CVE-2026-16530

A flaw was found in the PCP Performance Co-Pilot pmproxy service. A remote attacker can exploit a vulnerability in the pmLogLoadInDom function by sending a specially crafted request. This bypasses a critical bounds check, which can lead to the pmproxy service crashing, causing a Denial of Service...

CVE-2026-64381

A flaw was found in the SMB client of the Linux kernel. A remote attacker could exploit a memory leak in the receiveencryptedstandard function by sending specially crafted compound Protocol Data Units PDUs. This vulnerability occurs because a buffer is allocated before a necessary size check,...

kernel: ALSA: usb-audio: Add sanity check for OOB writes at silencing

A flaw was found in the Linux kernel's ALSA Advanced Linux Sound Architecture USB audio subsystem. An inconsistency in how USB audio playback and capture streams are handled can lead to an out-of-bounds write to a memory buffer. This can result in a system crash, causing a denial of service for a...

kernel: crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id

In the Linux kernel, the following vulnerability has been resolved: crypto: asymmetrickeys - prevent overflow in asymmetrickeygenerateid Use checkaddoverflow to guard against potential integer overflows when adding the binary blob lengths and the size of an asymmetrickeyid structure and return...

EUVD-2025-210538

kishan0725 Hospital Management System 4.0 is vulnerable to SQL Injection in checkavailability.php via the parameters emailid and email...

CVE-2026-64685

ImageMagick is free and open-source software used for editing and manipulating digital images. In versions prior to 7.1.2-27, the BGR decoder does not check for an end-of-file in every location so a crafted image could result in an heap buffer over-read. This issue has been fixed in version...

PT-2026-66602

Name of the Vulnerable Software and Affected Versions OpenProject versions prior to 17.6.0 Description An issue exists where the API endpoints 'GET /api/v3/time entries' and 'GET /api/v3/cost entries' render links.workPackage.title and links.workPackage.href via the associated resource in the fil...

PT-2026-66369

Name of the Vulnerable Software and Affected Versions WP Travel Engine versions prior to 6.8.2 Description The plugin fails to perform a capability check on an AJAX action used to update site-wide options. Because the public nonce intended to protect the action is served to anonymous visitors,...

MongoDB 7.0.x < 7.0.39 / 8.0.x < 8.0.28 / 8.2.x < 8.2.12 / 8.3.x < 8.3.7 Multiple Vulnerabilities (SERVER-128433)

The version of MongoDB installed on the remote host is 7.0.x prior to 7.0.39, 8.0.x prior to 8.0.28, 8.2.x prior to 8.2.12, or 8.3.x prior to 8.3.7. It is, therefore, affected by multiple vulnerabilities: - An authenticated user with low privileges may be able to perform unauthorized reads and...

PT-2026-66397

The Search Atlas SEO WordPress plugin before 2.6.12 does not perform a capability or nonce check in one of its AJAX handlers, allowing any authenticated user such as a Subscriber to invoke the site's Google Indexing API integration, submitting or removing the site's URLs from Google's index and...

PT-2026-76064

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-49 and 7.1.2-24, a crafted MVG file could result in a stack overflow due to a missing depth or visited-set check. This issue has been patched in versions 6.9.13-49 and 7.1.2-24...

PT-2026-66378

The Easy Appointments WordPress plugin through 3.12.26 does not perform a per-request capability or nonce check on one of its customer-listing handlers, allowing authenticated users with contributor-level access to read every stored customer's personal information...

VulnCheck KEV: CVE-2022-36883

A missing permission check in Jenkins Git Plugin 4.11.3 and earlier allows unauthenticated attackers to trigger builds of jobs configured to use an attacker-specified Git repository and to cause them to check out an attacker-specified commit...

PT-2026-66384

The LifterLMS WordPress plugin before 10.0.10 does not perform a capability check in one of its select2 query AJAX handlers, only verifying that the user is logged in, allowing any authenticated user with subscriber-level access to read the titles of internal post types such as coupon codes by...

PT-2026-76356

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a crafted SVG file can cause a denial of service. An off-by-one boundary check instead of = that allows bypass the guard and reach an undefined size t cast...

PT-2026-66606

Name of the Vulnerable Software and Affected Versions Sylius Mollie Plugin versions prior to 2.2.8 Sylius Mollie Plugin versions prior to 3.2.4 Sylius Mollie Plugin versions prior to 3.3.1 Description The payment webhook at the POST / locale/update-payment endpoint accepts the id and orderId...

PT-2026-66622

Name of the Vulnerable Software and Affected Versions MeshCentral version 1.1.21 Description A cross-site WebSocket hijacking protection bypass occurs when self-signed certificates are used. This is caused by an unconditional early return in the CheckWebServerOriginName function within...

PT-2026-66385

Name of the Vulnerable Software and Affected Versions tourmaster WordPress plugin versions prior to 5.4.8 Description The plugin fails to perform a nonce check when storing a custom-filter label received from a request parameter and does not escape this label when displaying it on the filter admi...

CVE-2026-12500: Missing Authorization

The WP Travel Engine WordPress plugin before 6.8.2 does not perform a capability check on an AJAX action that updates a WP Travel Engine WordPress plugin before 6.8.2 option, allowing unauthenticated users to overwrite a site-wide WP Travel Engine WordPress plugin before 6.8.2 option the public...

cirrusfb_check_mclk Heap Buffer Overflow DoS

The vulnerability of the cirrusfbcheckmclk function in the drivers/video/fbdev/cirrusfb.c driver for supporting Core Image Buffer devices in the Linux operating system is related to insufficient validation of input data during division by zero. Exploiting this vulnerability could allow an attacke...