PT-2026-66544

Name of the Vulnerable Software and Affected Versions Leantime version 3.6.2 Description An authenticated attacker can perform server-side request forgery SSRF and local file inclusion LFI by providing unsanitized filenames to the file get contents function within the Blueprints::import method...

PT-2026-66600

Name of the Vulnerable Software and Affected Versions Wolf CMS versions prior to 0.8.3.2 Description An issue in the FileManagerController allows authenticated attackers with the file manager mkfile capability to achieve remote code execution. This is possible due to missing file extension...

PT-2026-66613

Name of the Vulnerable Software and Affected Versions ansible-collection-redhat-leapp affected versions not specified Description A flaw exists where an attacker with privileged write access to a managed node's Leapp report content can manipulate the data. When an operator executes a specific...

PT-2026-66487

Name of the Vulnerable Software and Affected Versions IBM App Connect Enterprise versions 13.0.1.0 through 13.0.7.2 IBM App Connect Enterprise versions 12.0.1.0 through 12.0.12.27 Description A remote attacker can perform directory traversal on the system. By sending a specially crafted URL reque...

CVE-2026-12947: Insertion of Sensitive Information into Log File

IBM App Connect Enterprise 13.0.1.0 through 13.0.7.2, and 12.0.1.0 through 12.0.12.27 stores potentially sensitive information in log files that could be read by a local user...

CVE-2026-44100: Missing Authentication for Critical Function

The CHARX JupiCore service allows an unauthenticated remote attacker to reconfigure charging points. This can lead to disclosure of charging point UIDs, Denial-of-Service and files tampering...

PT-2026-76092

ImageMagick before 7.1.2-15 and 6.9.13-40 contains a memory leak in coders/txt.c when processing TXT files with texture attributes: the texture object allocated via ReadImage is not released when GetTypeMetrics fails, leaking memory each time a crafted TXT file with a texture attribute is process...

PT-2026-76104

ImageMagick before 7.1.2-26 contains a policy bypass vulnerability in the APNG encoder and external delegates due to missing validation checks. Attackers can write files to disallowed paths by bypassing configured policy restrictions through the APNG encoding process...

PT-2026-76098

ImageMagick before 7.1.2-24 contains an incorrect policy check that allows attackers to create or truncate files disallowed by security policies. Remote attackers can bypass path policy restrictions in sandboxed conversion services to write arbitrary files outside intended boundaries...

vim security update

8.2.2637-26.0.1.el98.13 - Remove upstream references Orabug: 31197557 2:8.2.2637-26.13 - RHEL-203985 CVE-2026-59858 vim: arbitrary Ex command execution in C omni-completion - RHEL-201197 CVE-2026-59856 vim: potential command execution in PHP omni-completion 2:8.2.2637-26.12 - RHEL-191367...

vim security update

9.1.083-9.0.1.el102.12 - Remove upstream references Orabug: 31197557 2:9.1.083-9.12 - RHEL-201113 CVE-2026-59856 vim: potential command execution in PHP omni-completion 2:9.1.083-9.11 - RHEL-203857 CVE-2026-59858 vim: arbitrary Ex command execution during C omni-completion 2:9.1.083-9.10 -...

PT-2026-76105

ImageMagick before 7.1.2-26 and 6.9.13-x before 6.9.13-51 contains a policy bypass vulnerability in the -script operation due to missing security policy checks. This allows reading files from paths that are otherwise disallowed by the configured security policy...

PT-2026-76067

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-48 and 7.1.2-24, an incorrect parsing of the filename can result in a policy bypass and read files disallowed by a security policy using a symlink. This issue has been patched i...

PT-2026-66483

IBM App Connect Enterprise 13.0.1.0 through 13.0.7.2, and 12.0.1.0 through 12.0.12.27 stores potentially sensitive information in log files that could be read by a local user...

CVE-2026-12942: Improper Limitation of a Pathname to a Restricted Directory

IBM Langflow OSS 1.0.0 through 1.10.1 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot " sequences /.. / to view arbitrary files on the system...

Gitea Code Execution

The vulnerability of the services/repository/files/patch.go file in the Git repository management system Gitea is related to improper code generation management. Exploiting this vulnerability allows an attacker who operates remotely to execute arbitrary code and gain unauthorized access to...

PT-2026-66539

Name of the Vulnerable Software and Affected Versions IBM Langflow OSS versions 1.0.0 through 1.10.1 Description A directory traversal issue allows a remote attacker to view arbitrary files on the system. This is achieved by sending a specially crafted URL request containing dot-dot-slash /../...

PT-2026-66425

Name of the Vulnerable Software and Affected Versions Phoenix Contact CHARX SEC-3150 affected versions not specified Description A low-privileged remote attacker with operator access can upload arbitrary files through the REST endpoint used for firmware updates. This allows for the persistent...

PT-2026-66517

Name of the Vulnerable Software and Affected Versions Apache Kyuubi versions 1.7.0 through 1.11.1 Description Improper handling of REST batch multipart uploads allows a remote attacker to use path traversal sequences in the client-supplied filename. This can lead to the server writing controlled...

PT-2026-66629

Name of the Vulnerable Software and Affected Versions SFTPGo versions prior to 2.7.4 Description Authenticated users can bypass per-directory access controls by creating symbolic links in a permitted directory that point to files in restricted directories where download, upload, or overwrite...