PT-2026-70257

TypeBot is a chatbot builder tool. Prior to version 3.17.0, the Google Sheets OAuth callback decodes a base64-encoded JSON state parameter and trusts the embedded workspaceId, typebotId, blockId, and redirectUrl without cryptographic integrity protection or authorization checks. The callback rout...

PT-2026-70158

FreeRDP before 3.30.0 contains an out-of-bounds vulnerability in kerberos DecryptMessage winpr/libwinpr/sspi/Kerberos/kerberos.c. The 16-bit EC extra count field of a peer-supplied GSS Wrap token RFC 4121 is used directly in pointer arithmetic to locate the encrypted regions without being...

Linux Distros Unpatched Vulnerability : CVE-2026-72745

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FreeRDP before 3.30.0 contains an out-of-bounds vulnerability in kerberosDecryptMessage winpr/libwinpr/sspi/Kerberos/kerberos.c. The 16-bit EC extra count field...

PT-2026-70557

Name of the Vulnerable Software and Affected Versions Windows DNS affected versions not specified Description An out-of-bounds write in Windows DNS allows an unauthorized attacker to execute arbitrary code over an adjacent network, which can affect the system. Recommendations At the moment, there...

PT-2026-70181

A vulnerability has been identified in Solid Edge SE2025 All versions V225.0 Update 15, Solid Edge SE2026 All versions V226.0 Update 7. The affected applications contains an out of bounds write vulnerability while parsing specially crafted DFT files. This could allow an attacker to execute code i...

PT-2026-70904

An unauthenticated remote code execution vulnerability was identified in GMS 9.5.1 Build 9510.1044 and earlier versions which allows remote attacker to read sensitive data and perform arbitrary file write via zipslip...

Intel® Slim Bootloader Advisory

Summary: Potential security vulnerabilities in the Intel® Slim Bootloader may allow denial of service or information disclosure. Intel is releasing firmware updates to mitigate these potential vulnerabilities. Vulnerability Details: CVEID: CVE-2026-28729 Description: Integer overflow in the UEFI...

PT-2026-70986

OriginLab OriginPro OPJ File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability...

PT-2026-70985

OriginLab OriginPro OPJU File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability...

PT-2026-70987

OriginLab OriginPro OGG File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability...

PT-2026-70834

CVAT is an open source interactive video and image annotation tool for computer vision. From 2.17.0 until 2.72.0, a user with write access to a CVAT job can submit a batch automatic annotation request to RequestViewSet.create with inconsistent task and job IDs, and because the task ID determines...

VulnCheck KEV: CVE-2026-49049

The Helix3 plugin for Joomla exposes an ajax handler task, that allows unauthenticated attackers to delete arbitrary files, write arbitrary JSON files and update template parameters...

PT-2026-70992

Name of the Vulnerable Software and Affected Versions Wazuh Manager affected versions not specified Description A deserialization of untrusted data issue exists in the Cluster DAPI Protocol, which allows a remote attacker to execute arbitrary code and perform arbitrary file read and write...

PT-2026-70351

is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain limited unauthorized read and write access, causing a limited disruption to availability. Exploitation of this...

Fedora 44 : chromium (2026-eebdfdf5ba)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-eebdfdf5ba advisory. chromium-151.0.7922.108 security release fix 41 CVE CVE-2026-19137: Use after free in WebGL CVE-2026-19138: Heap buffer overflow in CrashReporting...

PT-2026-70837

An issue in MongoDB Server's handling of certain query predicates against time-series collections with a metaField could allow an authenticated user with write access to cause the server process to terminate unexpectedly, resulting in a denial of service...

PT-2026-70252

Name of the Vulnerable Software and Affected Versions Docker affected versions not specified Description An issue known as CopyEscape allows for an arbitrary file write from a container to the host system. This occurs through the use of the docker cp command, which can be leveraged to write files...

PT-2026-70186

A vulnerability has been identified in Solid Edge SE2025 All versions V225.0 Update 15, Solid Edge SE2026 All versions V226.0 Update 7. The affected applications contains an out of bounds write vulnerability while parsing specially crafted PSM files. This could allow an attacker to execute code i...

PT-2026-70898

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.30.0, FreeRDP's winpr/libwinpr/sspi/Kerberos/kerberos.c kerberos DecryptMessage function fails to bound the peer-controlled GSS Wrap-token EC field before using it with RRC in IOV pointer offsets, allowing a malicious RDP...

PT-2026-70164

n8n versions before 1.123.67, 2.31.5, and 2.32.1 contain an arbitrary file write vulnerability in the Edit Image node, which passes its output format parameter to the underlying image library without validation. An authenticated user able to run workflows can supply a crafted format value to writ...