PT-2026-120234

HKUDS Vibe-Trading from 0.1.0 before 0.1.7 contains a missing authentication vulnerability that allows unauthenticated attackers to access the FastAPI surface because require auth returns early when API AUTH KEY is unset. Attackers can post messages to /sessions/id/messages to trigger root shell...

PT-2026-120208

Trigger.dev before 4.6.2 contains an authorization vulnerability that allows public-token holders with session write access to obtain environment-wide S2 stream credentials via session input initialization. Attackers can use the credential directly against the storage API to append, create, or tr...

PT-2026-120209

Trigger.dev before 4.5.0-rc.3 contains a path traversal vulnerability in the api/v1/packets and api/v2/packets endpoints that allows authenticated tenants to escape their object key prefix through an unsanitized filename splat segment. Attackers holding one valid API key can supply ../ sequences ...

PT-2026-120580

Trudesk through 1.2.11 contains an authorization bypass vulnerability that allows any authenticated user to modify tickets outside their groups via PUT /api/v1/tickets/:id and PUT /api/v2/tickets/batch. Attackers can supply arbitrary ticket ObjectIds to change status, subject, group, priority or...

PT-2026-120886

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.10 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, could have allowed an authenticated to read milestone metadata, including titles, descriptions, and full project paths, from arbitrary private projects...

PT-2026-120654

Incorrect authorization in the REST administration API of Progressive Robot hMailServer 6.3.4 through 6.3.6 allows a remote authenticated user whose credential holds the manage roles permission in named domains - a full-scope API key issued for those domains, or an account assigned the serveradmi...

PT-2026-120182

ArcadeDB from 26.8.1 before 26.10.1 contains an authorization bypass vulnerability that allows read-only users to modify edge type lightweight and unique schema flags without UPDATE SCHEMA permission. Attackers can send a bare ALTER TYPE edgeType WITH lightweight = true command over the HTTP, gRP...

PT-2026-120760

Name of the Vulnerable Software and Affected Versions Apache Pulsar Manager versions 0.1.0 through 0.4.0 Description Apache Pulsar Manager contains several security flaws. The process for creating the initial administrator account is accessible without authentication and remains available after...

GitLab 15.10 < 19.3.6 / 19.4 < 19.4.3 / 19.5 < 19.5.1 (CVE-2026-13319)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.10 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, could have allowed an authenticated to read milestone...

Linux Distros Unpatched Vulnerability : CVE-2026-92539

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A service account with user-management permissions in one organization can read, modify, disable or delete users belonging to other organizations on the same...

CVE-2026-91590

Vulnerability in the Oracle BI Publisher product of Oracle Analytics component: Web Service API. Supported versions that are affected are 8.2.0.0.0 and 26.01.0.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle BI Publisher...

CVE-2026-113728

Bulwark Webmail is a self-hosted webmail client for Stalwart Mail Server. Prior to 1.9.2, the unauthenticated POST /api/fetch-ical endpoint validates a caller-supplied hostname with one DNS lookup and then passes the URL to fetch, which performs a separate lookup for the socket connection. An...

CVE-2026-113062

Improper input validation in API in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-101725

Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL component: C API. Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1. Easily exploitable vulnerability...

CVE-2026-101726

Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL component: C API. Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1. Easily exploitable vulnerability...

CVE-2026-101535

Vulnerability in the Oracle Sales Foundation product of Oracle E-Business Suite component: Security API. Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Sales Foundation...

CVE-2026-91590

A vulnerability exists in the Web Service API component of Oracle BI Publisher (part of Oracle Analytics). Affected versions include 8.2.0.0.0 and 26.01.0.0.0 . This easily exploitable flaw allows a low-privileged attacker with network access via HTTP to compromise the product, provided they can ...

CVE-2026-101725

Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL component: C API. Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1. Easily exploitable vulnerability...

CVE-2026-101726

Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL component: C API. Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1. Easily exploitable vulnerability...

CVE-2026-101725

A vulnerability exists in the C API component of Oracle MySQL (MySQL Server and MySQL Cluster). Affected versions include MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1, and MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3, and 26.7.0-26.7.1. A low privileged attacker with network acc...