name of the Vulnerable Software and Affected Versions xSpeed Cache: AI-Powered Performance Hub with MCP, Caching & CDN versions prior to 1.4.3 Description Insufficient input sanitization and output escaping allow authenticated attackers with contributor-level access and above to perform Stored...

PT-2026-116356

Name of the Vulnerable Software and Affected Versions WP Booking System – Booking Calendar versions prior to 2.1.0.4 Description Authenticated users with subscriber-level access and above can extract private per-event booking descriptions and booking IDs from any calendar managed by the site. Thi...

PT-2026-116353

Name of the Vulnerable Software and Affected Versions LearnPress – WordPress LMS Plugin for Create and Sell Online Courses versions prior to 4.4.11 Description An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions...

PT-2026-116359

Name of the Vulnerable Software and Affected Versions Themify Popup versions prior to 1.4.8 Description The plugin is subject to Stored Cross-Site Scripting, a flaw where malicious scripts are permanently stored on the target server. This occurs due to insufficient input sanitization and output...

PT-2026-116194

An issue was discovered on Tektronix 3 Series MDO devices before 1.21.1. A path traversal vulnerability in the SCPI FILESystem command interface allows remote attackers to read or modify arbitrary files on the device through insufficient validation of file paths supplied to filesystem access...

PT-2026-116195

Name of the Vulnerable Software and Affected Versions Tektronix 3 Series MDO versions prior to 1.21.1 Description A path traversal issue exists in the web management interface. Insufficient validation of user-supplied file paths allows remote attackers to read arbitrary files accessible to the...

PT-2026-116193

Name of the Vulnerable Software and Affected Versions Tektronix 3 Series MDO versions prior to 1.21.1 Description An OS command injection issue exists in the FILESystem:MOUNT:DRIve SCPI command handler. Insufficient neutralization of user-supplied input allows remote attackers to execute arbitrar...

PT-2026-116361

Name of the Vulnerable Software and Affected Versions Themify Builder versions prior to 7.8.3 Description Insufficient input sanitization and output escaping allow authenticated attackers with contributor-level access and above to perform Stored Cross-Site Scripting XSS. This occurs via the visib...

PT-2026-116366

Name of the Vulnerable Software and Affected Versions PeachPay — Payments & Express Checkout for WooCommerce versions prior to 1.120.70 Description The plugin fails to perform capability or ownership checks before returning an order's secret key in response to an unauthenticated request. This...

PT-2026-116367

Name of the Vulnerable Software and Affected Versions Ukr-To-Lat versions prior to 1.3.6 Description Users with Contributor-level access and above can perform SQL injection attacks because the plugin fails to sanitize and escape a term name before incorporating it into a SQL query. Recommendation...

PT-2026-116369

Name of the Vulnerable Software and Affected Versions WP Data Access versions prior to 5.5.88 Description Insufficient authorization and Cross-Site Request Forgery CSRF checks in a specific action allow authenticated users, including those with subscriber privileges, to perform Server-Side Reques...

PT-2026-116380

The European VAT Compliance Assistant for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via CF-IPCountry Header in all versions up to, and including, 1.36.10 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

PT-2026-117681

CVE ID :CVE-2026-108117 Published : Oct. 17, 2026, 10:19 p.m. | 1 hour, 1 minute ago Description :None Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...

PT-2026-116355

Name of the Vulnerable Software and Affected Versions WP Booking System – Booking Calendar versions prior to 2.1.0.4 Description An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. Unauthenticated attackers or users with...

PT-2026-116201

Name of the Vulnerable Software and Affected Versions Hippoo Mobile App for WooCommerce versions prior to 1.13.0 Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Reflected Cross-Site Scripting. This occurs when an attacker tricks a user in...

PT-2026-117132

These are all security issues fixed in the putty-0.85-2.1 package on the GA media of openSUSE Tumbleweed...

PT-2026-117130

These are all security issues fixed in the percona-toolkit-3.7.1.4-1.1 package on the GA media of openSUSE Tumbleweed...

PT-2026-116381

The YMC Filter plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'post title' parameter in all versions up to, and including, 3.12.19 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level...

PT-2026-116360

Name of the Vulnerable Software and Affected Versions Post Export Import with Media versions prior to 1.17.3 Description The Post Export Import with Media plugin for WordPress contains a Directory Traversal flaw. This issue allows authenticated users with administrator-level access or higher to...

PT-2026-116504

A security flaw has been discovered in THU-MIG yoloe up to 40cd606cabdbe2b566d6f14a6b162c89206e9a1b. This affects the function eval of the file ultralytics/nn/autobackend.py of the component AutoBackend Model Loading. The manipulation of the argument imgsz/names/kpt shape results in improper...

PT-2026-116482

Admidio from 5.0.0 before 5.0.16 contains an insecure direct object reference vulnerability in ForumService::saveTopic that allows authenticated members to modify other users' forum topics. Attackers can replace the topic uuid parameter in their own topic save request, reusing their CSRF token, t...