PT-2026-70244

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description A timing side-channel vulnerability exists in the RSA OAEP decryption implementation. A privileged local attacker with access to the TPM command interface may...

PT-2026-70080

Name of the Vulnerable Software and Affected Versions cti-transmute affected versions not specified Description Authenticated users can add or remove emoji reactions on comments without authorization checks to verify if they are permitted to view the target comment. The react handler passes a...

PT-2026-70587

Name of the Vulnerable Software and Affected Versions Windows Deployment Services affected versions not specified Description A use-after-free condition exists in Windows Deployment Services. This flaw allows an unauthorized attacker to execute arbitrary code over a network. Use-after-free is a...

CVE-2026-57550

CVE-2026-57550 is a Qualcomm SIM card vulnerability: the "RUN AT" command allows attackers with physical SIM access to execute arbitrary code on IoT devices (EV chargers, industrial routers) and some phones (OPPO, ASUS). It affects Quectel modules with Qualcomm chips; no iPhones/Pixels impacted. ...

PT-2026-70559

Name of the Vulnerable Software and Affected Versions Windows Routing and Remote Access Service RRAS affected versions not specified Description A flaw in the Windows Routing and Remote Access Service RRAS allows remote attackers to execute arbitrary code, potentially granting unauthorized access...

PT-2026-70104

Name of the Vulnerable Software and Affected Versions SAP Commerce Cloud affected versions not specified Description An unauthenticated attacker can abuse a default authentication client by submitting specially crafted input to certain functions that lack sufficient validation. This flaw allows f...

PT-2026-70874

Name of the Vulnerable Software and Affected Versions PapersGPT for Zotero version 0.6.1 Description A remote code execution issue exists where arbitrary JavaScript can be executed by returning malicious code from an LLM endpoint. This occurs because the response is passed unsanitized to the...

PT-2026-70584

Name of the Vulnerable Software and Affected Versions Windows Secure Socket Tunneling Protocol SSTP affected versions not specified Description A double free issue in the Windows Secure Socket Tunneling Protocol SSTP allows an unauthorized remote attacker to execute arbitrary code over a network...

PT-2026-70890

Name of the Vulnerable Software and Affected Versions DB-GPT version 0.8.1 Description An unauthenticated path traversal issue exists in the Python file-upload endpoint. Remote attackers can write arbitrary files to any location on the server by injecting directory traversal sequences into the us...

PT-2026-70823

Cap v0.3.1 contains a broken access control vulnerability in the POST /api/video/comment endpoint that allows authenticated users to post comments on any private video without permission by supplying an arbitrary videoId in the request body. Attackers can inject comments into private video...

PT-2026-70260

Name of the Vulnerable Software and Affected Versions Zoom Clients affected versions not specified Description A missing bounds check in the annotator function allows a buffer over-read. This issue enables a meeting participant to cause a denial of service on another participant through network...

Metabase 0.63.4 SQL Injection

A proof of concept exploit for an unauthenticated SQL injection vulnerability in Metabase version 0.63.4. The vulnerability allows an attacker-controlled user-id value supplied to the password reset endpoint to reach a HoneySQL query as raw SQL. On installations using the default embedded H2...

PT-2026-70019

Name of the Vulnerable Software and Affected Versions SAP NetWeaver Application Server ABAP affected versions not specified Description An unauthenticated attacker can exploit logical errors in the parsing of the DIAG protocol, which is a proprietary SAP protocol used for communication between th...

PT-2026-70589

Name of the Vulnerable Software and Affected Versions .NET Framework affected versions not specified Description An integer overflow or wraparound occurs, allowing an unauthorized attacker to execute arbitrary code locally or remotely, which can affect the system. An integer overflow is a conditi...

PT-2026-70797

Name of the Vulnerable Software and Affected Versions PeerTube versions prior to 8.2.2 Description PeerTube is an ActivityPub-federated video streaming platform. The processUpdateActivity and processUpdateVideo functions accept an ActivityPub Update containing a Video object without verifying tha...

PT-2026-70612

Name of the Vulnerable Software and Affected Versions Microsoft Office SharePoint affected versions not specified Description Improper input validation allows an unauthorized attacker to execute arbitrary code over a network, which can lead to a full system compromise. Recommendations At the...

PT-2026-70243

Name of the Vulnerable Software and Affected Versions TCG TPM 2.0 reference code affected versions not specified Description An information leakage issue exists that allows a local attacker with elevated privileges to obtain a credential from a TPM-aware CA for a falsified TPM key, such as an...

PT-2026-70581

Name of the Vulnerable Software and Affected Versions .NET affected versions not specified Description An integer overflow or wraparound occurs in .NET, which could allow an unauthorized attacker to elevate privileges locally. An integer overflow happens when an arithmetic operation attempts to...

java-1.8.0-openjdk security update

1:1.8.0.502.b07-1.1.0.1 - Add Oracle vendor bug URL Orabug: 34340155 1:1.8.0.502.b07-1.1 - Update to 8u502-b07 GA. - Update release notes for 8u502-b07. - Bump lcms2 version to 2.19.1 following JDK-8321489, JDK-8348110, JDK-8375065 & JDK-8383354 - Bump zlib version to 1.3.2 following JDK-8378631 ...

PT-2026-70598

Name of the Vulnerable Software and Affected Versions Microsoft Exchange Server 2016 Microsoft Exchange Server 2019 Microsoft Exchange Server Subscription Edition Description An authentication bypass by capture-replay allows an authorized attacker to elevate privileges over a network. The issue...