PT-2026-70324

Heap-based buffer overflow for the IntelR Open Volume Kernel Library IntelR Open VKL library maintained by intelR before version 2.0.2 within Ring 3: User Applications may allow a denial of service. System software adversary with an authenticated user combined with a low complexity attack may...

PT-2026-70169

n8n before 1.123.67, 2.x before 2.31.5, and 2.32.x before 2.32.1 contain a remote code execution vulnerability in the Git node. Authenticated users with rights to create and execute workflows can stage a crafted local repository that causes git to run hooks under default git security settings,...

PT-2026-70138

Name of the Vulnerable Software and Affected Versions BadChoice Handesk versions prior to 2026-07-10 Description Broken access control allows authenticated agents to overwrite lead records belonging to other teams. This occurs because the 'LeadsController@update' endpoint lacks authorization chec...

PT-2026-70154

A stored SQL injection vulnerability in Koha through 24.11.17, 25.05.12, 25.11.06, and 26.05.01 allows authenticated staff with the tools = label creator permission to execute arbitrary SQL via the image name field of a patron card layout. The image name value is stored verbatim in the layout XML...

PT-2026-70141

Name of the Vulnerable Software and Affected Versions Friendica versions prior to 2026.08-dev Description An authenticated user with a self-registered account can perform a server-side request forgery SSRF through the link-preview endpoint. This occurs because the endpoint fetches user-supplied...

PT-2026-70855

An issue in MongoDB Server's query planner could allow an authenticated user with read-level privileges to cause the server process to terminate unexpectedly by submitting a specially formed query against a collection with a text index. This could result in a denial of service, affecting connecte...

PT-2026-70332

Improper input validation for some vLLM Hardware Plugin for IntelR GaudiR software before version 0.16.0 within Ring 3: User Applications may allow a denial of service. Authorized adversary with an authenticated user combined with a low complexity attack may enable denial of service. This result...

PT-2026-70051

Name of the Vulnerable Software and Affected Versions SAP NetWeaver Application Server ABAP affected versions not specified Description An authenticated attacker can generate and distribute a malicious link. When an authenticated victim accesses this link, injected input is processed and reflecte...

CVE-2026-51583

The connected sources confirm a concrete vulnerability: in usememos up to v0.30.0, an authenticated remote user can leverage a flaw in the Webhook validation (internal/webhook/validate.go) to perform SSRF by targeting internal addresses. This is a server-side issue that arises from how webhook ta...

PT-2026-70133

Name of the Vulnerable Software and Affected Versions CiviCRM versions prior to 6.18.alpha1 Description An SQL injection issue exists where the contact search RLIKE clause concatenates user-supplied values into a SQL query without proper sanitization. This allows authenticated users with...

PT-2026-70239

Name of the Vulnerable Software and Affected Versions NETGEAR R7000 affected versions not specified Description Insufficient input validation allows authenticated administrators connected to the local network to make unauthorized modifications to the router software and functionality...

EUVD-2026-56176

An issue in usememos through v0.30.0 allows a remote authenticated attacker to perform Server-Side Request Forgery SSRF via the Webhook validation mechanism in internal/webhook/validate.go, by setting a webhook target to an internal address...

PT-2026-70027

Name of the Vulnerable Software and Affected Versions SAP NetWeaver Application Server Java Adobe Document Service affected versions not specified Description The Adobe Document Service component uses outdated open source cryptographic and data transfer libraries. A low-privileged authenticated...

PT-2026-70850

An issue in MongoDB Server's handling of timeseries collections could allow an authenticated user with write privileges to cause an internal data structure to become inconsistent through certain document insertions. A subsequent insert into the affected bucket could then result in the server...

PT-2026-70134

Name of the Vulnerable Software and Affected Versions HortusFox version 5.9 Description A stored cross-site scripting issue allows authenticated workspace members to inject persistent JavaScript into plant notes. This occurs because Parsedown is rendered without safe mode, causing notes to be...

PT-2026-70227

Name of the Vulnerable Software and Affected Versions NETGEAR affected versions not specified Description A buffer overflow occurs when a program writes more data to a block of memory, or buffer, than it is designed to hold, potentially overwriting adjacent memory. In this case, the issue allows ...

PT-2026-70231

Name of the Vulnerable Software and Affected Versions NETGEAR affected versions not specified Description Insufficient input validation allows authenticated administrators connected to the local network to make unauthorized modifications to router software and functionality. Recommendations At th...

PT-2026-70228

Name of the Vulnerable Software and Affected Versions NETGEAR affected versions not specified Description A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than the buffer is allocated to hold, potentially overwriting adjacent memory. This issue...

PT-2026-70156

A stored SQL injection vulnerability in Koha through 24.11.17, 25.05.12, 25.11.06, and 26.05.01 allows authenticated staff with the borrowers = edit borrowers permission to cause a time-based denial of service by storing a SQL payload in a patron lang field. The value is concatenated raw into a...

PT-2026-70799

Name of the Vulnerable Software and Affected Versions Coturn versions prior to 4.13.1 Description The good peer addr function in src/server/ns turn server.c utilizes ioa addr in range in src/client/ns turn ioaddr.c without canonicalizing IPv4-compatible, 6to4, and 64:ff9b::/96 NAT64 address forms...