PT-2026-92183

Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 10.1.0 through 19.1.7 GitLab CE/EE versions 19.2 through 19.2.5 GitLab CE/EE versions 19.3 through 19.3.1 Description Improper authorization checks on internal data emission endpoints could allow an authenticated user to...

JFrog Artifactory < 7.111.20 / 7.117.x < 7.117.27 / 7.125.x < 7.125.19 / 7.133.x < 7.133.28 / 7.146.x < 7.146.35 Improper Authentication

According to its self-reported version number, the version of JFrog Artifactory installed on the remote host is prior to 7.111.20, 7.117.x prior to 7.117.27, 7.125.x prior to 7.125.19, 7.133.x prior to 7.133.28, or 7.146.x prior to 7.146.35. It is, therefore, affected by an improper authenticatio...

PT-2026-92329

Name of the Vulnerable Software and Affected Versions The product name cannot be determined. affected versions not specified Description A logic error in the code across multiple locations allows for a local escalation of privilege. This issue enables an attacker to gain System execution privileg...

PT-2026-92194

pdfforge PDF Architect PDF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of pdfforge PDF Architect. User interaction is required to exploit this vulnerability in that the target...

PT-2026-92410

Name of the Vulnerable Software and Affected Versions Devolutions Server versions prior to 2026.2.17 Description Improper access control in the vault entry listing feature allows an authenticated user who does not have the view-password permission to obtain cleartext passwords. This is achieved b...

PT-2026-93223

Name of the Vulnerable Software and Affected Versions Secret Server affected versions not specified Description Under certain conditions, a valid SAML IdP response may be used to impersonate another user. SAML Security Assertion Markup Language is an XML-based standard for exchanging authenticati...

PT-2026-92291

Name of the Vulnerable Software and Affected Versions Cellular Modem affected versions not specified Description A heap buffer overflow in the Cellular Modem allows for an out-of-bounds write. This issue can be exploited without user interaction to achieve remote escalation of privilege without...

PT-2026-92715

Name of the Vulnerable Software and Affected Versions Oracle Siebel CRM versions 17.0 through 26.7 Description A flaw exists in the Open UI component of the Siebel CRM End User product. This issue allows an unauthenticated attacker with network access via HTTP to compromise the system, which coul...

PT-2026-92166

Concrete CMS 9.2.0 to 9.5.2 did not enforce per-field edit user properties permissions on the REST API user write endpoints PUT /ccm/api/1.0/users/uID and POST /ccm/api/1.0/users/uID/change password. A user with an update-scoped OAuth token and permission to edit only one non-sensitive field coul...

PT-2026-92612

Name of the Vulnerable Software and Affected Versions Oracle Database Server versions 23.4.0 through 23.26.3 Description A flaw exists in the RDBMS component of the Oracle Database Server. An authenticated attacker with low privileges and network access via Oracle Net can exploit this issue to...

PT-2026-92021

An issue was discovered in Keyfactor SignServer before 7.6.0. A number of properties were identified to not have any restrictions to what path they can be set to by an admin user. Setting these properties to specific file paths can reveal information to the client side. Three specific properties...

PT-2026-93100

Name of the Vulnerable Software and Affected Versions Oracle VM VirtualBox version 7.2.16 Description A flaw in the Core component allows a high privileged attacker with access to the infrastructure where the software executes to compromise the system. The attack requires human interaction from a...

PT-2026-93094

Name of the Vulnerable Software and Affected Versions Oracle VM VirtualBox version 7.2.16 Description A flaw in the Core component allows a low-privileged attacker with access to the infrastructure where the software executes to compromise the system. Exploitation is difficult and requires human...

PT-2026-92387

Incorrect privilege assignment in the admin user-management component of Webkul Bagisto 2.4.9 allows an authenticated backend user holding only the settings.users.edit permission to escalate to full administrator. The user-update endpoint route admin.settings.users.update, UserController::update...

EUVD-2026-79300

Incorrect privilege assignment in the admin user-management component of Webkul Bagisto 2.4.9 allows an authenticated backend user holding only the settings.users.edit permission to escalate to full administrator. The user-update endpoint route admin.settings.users.update, UserController::update...

CVE-2026-91998: Incorrect Authorization

Casdoor through 4.4.0 contains an authorization bypass vulnerability in the /api/mcp endpoint that allows attackers with any application's clientId and clientSecret to gain unrestricted access to user administration across all organizations. Attackers can enumerate user records including password...

CVE-2026-48722: Incorrect Default Permissions

Nextflow is a DSL for data-driven computational pipelines. From 25.09.2-edge until 25.10.6 and 26.04.3, nextflow auth login writes Seqera Platform OIDC bearer tokens to $NXFHOME:-/.nextflow/seqera-auth.config through AuthCommandImpl.writeConfig in...

CVE-2026-56920: Out-of-bounds Write

In sdecodevuiparam of fwhevcdecheader.c, there is a possible out-of-bounds write due to a logic error in the code. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-55343: Buffer Copy without Checking Size of Input

In decodeAmr of ImsMediaAudioPlayer.cpp, there is a possible out-of-bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation...

PT-2026-92330

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description An out-of-bounds write can occur in the Start function of AudioRtpPayloadEncoderNode.cpp due to improper input validation. This issue may allow remote code...