PT-2026-59287

A weakness has been identified in FoundationAgents MetaGPT up to 0.8.2. This affects the function Message.check instruct content of the file metagpt/schema.py. Executing a manipulation of the argument mapping can lead to deserialization. The attack is restricted to local execution. The exploit ha...

PT-2026-59957

Impact When MaxPool receives a window size input array ksize with dimensions greater than its input tensor input, the GPU kernel gives a CHECK fail that can be used to trigger a denial of service attack. python import tensorflow as tf import numpy as np input = np.ones1, 1, 1, 1 ksize = 1, 1, 2, ...

PT-2026-59766

Impact If QuantizeAndDequantizeV3 is given a nonscalar num bits input tensor, it results in a CHECK fail that can be used to trigger a denial of service attack. python import tensorflow as tf signed input = True range given = False narrow range = False axis = -1 input = tf.constant-3.5, shape=1,...

PT-2026-59742

Impact When running on GPU, tf.image.generate bounding box proposals receives a scores input that must be of rank 4 but is not checked. python import tensorflow as tf a = tf.constantvalue=1.0, 1.0, 1.0, 1.0, 1.0, 1.0, 1.0, 1.0 b = tf.constantvalue=1 tf.image.generate bounding box...

PT-2026-59059

Summary Microsoft APM normalizes marketplace plugins by copying plugin components referenced in plugin.json into .apm/. The manifest fields agents, skills, commands, and hooks are attacker-controlled, but the implementation does not enforce that those paths remain inside the plugin directory. A...

PT-2026-59835

Impact When tf.random.gamma receives large input shape and rates, it gives a CHECK fail that can trigger a denial of service attack. python import tensorflow as tf arg 0=tf.random.uniformshape=4,, dtype=tf.int32, maxval=65536 arg 1=tf.random.uniformshape=4, 4, dtype=tf.float64, maxval=None arg...

PT-2026-60040

xiaomusic v0.5.7 contains an unauthenticated path traversal vulnerability in the GET /music/file path:path endpoint that allows unauthenticated attackers to read arbitrary files outside the intended music directory by exploiting an incomplete path prefix check. Attackers can request files from...

PT-2026-59920

Impact If FakeQuantWithMinMaxVarsPerChannel is given min or max tensors of a rank other than one, it results in a CHECK fail that can be used to trigger a denial of service attack. python import tensorflow as tf num bits = 8 narrow range = False inputs = tf.constant0, shape=4, dtype=tf.float32 mi...

PT-2026-60029

Summary Five routine detail action endpoints check a cache before calling self.get object. Cache keys are scoped only by pk — no user ID is included. When a victim has previously accessed their routine via the API, an attacker can retrieve the cached response for the same PK without any ownership...

PT-2026-59569

Summary Type: Authorization bypass enabling workspace metadata + settings tampering. The PATCH /workspaces/workspace id endpoint is gated only by require workspace memberworkspace id default min role="member". Any member can rewrite the workspace's name, description, and the settings JSON blob. T...

PT-2026-57806

Mattermost versions 11.7.x = 11.7.2, 11.6.x = 11.6.4, 10.11.x = 10.11.19 fail to check the manage shared channels permission in the /share-channel autocomplete handler, which allows an authenticated user without that permission to enumerate configured remote cluster connection metadata via slash...

PT-2026-60087

Summary The Timesheet API PATCH /api/timesheets/id and POST /api/timesheets endpoints accept a user-supplied project ID and resolve it through a Symfony EntityType whose query builder allows the submitted ID to satisfy the access predicate via an unconditional OR branch. As a result, any...

PT-2026-59921

Impact When TensorListFromTensor receives an element shape of a rank greater than one, it gives a CHECK fail that can trigger a denial of service attack. python import tensorflow as tf arg 0=tf.random.uniformshape=6, 6, 2, dtype=tf.bfloat16, maxval=None arg 1=tf.random.uniformshape=6, 9, 1, 3,...

PT-2026-59363

Missing Access Check on Channel Members Endpoint for Standard Channels Affected Component Channel members listing endpoint: - backend/open webui/routers/channels.py lines 445-507, get channel members by id Affected Versions Current main branch and likely all versions with the channels feature...

PT-2026-59692

Impact The ajax lookup endpoint in application.py bypasses the is accessible access control check that all other endpoints enforce. If a developer restricts model access by overriding is accessible, an authenticated user can still query that model's data through the ajax lookup endpoint — silentl...

PT-2026-59702

Impact The implementation of AvgPoolGrad does not fully validate the input orig input shape. This results in a CHECK failure which can be used to trigger a denial of service attack: python import tensorflow as tf ksize = 1, 2, 2, 1 strides = 1, 2, 2, 1 padding = "VALID" data format = "NHWC" orig...

PT-2026-57915

Cockpit CMS contains a missing authorization vulnerability in the Bucket file storage API /system/buckets/api. The api method in modules/System/Controller/Buckets.php executes bucket commands ls, upload, removefiles, rename, createfolder without performing any ACL or role check. Any authenticated...

PT-2026-59372

Summary The LDAP and OAuth authentication flows use a TOCTOU Time-of-Check-Time-of-Use pattern for first-user admin role assignment. The regular signup handler signup handler in auths.py, line 663 was explicitly patched to prevent this race with the comment "Insert with default role first to avoi...

PT-2026-59365

Summary POST /api/v1/calendars/events/event id/update validates that the caller has write access to the calendar the event currently belongs to, but does not validate the destination calendar id supplied in the request body. The model layer then persists the new calendar id unconditionally. A...

PT-2026-59268

Impact What kind of vulnerability is it? Who is impacted? Receiving a file wormhole receive from a malicious party could result in overwriting critical local files, including /.ssh/authorized keys and .bashrc. This could be used to compromise the receiver's computer. Only the sender of the file t...