PT-2026-38456

Name of the Vulnerable Software and Affected Versions Ivanti Endpoint Manager Mobile versions prior to 12.7.0.2 Ivanti Endpoint Manager Mobile versions prior to 12.8.0.3 Ivanti Endpoint Manager Mobile versions prior to 12.9.0.1 Description Ivanti Endpoint Manager Mobile EPMM, formerly known as...

PT-2026-38575

Name of the Vulnerable Software and Affected Versions M365 Copilot affected versions not specified Description Improper neutralization of special elements in output used by a downstream component injection allows an unauthorized attacker to disclose information over a network. Recommendations At...

PT-2026-38618

Name of the Vulnerable Software and Affected Versions Zebra versions 4.3.1 through 4.3.1 Description Insufficient error handling during sighash computation can lead to consensus divergence. When an invalid sighash type is encountered, the system fails to return an error, leaving the input sighash...

PT-2026-38579

Name of the Vulnerable Software and Affected Versions Microsoft Teams affected versions not specified Description Improper authorization in Microsoft Teams allows an authorized attacker to disclose information over a network. Recommendations At the moment, there is no information about a newer...

PT-2026-38428

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 150.0.2 Firefox ESR versions prior to 140.10.2 Firefox ESR versions prior to 115.35.2 Thunderbird versions prior to 150.0.2 Thunderbird versions prior to 140.10.2 Description A use-after-free issue exists within the D...

PT-2026-38423

Name of the Vulnerable Software and Affected Versions Liderahenk versions 2.0.1 through 2.0.1 Description An Origin Validation Error in the application allows attackers to bypass Access Control Lists ACLs, which are sets of rules that define permissions for users or systems. This flaw enables...

fast-xml-parser 安全漏洞

fast-xml-parser is an open-source library developed by Natural Intelligence. It is used for quickly validating, parsing, and processing XML files without relying on C/C++-based libraries or callbacks. Versions of fast-xml-parser prior to 5.7.0 contained security vulnerabilities. These...

CVE-2026-41650: XML Injection (aka Blind XPath Injection)

fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. Prior to version 5.7.0, XMLBuilder does not escape the "--" sequence in comment content or the "" sequence in CDATA sections when building XML from JavaScript objects. This allows XML injection...

PT-2026-45198

Name of the Vulnerable Software and Affected Versions D-Link DI-8400 versions prior to 16.07.26A1 Description A stack-based buffer overflow occurs in an unknown function within the '/dbsrv.asp' endpoint. This issue is triggered by manipulating the str argument, allowing for remote exploitation. A...

PT-2026-38333

Name of the Vulnerable Software and Affected Versions OpenEXR versions 3.0.0 through 3.2.8 OpenEXR versions 3.3.0 through 3.3.10 OpenEXR versions 3.4.0 through 3.4.10 Description An integer overflow exists in the ImageChannel::resize function, which can lead to a heap out-of-bounds OOB write—a...

PT-2026-38421

Name of the Vulnerable Software and Affected Versions Proticaret E-Commerce versions 5.0.0 through 6.0.1767.1382 Description Improper neutralization of input during web page generation allows for Reflected Cross-Site Scripting XSS, a flaw where an application includes untrusted data in a web page...

PT-2026-38340

Name of the Vulnerable Software and Affected Versions Math.js versions 13.1.0 through 15.1.x Description Arbitrary JavaScript can be executed through the expression parser of the library. Recommendations Update to version 15.2.0...

Demystifying and Detecting Agentic Workflow Injection Vulnerabilities in GitHub Actions

GitHub Actions is increasingly used to deploy LLM-based agents for repository-centric tasks such as issue triage, pull-request review, code modification, and release assistance. These agentic workflows extend traditional CI/CD automation with agentic capabilities but also create a new injection...

PT-2026-38330

Name of the Vulnerable Software and Affected Versions Spring Cloud Config versions 3.1.0 through 3.1.13 Spring Cloud Config versions 4.1.0 through 4.1.9 Spring Cloud Config versions 4.2.0 through 4.2.6 Spring Cloud Config versions 4.3.0 through 4.3.2 Spring Cloud Config versions 5.0.0 through 5.0...

PT-2026-38587

Name of the Vulnerable Software and Affected Versions Azure DevOps affected versions not specified Description Exposure of sensitive information in Azure DevOps allows an unauthorized actor to disclose information over a network. Recommendations At the moment, there is no information about a newe...

PT-2026-38574

Name of the Vulnerable Software and Affected Versions M365 Copilot affected versions not specified Description Improper neutralization of special elements in Copilot Business Chat allows an unauthorized attacker to disclose information over a network. Recommendations At the moment, there is no...

PT-2026-38412

Name of the Vulnerable Software and Affected Versions Docling-Graph versions prior to 1.5.1 Description The URLInputHandler class in docling graph/core/input/handlers.py makes HTTP requests to user-supplied URLs without validating if the target resolves to a private, loopback, or link-local IP...

PT-2026-38422

Name of the Vulnerable Software and Affected Versions Fluent Forms WordPress plugin versions prior to 6.2.1 PAN-OS versions prior to 10.2.9-h1 PAN-OS versions prior to 11.0.4-h2 PAN-OS versions prior to 11.1.2-h3 Description Fluent Forms contains an issue where ownership is not properly verified...

PT-2026-39665

Name of the Vulnerable Software and Affected Versions urllib3 versions 1.23 through 2.6.x Description Sensitive headers, specifically Authorization, Cookie, and Proxy-Authorization, are forwarded during cross-origin redirects when using the low-level API via ProxyManager.connection from...

PT-2026-38617

Name of the Vulnerable Software and Affected Versions FacturaScripts versions prior to 2025.81 Description An authenticated unrestricted file upload issue exists in the product image upload functionality. An attacker with valid credentials can bypass MIME type validation by prepending GIF89a magi...