Linux Distros Unpatched Vulnerability : CVE-2026-73213

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.16.0, addrlesseq in src/client/nsturnioaddr.c uses a component-wise comparison f...

PT-2026-71031

The ProSolution WP Client WordPress plugin before 2.0.9 does not perform capability checks on two administrative AJAX actions, and the nonce they rely on is published on its public frontend, allowing any authenticated user, such as a subscriber, to trigger an administrative data synchronisation a...

PT-2026-71223

Name of the Vulnerable Software and Affected Versions Dell Display and Peripheral Manager DDPM Windows versions prior to 2.3.0.17 Description Improper Access Control allows a low privileged attacker with local access to potentially achieve Elevation of Privileges and execute arbitrary code...

PT-2026-71242

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.7.4 Description Authenticated readers or anonymous users when publish authentication is disabled can exploit missing publish-access filtering across multiple endpoints. The endpoint '/api/av/getAttributeViewKeysByID'...

PT-2026-71133

Name of the Vulnerable Software and Affected Versions Apache Airflow versions prior to 3.3.1 Description In deployments using multi-team mode with a team-aware auth manager, the asset materialization endpoint POST /api/v2/assets/asset id/materialize and the XCom result check on wait dag run until...

PT-2026-71237

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.7.4 Description An issue exists where the software fails to filter embedded block content based on publish access permissions. While the initial requested block is checked for authorization, blocks pulled in via embe...

PT-2026-71334

The type=track branch authorises on is my caset attach.case only and never checks VinceTrackAttachment.shared. A coordinator-uploaded case artefact that has NOT been marked shared is still retrievable by any case member who has or is sent its uuid — leaks not-yet-released coordinator material to...

PT-2026-71029

The WP Photo Album Plus WordPress plugin before 9.2.09.002 does not check that the current user is allowed to upload into the album they target when it processes a front-end upload, allowing any authenticated user, such as a Subscriber, to upload files into albums owned by other users or by the...

PT-2026-76561

Name of the Vulnerable Software and Affected Versions Fleet versions prior to 4.87.0 Description The target search endpoint POST /api/latest/fleet/targets fails to sanitize data for users with Observer, Observer+, or Technician roles. This allows these users to retrieve unmasked team enroll secre...

PT-2026-71247

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.7.4 Description Insufficient publish-access checks on the 'getBlockBreadcrumb', 'getRefText', and 'getBlockTreeInfos' endpoints allow the disclosure of protected document content and metadata. Anonymous readers or...

PT-2026-71015

The WP Travel Engine WordPress plugin before 6.8.5 does not perform authorization or ownership checks when loading a caller-supplied booking identifier in one of its unauthenticated cart actions, allowing unauthenticated attackers to disclose any customer's booking order details and their stored...

PT-2026-71001

Name of the Vulnerable Software and Affected Versions KiviCare WordPress plugin versions prior to 4.5.2 Description An issue exists where the software fails to verify if the requesting user owns the records they are attempting to access. This allows authenticated users with patient-level privileg...

PT-2026-71129

Name of the Vulnerable Software and Affected Versions The product name cannot be determined. affected versions not specified Description A holder of a valid integration credential may impersonate other users under specific conditions. Recommendations At the moment, there is no information about a...

PT-2026-71003

Name of the Vulnerable Software and Affected Versions WP Crowdfunding WordPress plugin versions prior to 2.2.1 Description Authenticated users, including those with Subscriber roles, can modify the update history of campaigns they do not own and trigger notification emails to backers because the...

PT-2026-76592

Name of the Vulnerable Software and Affected Versions Drupal Diff versions 0.0.0 through 2.0.1 Drupal Diff versions 2.1.0 through 2.1.1 Description An incorrect authorization issue allows forceful browsing. The module does not sufficiently restrict access to non-node entity revision diffs. This...

Linux Distros Unpatched Vulnerability : CVE-2025-31938

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Insufficient granularity of access control in some subsystem for some IntelR XeonR 6 Scalable processors with IntelR TDX may allow an information disclosure...

Debian dsa-6434 : lemonldap-ng - security update

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6434 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6434-1 [email protected] https://www.debian.org/securit...

PT-2026-71238

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.7.4 Description An access control bypass exists in the server mux where several static-file routes bypass the publish-access controls enforced on the REST API. This allows attackers with publish reader tokens or...

PT-2026-71142

An unauthenticated user may access restricted artifacts in JFrog Artifactory under specific conditions...

PT-2026-71043

Velociraptor allows reading Stacked result sets from the GUI. Velociraptor's multi-tenant design stores sub orgs within the datastore directory. The path requested by the GUI is not correctly checked against the prefix deny list, allowing result sets to read from denied prefixes. In particular, a...