PT-2026-70704

Name of the Vulnerable Software and Affected Versions Microsoft Office SharePoint affected versions not specified Description Deserialization of untrusted data allows an authorized attacker to execute arbitrary code over a network, which can affect the system. Deserialization is the process of...

PT-2026-70426

Name of the Vulnerable Software and Affected Versions Windows Sensor Data Service affected versions not specified Description A heap-based buffer overflow in the Windows Sensor Data Service allows an authorized attacker to elevate privileges locally. A heap-based buffer overflow occurs when a...

PT-2026-70656

Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally...

PT-2026-70431

Name of the Vulnerable Software and Affected Versions Windows GDI affected versions not specified Description An untrusted pointer dereference in Windows GDI allows an authorized attacker to disclose sensitive information locally. Recommendations At the moment, there is no information about a new...

PT-2026-70545

Name of the Vulnerable Software and Affected Versions Windows NTFS affected versions not specified Description An out-of-bounds read in Windows NTFS allows an authorized attacker to disclose sensitive information locally, which can affect the system. Recommendations At the moment, there is no...

PT-2026-70575

Name of the Vulnerable Software and Affected Versions Windows DNS affected versions not specified Description A stack-based buffer overflow in Windows DNS allows an unauthorized attacker to execute arbitrary code over a network, which can affect the system. A stack-based buffer overflow occurs wh...

PT-2026-70596

Name of the Vulnerable Software and Affected Versions .NET affected versions not specified Description An uncaught exception in .NET allows an authorized attacker to elevate privileges locally. Recommendations At the moment, there is no information about a newer version that contains a fix for th...

PT-2026-70413

Name of the Vulnerable Software and Affected Versions Remote Desktop Client affected versions not specified Description A heap-based buffer overflow occurs in the Remote Desktop Client, which allows an unauthorized attacker to execute arbitrary code over a network and affect the system. A...

PT-2026-70544

Name of the Vulnerable Software and Affected Versions Windows LDAP affected versions not specified Description A use after free issue in the Lightweight Directory Access Protocol LDAP allows an unauthorized attacker to execute arbitrary code over a network, potentially affecting the system...

PT-2026-70412

Name of the Vulnerable Software and Affected Versions Microsoft High Performance Computing HPC Pack affected versions not specified Description Execution with unnecessary privileges allows an authorized attacker to elevate privileges over a network. Recommendations At the moment, there is no...

PT-2026-70816

Name of the Vulnerable Software and Affected Versions Adobe Commerce affected versions not specified Magento Open Source affected versions not specified Adobe Commerce B2B affected versions not specified Description Stored Cross-Site Scripting XSS occurs due to insufficient protection of the web...

PT-2026-70242

A flaw was found in the oauth-server component. This open redirect vulnerability occurs when the 'then' parameter in the grant approval handler is not properly validated. A remote attacker can craft a malicious URL that, when approved or denied by an authenticated user, redirects them to an...

CVE-2025-30241

Certain web interface components in affected TP-Link Aginet devices do not validate and sanitize user-supplied input properly before passing it to system-level command execution functions. An authenticated adjacent attacker may inject specially crafted input to execute arbitrary operation system...

CVE-2026-72918

Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 7.10.14, 8.0.8, 8.1.7, 8.2.7, 8.3.7, 8.4.5, 8.5.2, and 8.6.1, the stream-notify-user stream in the WebSocket protocol allows an authenticated user to write arbitrary notification bodies because the sender ...

CVE-2026-15467

A flaw was found in the trustyai-service-operator's LMEvalJob controller. An authenticated user within the cluster can exploit this vulnerability by configuring a sidecar container to bypass existing security policies. This allows the user to enable and execute untrusted remote code, leading to...

EUVD-2026-55825

A flaw was found in ml-metadata. The statically-linked gRPC stack in ml-metadata is outdated, making it vulnerable to known HTTP/2 denial of service DoS issues. An in-cluster attacker, with network access to the MLMD pod, could exploit these vulnerabilities by sending specially crafted HTTP/2...

CVE-2026-72885

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, dockerContextPath accepted by apps/dokploy/components/dashboard/application/build/show.tsx flows through getDockerContextPath in packages/server/src/utils/filesystem/directory.ts into the unquoted cd command in...

CVE-2025-13294

An unauthenticated SQL injection vulnerability exists in the web server of TBEA TLogger V2.1.0.0B0.0.0.0. Multiple HTTP endpoints incorporate attacker-controlled parameters directly into SQLite queries without sufficient validation or parameterization. A remote unauthenticated attacker can exploi...

CVE-2026-59091

A flaw was found in GIMP's file format plugins, including those for PSD and PAA files. A remote attacker could exploit these vulnerabilities by tricking a user into opening a specially crafted image file. This could lead to unexpected application behavior or other potential security impacts witho...

EUVD-2026-55735

CyberPanel 2.4.3, fixed in commit eca0c3c, contains an authenticated remote code execution vulnerability in the remote backup feature that allows authenticated attackers to gain root-level SSH access by supplying a malicious remote server address. Attackers can exploit the unverified SSH public k...