PT-2026-119398

Name of the Vulnerable Software and Affected Versions MySQL Server versions 8.4.0 through 8.4.12 MySQL Server versions 9.7.0 through 9.7.3 MySQL Server version 26.7.0 through 26.7.1 MySQL Cluster versions 8.0.0 through 8.0.49 MySQL Cluster versions 8.4.0 through 8.4.12 MySQL Cluster versions 9.7....

Oracle MySQL Vulnerability CVE-2026-101725

Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL component: C API. Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1. Easily exploitable vulnerability...

PT-2026-118492

Name of the Vulnerable Software and Affected Versions ApostropheCMS import-export module versions prior to 3.7.1 Description The API endpoint 'POST /api/v1/@apostrophecms/import-export/clean-export' lacks authentication and authorization checks. This allows unauthenticated anonymous users with a...

PT-2026-118338

Dockhand before 1.0.46 contains an arbitrary file read vulnerability that allows non-admin users with stacks:edit permission to read files through the path parameter of /api/system/files/content. Attackers can supply absolute paths to read /etc/shadow, /etc/passwd, git .git/config credentials, an...

PT-2026-118450

Name of the Vulnerable Software and Affected Versions ApostropheCMS versions prior to 4.34.0 Description A public REST API type utilizing publicApiProjection allows the exposure of excluded searchable or sortable field information. This occurs through search membership and sort ordering oracles,...

PT-2026-118503

Name of the Vulnerable Software and Affected Versions ApostropheCMS versions prior to 4.33.0 Description An unauthenticated user can cause a denial of service by exhausting temporary disk capacity. The issue occurs because the system writes multipart uploads to the temporary directory before...

PT-2026-118323

A security vulnerability has been detected in arizu-id fast-tunnel 1.0.0. Affected by this issue is the function ZipArchive::extractTo of the file backend/api plugins.php of the component Plugin Installer. Such manipulation of the argument plugin file leads to unrestricted upload. The attack may ...

PT-2026-118482

Name of the Vulnerable Software and Affected Versions SuggestArr versions prior to 3.0.0 Description An authentication bypass exists in the local bypass authentication mode. The enforce authentication function in api service/auth/middleware.py trusts the request.remote addr value, which is derive...

PT-2026-118298

Homer: Authenticated SQL Injection via Unvalidated rawquery Field in /api/v4/statistics/query in github.com/sipcapture/homer-app. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing...

PT-2026-118316

In versions running on TYPO3 10 and 11, the configured OpenAI API key is embedded in every backend page, so that the editor plugin can contact the OpenAI service directly from the browser. Any authenticated backend user can read the key and use it at the expense of the site operator. This only...

PT-2026-119218

Vulnerability in the Oracle Sales Foundation product of Oracle E-Business Suite component: Security API. Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Sales Foundation...

PT-2026-118600

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 2.1.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2, when an operator has enabled --enable-helm for kustomize build, helmGlobals.configHome can point Helm's config and data directories at a repository-controlled location...

Xerj Console API Authentication Bypass Leads to Unauthorized Credential Minting

Overview An authentication bypass vulnerability in the Xerj Console API allows sessions to bypass passkey-backed requirements during token issuance. By exploiting this flaw, an attacker with an existing valid token can create independent, persistent successor credentials directly through the...

CVE-2026-59387 - broken access control restriction in Cloud Controller API | Cloud Foundry

Severity High CVSS score: 8.8 High CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Vendor Cloud Foundry Foundation Versions Affected CAPI Cloud Foundry Controller – Confirmed in CAPI up to v1.245.0 inclusive Description The Nginx routing configuration for Cloud Controller blocks unauthenticated acce...

Oracle E-Business Suite: CVE-2026-101535: Critical Patch Update

Vulnerability in the Oracle Sales Foundation product of Oracle E-Business Suite component: Security API. Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Sales Foundation...

SUSE CVE-2026-112074

A security flaw has been discovered in Tencent ncnn up to 44b02dabdcf97499281a4692ebd65bad73dcf8b6. Affected by this issue is the function ncnn::yuv420sp2rgb of the file src/matpixel.cpp of the component Conversion API. The manipulation results in integer overflow. The attack can be launched...

CVE-2026-112371

A vulnerability was determined in H3C Magic NX15 NX15V100R017. Impacted is the function write of the file /api/esps of the component RPC Interface. Executing a manipulation of the argument path can lead to code injection. The attack can be executed remotely. The exploit has been publicly disclose...

CVE-2026-112372 H3C Magic NX15 upload importprofile path traversal

A weakness has been identified in H3C Magic NX15 V100R017. This affects the function importprofile of the file /api/upload. This manipulation of the argument fileName causes path traversal. It is possible to initiate the attack remotely. The exploit has been made available to the public and could...

CVE-2026-112372

A path traversal vulnerability exists in H3C Magic NX15 V100R017 . The issue is located in the importprofile function of the /api/upload file, where a lack of proper input validation on the fileName argument allows for path traversal. This weakness can be exploited remotely to access or manipulat...

CVE-2026-112371

A code injection vulnerability exists in the RPC Interface component of H3C Magic NX15 NX15V100R017 . Specifically, the write function of the /api/esps file is affected. By manipulating the argument path , a remote attacker can achieve code injection . The vulnerability is exploitable remotely, a...