PT-2026-1474

Name of the Vulnerable Software and Affected Versions BoldGrid Post and Page Builder versions through 1.27.9 Description An authorization issue exists in BoldGrid Post and Page Builder. The issue involves incorrectly configured access control security levels, potentially allowing unauthorized...

PT-2026-1363

Name of the Vulnerable Software and Affected Versions Download Manager plugin for WordPress versions prior to 3.3.41 Description The Download Manager plugin for WordPress is susceptible to privilege escalation, potentially leading to account takeover. The issue stems from insufficient user identi...

PT-2026-1529

Name of the Vulnerable Software and Affected Versions versions prior to 2025-47334 Description A memory corruption issue exists when processing shared command buffer packets between the camera userspace and kernel. This can potentially lead to system instability or compromise. The issue involves ...

CVE-2025-69228

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below allow a request to be crafted in such a way that an AIOHTTP server's memory fills up uncontrollably during processing. If an application includes a handler that uses the Request.post method, ...

PT-2026-1526

Name of the Vulnerable Software and Affected Versions affected versions not specified Description An information disclosure issue exists when processing a firmware event. Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability...

PT-2026-1365

Name of the Vulnerable Software and Affected Versions Modem affected versions not specified Description A flaw exists in Modem that may lead to a remote denial of service. This issue stems from a read of uninitialized heap data caused by an uncaught exception. An attacker can exploit this by havi...

PT-2026-1480

Name of the Vulnerable Software and Affected Versions StellarWP The Events Calendar versions through 6.15.12.2 Description A missing authorization issue exists in StellarWP The Events Calendar, allowing exploitation of incorrectly configured access control security levels. Recommendations Update...

CVE-2025-69227

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below allow for an infinite loop to occur when assert statements are bypassed, resulting in a DoS attack when processing a POST body. If optimizations are enabled -O or PYTHONOPTIMIZE=1, and the...

PT-2026-1536

Name of the Vulnerable Software and Affected Versions affected versions not specified Description A cryptographic issue may occur while encrypting license data. Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability...

PT-2026-1410

Name of the Vulnerable Software and Affected Versions URL Image Importer plugin for WordPress versions up to and including 1.0.7 Description The URL Image Importer plugin for WordPress is susceptible to Stored Cross-Site Scripting through SVG file uploads. Insufficient sanitization of SVG files...

PT-2026-1528

Name of the Vulnerable Software and Affected Versions versions prior to 2025 Description A memory corruption issue exists when handling buffer mapping operations within the cryptographic driver. The issue involves a flaw in how the driver manages memory, potentially leading to crashes or unexpect...

CVE-2025-69226

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below enable an attacker to ascertain the existence of absolute path components through the path normalization logic for static files meant to prevent path traversal. If an application uses...

CVE-2025-69224 AIOHTTP's Unicode processing of header values could cause parsing discrepancies

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below of the Python HTTP parser may allow a request smuggling attack with the presence of non-ASCII characters. If a pure Python version of AIOHTTP is installed i.e. without the usual C extensions ...

EUVD-2026-0824

Craft is a platform for creating digital experiences. Versions 5.0.0-RC1 through 5.8.20 and 4.0.0-RC1 through 4.16.16 are vulnerable to potential authenticated Remote Code Execution via malicious attached Behavior. Note that attackers must have administrator access to the Craft Control Panel for...

CVE-2025-68455

CVE-2026-25498 is a Craft CMS RCE issue exploiting assembleLayoutFromPost() in fmt/src/services/Fields.php, where un-sanitized user configuration data passed to Craft::createObject() enables authenticated admins to inject dangerous Yii2 behavior and execute commands. Affected: Craft 4.x up to 4.1...

CVE-2025-68436 Craft CMS vulnerable to potential information disclosure via unchecked asset relocation

Craft is a platform for creating digital experiences. In versions 5.0.0-RC1 through 5.8.20 and 4.0.0-RC1 through 4.16.16, authenticated users on a Craft installation could potentially expose sensitive assets via their user profile photo via maliciously crafted requests. Users should update to the...

CVE-2025-64424 Colify has command injection vulnerability in project git source

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. In Coolify versions up to and including v4.0.0-beta.434, a command injection vulnerability exists in the git source input fields of a resource, allowing a low privileged user member to execute syst...

CVE-2025-64424

CVE-2025-64424 affects Coolify up to v4.0.0-beta.434, enabling a low-privileged user to run commands as root via a command-injection in the git source input fields of a resource. Several connected sources corroborate the vulnerability class and affected components; remediation notes indicate fixe...

EUVD-2026-0826

A malicious actor with access to the adjacent network could overflow the UniFi Protect Application Version 6.1.79 and earlier discovery protocol causing it to restart. Affected Products: UniFi Protect Application Version 6.1.79 and earlier. Mitigation: Update your UniFi Protect Application to...

EUVD-2024-28436

Improper Validation of Specified Quantity in Input vulnerability in SaasProject Booking Package allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Booking Package: from n/a through 1.6.27...