PT-2026-127735

A vulnerability was detected in a2ui-project a2ui up to 0.10.6. Affected is the function DataContext.dispatchExpressionError of the file renderers/web core/src/v0 9/rendering/data-context.ts of the component Error Handler. Performing a manipulation results in information exposure through error...

PT-2026-127812

The Product Designer for WooCommerce WordPress | Lumise plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.1.2 via the process checkout function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the...

PT-2026-128100

In the Linux kernel, the following vulnerability has been resolved: ntfs: fix incorrect MFT record pointer passed to ntfs attr record resize ntfs new attr flags passes the wrong MFT record to ntfs attr record resize. When the attribute is in an extent record, ctx-mrec points to the extent but the...

PT-2026-128116

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 5.15.224 Description An issue exists in the virtio transport recv pkt function where the fallback mechanism for looking up sockets in the bound table fails to validate the source address. This allows a response...

PT-2026-128118

In the Linux kernel, the following vulnerability has been resolved: s390/pai: Handle multiple PMU stop callback invocations Handle the following scenario: The kernel protects itself against a very high sampling load and throttles the sampling using: perf event throttle -- PMU-stop Shortly later t...

PT-2026-128124

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.1.191 Linux kernel versions prior to 6.6.161 Description A quota enforcement bypass exists in the XFS file system. A user can evade group quota limits and exceed the hard limit by changing a file's group ID to...

PT-2026-128136

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.6.161 Description An out-of-bounds memory access issue exists in the tracing predicate parser. The predicate parse function incorrectly uses an increased value to reserve terminal TRUE and FALSE entries as the...

PT-2026-127862

The The Innovative Form Builder – IvyForms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.5.1 via the filterFiletypeAndExt function. This is due to insufficient file type validation due to the absence of a dangerous-extension denylist in the...

PT-2026-128328

Ultralytics check det dataset Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ultralytics. User interaction is required to exploit this vulnerability in that the target must visit a malicious pag...

PT-2026-128327

Ultralytics torch load Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ultralytics. User interaction is required to exploit this vulnerability in that the target must visit a...

PT-2026-128321

Alpine iLX-F511 Framework Service Exposed Dangerous Function Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Alpine iLX-F511 devices. Authentication is not required to exploit this vulnerability. The...

PT-2026-128331

Ultralytics load dataset cache file Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ultralytics. User interaction is required to exploit this vulnerability in that the target...

PT-2026-128342

Name of the Vulnerable Software and Affected Versions HTTP::Body versions prior to 1.23 01 Description CPU exhaustion can occur when parsing chunked request bodies. In chunked mode, which is utilized when no content length is provided, the add function matches each chunk-size line using a regular...

PT-2026-129084

Name of the Vulnerable Software and Affected Versions MIME::Words versions prior to 5.521 Description A memory exhaustion issue exists in the decode mimewords function. When the function encounters repeated "=?" sequences that do not start a complete encoded word, it appends an error message...

UBUNTU-CVE-2026-99138

In the Linux kernel, the following vulnerability has been resolved: tcp: fix use-after-free in dotcpgetsockoptTCPCCINFO dotcpgetsockopt reads icsk-icskcaops and dereferences the getinfo function pointer without rcureadlock. With BPF structops congestion control, caops can point to dynamically...

PT-2026-130623

Name of the Vulnerable Software and Affected Versions Bot for Telegram on WooCommerce versions prior to 1.3.1 Description An authentication bypass exists that allows unauthenticated attackers to take over any account, including administrators, using only a username. The issue occurs because the...

PT-2026-129213

Name of the Vulnerable Software and Affected Versions AVideo versions prior to 8.1.0 Description An unauthenticated remote attacker can achieve operating-system command execution as the web-server user. The issue exists in the live-streaming endpoint view/videosListToLive.php, which accepts an...

CVE-2026-109590: magepeopleteam Travelly – Tour & Travel Booking Manager for WooCommerce: The Tour Booking Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'width', 'height'…

The Tour Booking Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'width', 'height' and 'zoom' shortcode attributes of the ttbm-hotel-map shortcode in versions up to, and including, 2.3.6 This is due to insufficient input sanitization and output escaping on user...

Ultralytics deserialization injection vulnerability

Version 8.4.65 of Ultralytics contains a deserialization injection vulnerability. This flaw arises because the loaddatasetcachefile function fails to validate user-supplied data, allowing untrusted data to be deserialized. As a result, remote attackers may execute arbitrary code within the contex...

King-Themed Product Designer for WooCommerce WordPress | Lumise path traversal vulnerability

King-Themed Product Designer for WooCommerce WordPress | Lumise versions 2.1.2 and earlier contain a path traversal vulnerability. This vulnerability stems from directory traversal in the processcheckout function. Unauthenticated attackers can exploit this flaw by using the /?lumise=ajax...