PT-2026-107691

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.4.3 Splunk Enterprise versions prior to 10.2.7 Splunk Enterprise versions prior to 10.0.10 Splunk Enterprise versions prior to 9.4.15 Description An improper access control issue exists in the REST API,...

PT-2026-107700

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.4.3 Splunk Enterprise versions prior to 10.2.7 Splunk Enterprise versions prior to 10.0.10 Description An authorization bypass exists in the Representational State Transfer REST API. A user with the edit...

Linux Distros Unpatched Vulnerability : CVE-2026-106420

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Incorrect calculation in API in Google Chrome on on Windows prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to spoof UI elements...

PT-2026-107563

LMCache through 0.5.5 contains a missing authentication vulnerability in the multiprocess coordinator that allows remote unauthenticated attackers to access its HTTP fleet control API listening on all interfaces by default. Attackers can register or deregister instances via /instances, overwrite...

PT-2026-107409

The WPCafe WordPress plugin before 3.0.21 does not restrict access to some of its REST API endpoints, allowing unauthenticated attackers to read WooCommerce product data, including per-product sales counts, exact stock levels, and private product meta, that WooCommerce itself keeps behind...

CVE-2026-106208

Missing authorization in API in Google Chrome prior to 155.0.8059.39 a...

PT-2026-107592

Name of the Vulnerable Software and Affected Versions Homer versions prior to 11.0.283 Description In default installations, the software fails to enforce authentication for protected API endpoints because the jwtSecret variable defaults to an empty string. When this variable is empty, the...

PT-2026-107591

Name of the Vulnerable Software and Affected Versions Homer versions prior to 11.0.283 Description In fresh deployments using internal authentication, the bootstrap process automatically creates an admin account with a hard-coded password sipcapture. This password is stored as a legacy SHA-256 he...

PT-2026-107609

Name of the Vulnerable Software and Affected Versions Cisco NX-OS Software affected versions not specified Description Insufficient input validation in the NX-API feature allows an unauthenticated remote attacker to execute arbitrary code with root privileges or trigger a denial of service DoS...

PT-2026-107687

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.4.3 Splunk Enterprise versions prior to 10.2.7 Splunk Enterprise versions prior to 10.0.10 Splunk Enterprise versions prior to 9.4.15 Splunk Secure Gateway versions prior to 3.10.11 Splunk Secure Gateway...

PT-2026-107693

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.4.3 Splunk Enterprise versions prior to 10.2.7 Splunk Enterprise versions prior to 10.0.10 Description A low-privileged user without admin or power roles can cause a denial of service against a REST API...

PT-2026-107689

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.4.3 Splunk Enterprise versions prior to 10.2.7 Splunk Enterprise versions prior to 10.0.10 Description A user with the read o11y content capability can inject forged entries into the app log via the REST...

PT-2026-107574

Gophish through 0.12.1 contains an insecure direct object reference vulnerability that allows authenticated users to take over other users' groups, templates, landing pages and sending profiles. Attackers can supply another user's sequential id in POST requests to /api/groups/, /api/templates/,...

PT-2026-107577

Gophish 0.11.0 through 0.12.1 contains a server-side request forgery vulnerability that allows authenticated low-privileged users to reach loopback and private hosts via POST /api/import/site. Attackers can submit internal URLs, which the default dialer deny list does not block, to read service...

PT-2026-107488

Obot 0.12.0 before 0.26.2 contains an insufficiently protected credentials vulnerability that allows authenticated users to read static secrets set on MCP catalog entries by admins or power users. Basic users granted an entry by access control rules can request GET /api/all-mcps/entries/entry id ...

PT-2026-107690

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.4.3 Splunk Enterprise versions prior to 10.2.7 Description An unauthenticated user with network access to the Patroni REST API on a search head cluster member can execute arbitrary operating-system...

PT-2026-107694

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.4.3 Splunk Enterprise versions prior to 10.2.7 Splunk Enterprise versions prior to 10.0.10 Splunk Enterprise versions prior to 9.4.15 Splunk Secure Gateway versions prior to 3.10.11 Splunk Secure Gateway...

PT-2026-107427

This vulnerability exists in the ERP system due to insufficient validation and parameterization of user supplied input in an API endpoint. An unauthenticated remote attacker could exploit this vulnerability by supplying specially crafted input to the vulnerable endpoint. Successful exploitation o...

PT-2026-107426

Name of the Vulnerable Software and Affected Versions ERP system affected versions not specified Description Improper validation of payment callback parameters and inadequate authentication controls in an API endpoint allow an unauthenticated remote attacker to manipulate parameters. This can cau...

PT-2026-107516

wger is a free, open-source workout and fitness manager. Prior to version 2.6, an authenticated attacker can inject arbitrary workout log entries into any other user's SlotEntry by supplying the victim's slot entry ID in a POST /api/v2/workoutlog/ request. The slot entry foreign key is not includ...