PT-2026-123159

A security flaw has been discovered in GouGuOA up to 6.1.2. The impacted element is the function chunkUpload of the file app/disk/controller/Api.php. The manipulation of the argument file extension results in unrestricted upload. It is possible to launch the attack remotely. The exploit has been...

PT-2026-123128

A vulnerability was found in itsourcecode Online Cake Ordering System 1.0. The affected element is an unknown function of the file /deletetransac.php. The manipulation of the argument ID results in sql injection. The attack may be performed from remote. The exploit has been made public and could ...

PT-2026-123148

A vulnerability was identified in Sony Neural Network Libraries up to 1.39.0. This affects the function load param in txt of the file python/src/nnabla/utils/cli/encode decode param.py of the component Encode Param Command Handler. Such manipulation leads to code injection. It is possible to laun...

PT-2026-123127

A vulnerability has been found in gougucms up to 4.08.18. Impacted is the function Add of the file app/admin/controller/Level.php of the component User Level Handler. The manipulation of the argument Title leads to cross site scripting. The attack is possible to be carried out remotely. The explo...

PT-2026-123149

A security flaw has been discovered in Sony Neural Network Libraries up to 1.39.0. This impacts the function func set nnabla version decorate of the file python/src/nnabla/utils/converter/utils.py of the component NNP Converter. Performing a manipulation of the argument function.type results in...

PT-2026-123153

A vulnerability was detected in Datafeedr Product Sets Plugin up to 1.3.24 on WordPress. Affected by this issue is the function dfrps ajax delete saved search of the file functions/ajax.php of the component AJAX Handlers. The manipulation results in missing authorization. The attack may be launch...

PT-2026-123204

A security vulnerability has been detected in Oray Pugongying X5 Pro 7.6.1. This impacts an unknown function of the component Dnsmasq. The manipulation of the argument rent time leads to crlf injection. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used...

PT-2026-123244

A vulnerability was identified in rathena FluxCP up to 98cd4b8fd83228c11b36fb3d097b8e0f7c105a8d. This issue affects the function verifyiprange of the file lib/Flux/PaymentNotifyRequest.php of the component PayPal IPN Handler. The manipulation of the argument X-Real-IP leads to origin validation...

PT-2026-123376

In the Linux kernel, the following vulnerability has been resolved: ASoC: samsung: i2s: enable op clk in probe to balance runtime PM The probe function puts the device into the runtime PM active state with only the "iis" bus clock enabled, but it also sets priv-op clk to the parent of the RCLK SR...

PT-2026-125479

Name of the Vulnerable Software and Affected Versions Furnace versions prior to 0.6.8.4 Description An out-of-bounds heap read occurs during the import of FamiTracker modules .ftm, .dnm, or 0CC/E-FamiTracker. The issue is triggered by an unbounded DPCM note count in the DivEngine::loadFTM functio...

PT-2026-125536

A vulnerability has been found in SourceCodester Online Food Ordering System 1.0. The affected element is an unknown function of the file admin/delete admin.php. The manipulation of the argument ID leads to missing authentication. It is possible to initiate the attack remotely. The exploit has be...

openSUSE 16: cluster-md-kmp-64kb / cluster-md-kmp-azure / cluster-md-kmp-default / etc (openSUSE-SU-2026:22167-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:22167-1 advisory. The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues: The following security issues were fixed: - CVE-2026-31731:...

PT-2026-125116

Name of the Vulnerable Software and Affected Versions erlang-jose versions 1.7.7 through 1.11.12 Description Inefficient algorithmic complexity allows an unauthenticated remote attacker to cause a CPU-exhaustion denial of service by submitting a crafted RSA JSON Web Key JWK. When an application...

PT-2026-125502

A vulnerability has been found in Argilla up to 2.8.0. The impacted element is an unknown function of the file argilla-frontend/components/features/annotation/container/fields/sandbox/Sandbox.vue. The manipulation of the argument template leads to cross site scripting. Remote exploitation of the...

PT-2026-123396

Open5GS 1.3.0 through 2.8.0 contains a heap out-of-bounds write vulnerability in parse multipart that allows unauthenticated attackers to corrupt memory by supplying an empty multipart boundary. Attackers can send a single crafted multipart/related request to the SBI interface of any network...

CVE-2026-115349

Mistune from 3.0.0 before 3.3.0 contains an algorithmic complexity denial of service vulnerability in the parselinktext function in src/mistune/helpers.py. Attackers can submit markdown with deeply nested square brackets triggering quadratic parsing time, exhausting server CPU with small crafted...

Linux kernel Heap Buffer Overflow DoS

The vulnerability in the kvms390giscregister function within the arch/s390/kvm/pci.c file of the Linux kernel kernel is related to an improper thread management implementation. Exploitation of this vulnerability may allow an attacker to cause a denial of service...

Security update for python-nltk (important)

openSUSE Security Update: Security update for python-nltk Announcement ID: openSUSE-SU-2026:0359-1 Rating: important References: 1227174 1232448 1273256 1274590 1276252 1276253 Cross-References: CVE-2024-39705 CVE-2025-14009 CVE-2026-12075 CVE-2026-12252 CVE-2026-12372 CVE-2026-12841 CVE-2026-715...

PT-2026-123411

A security flaw has been discovered in 2K Games Sid Meier's Civilization IV 1.0.12.68. The affected element is the function loadstring of the component Lua sandbox. Performing a manipulation results in type confusion. The attack may be initiated remotely. The exploit has been released to the publ...

PT-2026-125478

Name of the Vulnerable Software and Affected Versions libfvde versions prior to 20260923 Description A heap out-of-bounds read occurs in the libfvde encrypted metadata read type 0x001a function due to an unbounded strlen operation on embedded XML plist data. An attacker can trigger this by...