PT-2026-70027

Name of the Vulnerable Software and Affected Versions SAP NetWeaver Application Server Java Adobe Document Service affected versions not specified Description The Adobe Document Service component uses outdated open source cryptographic and data transfer libraries. A low-privileged authenticated...

PT-2026-70600

Name of the Vulnerable Software and Affected Versions Microsoft Exchange Server affected versions not specified Description A heap-based buffer overflow allows an authorized attacker to execute arbitrary code over a network, which can affect the system. A heap-based buffer overflow occurs when a...

PT-2026-70545

Name of the Vulnerable Software and Affected Versions Windows NTFS affected versions not specified Description An out-of-bounds read in Windows NTFS allows an authorized attacker to disclose sensitive information locally, which can affect the system. Recommendations At the moment, there is no...

PT-2026-70544

Name of the Vulnerable Software and Affected Versions Windows LDAP affected versions not specified Description A use after free issue in the Lightweight Directory Access Protocol LDAP allows an unauthorized attacker to execute arbitrary code over a network, potentially affecting the system...

PT-2026-70242

A flaw was found in the oauth-server component. This open redirect vulnerability occurs when the 'then' parameter in the grant approval handler is not properly validated. A remote attacker can craft a malicious URL that, when approved or denied by an authenticated user, redirects them to an...

PT-2026-70759

Improper input validation in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information locally...

PT-2026-70649

Improper neutralization of special elements used in a command 'command injection' in Microsoft Office allows an unauthorized attacker to execute code locally...

PT-2026-70704

Name of the Vulnerable Software and Affected Versions Microsoft Office SharePoint affected versions not specified Description Deserialization of untrusted data allows an authorized attacker to execute arbitrary code over a network, which can affect the system. Deserialization is the process of...

PT-2026-70187

Name of the Vulnerable Software and Affected Versions LOGO! Soft Comfort versions prior to V9 Description Products use a static, hardcoded AES master key to encrypt project files. A local attacker could extract this master key from the application files or memory to decrypt project files or remov...

PT-2026-70575

Name of the Vulnerable Software and Affected Versions Windows DNS affected versions not specified Description A stack-based buffer overflow in Windows DNS allows an unauthorized attacker to execute arbitrary code over a network, which can affect the system. A stack-based buffer overflow occurs wh...

The vulnerability of the `_flatten` and `_isEqual` functions in the JavaScript library for working with arrays, Underscore, allows attackers to cause a service failure.

The vulnerability of the flatten and isEqual functions in the JavaScript library for working with arrays, Underscore, is related to the allocation of unlimited memory. Exploiting this vulnerability could allow a remote attacker to cause a service failure...

PT-2026-70596

Name of the Vulnerable Software and Affected Versions .NET affected versions not specified Description An uncaught exception in .NET allows an authorized attacker to elevate privileges locally. Recommendations At the moment, there is no information about a newer version that contains a fix for th...

PT-2026-70558

Name of the Vulnerable Software and Affected Versions Active Directory Certificate Services affected versions not specified Description A use after free issue in Active Directory Certificate Services allows an authorized attacker to execute arbitrary code over a network, which can affect the...

PT-2026-70705

Name of the Vulnerable Software and Affected Versions Microsoft Office Word affected versions not specified Description An off-by-one error occurs when a program writes or reads one element past the end of an array, which can lead to memory corruption or information disclosure. In this case, the...

PT-2026-70639

Integer overflow or wraparound in Microsoft Office allows an unauthorized attacker to execute code locally...

CVE-2026-72918

Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 7.10.14, 8.0.8, 8.1.7, 8.2.7, 8.3.7, 8.4.5, 8.5.2, and 8.6.1, the stream-notify-user stream in the WebSocket protocol allows an authenticated user to write arbitrary notification bodies because the sender ...

CVE-2026-15467

A flaw was found in the trustyai-service-operator's LMEvalJob controller. An authenticated user within the cluster can exploit this vulnerability by configuring a sidecar container to bypass existing security policies. This allows the user to enable and execute untrusted remote code, leading to...

EUVD-2026-55825

A flaw was found in ml-metadata. The statically-linked gRPC stack in ml-metadata is outdated, making it vulnerable to known HTTP/2 denial of service DoS issues. An in-cluster attacker, with network access to the MLMD pod, could exploit these vulnerabilities by sending specially crafted HTTP/2...

CVE-2026-72885

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, dockerContextPath accepted by apps/dokploy/components/dashboard/application/build/show.tsx flows through getDockerContextPath in packages/server/src/utils/filesystem/directory.ts into the unquoted cd command in...

CVE-2025-13294

An unauthenticated SQL injection vulnerability exists in the web server of TBEA TLogger V2.1.0.0B0.0.0.0. Multiple HTTP endpoints incorporate attacker-controlled parameters directly into SQLite queries without sufficient validation or parameterization. A remote unauthenticated attacker can exploi...