PT-2026-120228

adm-zip before 0.6.1 contains a denial of service vulnerability that allows unauthenticated attackers to crash the Node.js process via a malformed ZIP file, because inflateAsync in methods/inflater.js lacks a zlib stream error listener. Attackers can supply a ZIP with corrupted DEFLATE data...

PT-2026-120222

Dulwich from 0.24.0 before 1.2.8 contains a symlink following vulnerability in porcelain.checkoutpaths=... that allows attackers to write arbitrary files by abusing raw os.open without O NOFOLLOW. Attackers can craft a repository where a worktree symlink points to .git/hooks/post-checkout, so...

PT-2026-120220

Dulwich before 1.2.9 fails to validate DOS drive letter prefixes in Git tree path elements on Windows, allowing arbitrary file write. Attackers can craft a malicious repository with a tree entry named 'C:' that bypasses NTFS validation and writes files outside the worktree to achieve remote code...

PT-2026-120473

The WholesaleX WordPress plugin before 3.0.9 does not protect or remove the user-import file it keeps in a publicly accessible location under a predictable name, allowing unauthenticated users to download the most recently imported user data, including any account passwords and customer contact a...

Apache bRPC resource management error vulnerability

Versions of Apache bRPC prior to 1.18.0 contain a security vulnerability. This vulnerability arises because the built-in /flags service can be manipulated via ?setvalue= to alter the bvar/mbvar dump path; additionally, the bvardumptabs path is not properly sanitized. As a result, remote attackers...

CVE-2025-60469

A NULL pointer dereference in the gfac4presentationchmode function /mediatools/avparsers.c of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service DoS via supplying a crafted AC4 file...

CVE-2025-60497

A segmentation violation in the GetESD function /isomedia/track.c of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service DoS via supplying a crafted MP4 file...

PT-2026-120816

Name of the Vulnerable Software and Affected Versions EKKOLearnAI ekko-studio versions prior to 1.0.7 Description A flaw in the Media Generation API component allows remote exploitation via file inclusion. The issue exists within the saveGeneratedImages function located in the...

CVE-2025-71438

An out-of-bounds read in gfodfac4cfgdsiv1 /odf/descriptors.c in GPAC Project/MP4Box before v26.07.0 allows attackers to cause a Denial of Service DoS via supplying a crafted AC4 file...

CVE-2025-60489

A NULL pointer dereference in the dasherinserttimelineentry function /filters/dasher.c of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service DoS via supplying a crafted MP4 file...

CVE-2025-60478

A use-after-free in the gffilterpacketdestroy function /filtercore/filterpck.c of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service DoS via supplying a crafted MPEG-2 file...

PT-2026-122070

Name of the Vulnerable Software and Affected Versions Your Dress versions prior to 1.4.2 Description An improper control of filename for include/require statements in the PHP program allows for Local File Inclusion. This enables unauthenticated attackers to include and execute arbitrary files on...

PT-2026-120699

Name of the Vulnerable Software and Affected Versions Cisco Emergency Responder affected versions not specified Cisco Prime Collaboration Deployment affected versions not specified Cisco Unified Communications Manager Unified CM affected versions not specified Cisco Unified Communications Manager...

oretnom23 file-management-system-php input validation error vulnerability

The oretnom23 file-management-system-php versions 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4 and earlier contain a security vulnerability. This vulnerability stems from improper handling of the ID parameter by the readfile function in the download.php file of the File Download component, potentiall...

Atlassian Confluence < 9.2.5 (CONFSERVER-104458)

The version of Atlassian Confluence Server running on the remote host is affected by a vulnerability as referenced in the CONFSERVER-104458 advisory. - extract-zip through 2.0.1 containment-checks only the parent directory of each archive entry and never the entry's own final path component, so a...

FreeBSD : Emacs -- Local command injection via crafted file names in TRAMP (436ad1a7-ccc8-11f1-af18-c4ff99d93a55)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 436ad1a7-ccc8-11f1-af18-c4ff99d93a55 advisory. TRAMP Transparent Remote file Access, Multiple Protocol is a part of Emacs that provides an...

SUSE SLES15 Security Update : php-composer2 (SUSE-SU-2026:4589-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4589-1 advisory. - CVE-2026-59946: package bin entries with path segments can cause unintended host file permission modifications bsc1271152. -...

Linux Distros Unpatched Vulnerability : CVE-2026-109277

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ImageMagick before 7.1.2-32 contains a policy bypass vulnerability in the -script operation due to missing checks on file descriptor handling. Attackers can use...

AlmaLinux 8 : python3 (ALSA-2026:85239)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:85239 advisory. python: python: Arbitrary file deletion via race condition during temporary directory cleanup CVE-2026-12345 python: python: Certificate verification...

Linux Distros Unpatched Vulnerability : CVE-2026-109741

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use-after-free in the Storage: Bucket File System component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird...