Threat database

Unauthenticated Bypass Vulnerability in hCaptcha for WP <= 5.3.0 versions.

CVE-2026-77646 is a high-severity vulnerability in PTC Windchill PDMLink and PTC FlexPLM involving deserialization of untrusted data that can lead to Server-Side Request Forgery (SSRF). This vulnerability allows an attacker to exploit the system without authentication, potentially causing unauthorized requests from the server. Multiple specific versions of Windchill PDMLink are affected. No patch or official remediation details are provided in the available data.

CVE-2026-77645 is a critical remote code execution vulnerability in PTC Windchill PDMLink and PTC FlexPLM. It arises from improper input validation related to deserialization of untrusted data. The vulnerability affects multiple specific versions of Windchill PDMLink. The CVSS 4.0 score is 9.2, indicating a critical severity level. No patch or vendor advisory details are provided in the input. There are no known exploits in the wild at this time.

CVE-2026-77644 is a critical vulnerability in PTC Windchill Risk and Reliability Enterprise Edition (formerly Relex) that allows bypassing access control due to missing authentication for a critical function. It affects versions from 11.1 through 13.1 inclusive. The vulnerability has a high CVSS 4.0 score of 9.3, indicating network exploitable, no privileges or user interaction required, with high impact on confidentiality, integrity, and availability. No public exploits are known, and no patch information is currently provided.

A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill PDMlink and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data.  * This advisory also applies to all CPS versions * The identified vulnerability also impacts Windchill and FlexPLM releases prior to 11.0 M030

A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data. This issue affects Windchill PDMLink: 11.0 M030, 11.1 M020, 11.2.1.0, 12.0.2.0, 12.1.2.0, 13.0.2.0, 13.1.0.0, 13.1.1.0, 13.1.2.0, 13.1.3.0; FlexPLM: 11.0 M030, 11.1 M020, 11.2.1.0, 12.0.0.0, 12.0.2.0, 12.0.3.0, 12.1.2.0, 12.1.3.0, 13.0.2.0, 13.0.3.0.

EPSS 0.8%VulnerabilityPTC#cwe-94United States+11

Missing Authorization vulnerability in hcaptcha hCaptcha for WP hcaptcha-for-forms-and-more allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects hCaptcha for WP: from n/a through <= 4.21.1.

The MTCaptcha WordPress Plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.7.2. This is due to missing or incorrect nonce validation on the settings update functionality. This makes it possible for unauthenticated attackers to update the plugin settings, including sensitive values like the private key, via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

Drawing-Captcha APP provides interactive, engaging verification for Web-Based Applications. The vulnerability is a Host Header Injection in the /register and /confirm-email endpoints. It allows an attacker to manipulate the Host header in HTTP requests to generate malicious email confirmation links. These links can redirect users to attacker-controlled domains. This vulnerability affects all users relying on email confirmation for account registration or verification. This vulnerability is fixed in 1.2.5-alpha-patch.

EPSS 0.5%VulnerabilityDrawing-Captcha#cwe-601Germany+7

Cross-Site Request Forgery (CSRF) vulnerability in captcha.soft Image Captcha image-captcha allows Cross Site Request Forgery.This issue affects Image Captcha: from n/a through <= 1.2.

The hCaptcha for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's cf7-hcaptcha shortcode in all versions up to, and including, 4.0.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.