PT-2026-32854

Name of the Vulnerable Software and Affected Versions Microsoft Windows affected versions not specified Description A protection mechanism failure in the Windows Shell allows a remote unauthorized attacker to perform spoofing. The issue occurs when a malicious Windows shortcut or LNK path trigger...

PT-2026-32879

Name of the Vulnerable Software and Affected Versions Microsoft 365 Apps for Enterprise versions 16.0.1 through 16.0.1 Description A use-after-free issue in Microsoft Office Word allows an unauthorized attacker to execute code locally. This occurs when a user is tricked into opening a malicious...

PT-2026-32560

Name of the Vulnerable Software and Affected Versions SAP Business Planning and Consolidation affected versions not specified SAP Business Warehouse affected versions not specified Description Insufficient authorization checks in SAP Business Planning and Consolidation and SAP Business Warehouse...

PT-2026-32885

Name of the Vulnerable Software and Affected Versions Windows Active Directory versions prior to April 2026 Patch Tuesday Description Improper input validation in Windows Active Directory allows an authorized attacker to execute arbitrary code over an adjacent network. This issue enables...

PT-2026-32883

Name of the Vulnerable Software and Affected Versions Windows 10 Windows 11 Windows Server versions 2012 through 2025 Description A double-free memory corruption flaw exists in the Windows Internet Key Exchange IKE Service Extensions. This issue occurs when the service processes malformed...

PT-2026-32622

Name of the Vulnerable Software and Affected Versions Composer versions 1.0 through 2.2.26 Composer versions 2.3 through 2.9.5 Description Command injection is possible in the PHP dependency manager Composer. The Perforce::syncCodeBase function appends the $sourceReference parameter to a shell...

PT-2026-32958

Name of the Vulnerable Software and Affected Versions Jellyfin versions prior to 10.11.7 Description An unauthenticated arbitrary file read is possible via ffmpeg argument injection through the query parameter parsing mechanism. The ParseStreamOptions method in StreamingHelpers.cs adds lowercase...

PT-2026-32612

Summary A soundness vulnerability in the SP1 V6 recursive shard verifier allows a malicious prover to construct a recursive proof from a shard proof that the native verifier would reject. - Affected versions: = 6.0.0, = 6.0.2 - Not affected: SP1 V5 all versions - Severity: High Details Background...

PT-2026-32716

Name of the Vulnerable Software and Affected Versions Windows Boot Loader affected versions not specified Description Reliance on untrusted inputs in a security decision allows an authorized attacker to bypass a security feature locally. Recommendations At the moment, there is no information abou...

PT-2026-32896

Name of the Vulnerable Software and Affected Versions DRC Central Office Services COS affected versions not specified Description An unauthenticated configuration file modification issue allows an attacker to modify the server configuration file. This could lead to mass data exfiltration, malicio...

Decidim's comments API allows access to all commentable resources

Impact The root level commentable field in the API allows access to all commentable resources within the platform, without any permission checks. All Decidim instances are impacted that have not secured the /api endpoint. The /api endpoint is publicly available with the default configuration...

PT-2026-32895

Name of the Vulnerable Software and Affected Versions Radware Alteon vADC load-balancer version 34.5.4.0 Description A Reflected Cross-Site Scripting XSS issue allows an attacker to inject malicious scripts into the website. This can lead to unauthorized actions, data theft, or other malicious...

PT-2026-32692

Name of the Vulnerable Software and Affected Versions FortiSandbox versions 5.0.0 through 5.0.5 FortiSandbox versions 4.4.0 through 4.4.8 Description A path traversal issue exists where specially crafted HTTP requests can be used to bypass restricted directory access. This flaw allows a remote...

PT-2026-32887

Windows Snipping Tool affected versions not specified Description An information disclosure issue exists in the Windows Snipping Tool that allows remote attackers to capture NTLM authentication responses from users. Exploitation requires user interaction, where a victim is tricked into visiting a...

PT-2026-32853

Name of the Vulnerable Software and Affected Versions Microsoft SharePoint Server affected versions not specified Microsoft SharePoint Server Subscription Edition affected versions not specified Microsoft SharePoint Enterprise Server affected versions not specified Description An improper input...

PT-2026-32878

Name of the Vulnerable Software and Affected Versions Microsoft 365 Apps for Enterprise versions 16.0.1 through 16.0.1 Description Untrusted pointer dereference in Microsoft Office Word allows an unauthorized attacker to execute code locally by tricking a user into opening a malicious document...

maven-model:Xpp3ReaderFuzzer: Security exception in java.base/java.lang.StringUTF16.newBytesFor

Project: https://github.com/apache/maven.git Detailed Report: https://oss-fuzz.com/testcase?key=6187903607963648 Project: maven-model Fuzzing Engine: libFuzzer Fuzz Target: Xpp3ReaderFuzzer Job Type: libfuzzerasanmaven-model Platform Id: linux Crash Type: Security exception Crash Address: Crash...

mruby:mruby_fuzzer: Heap-buffer-overflow in mrb_vformat

Detailed Report: https://oss-fuzz.com/testcase?key=5605604055121920 Project: mruby Fuzzing Engine: afl Fuzz Target: mrubyfuzzer Job Type: aflasanmruby Platform Id: linux Crash Type: Heap-buffer-overflow READ Crash Address: 0x747fd4ee5ccd Crash State: mrbvformat errorva mrbraisef Sanitizer: addres...

EUVD-2026-22047

Pachno 1.0.6 contains a cross-site request forgery vulnerability that allows attackers to perform arbitrary actions in authenticated user context by exploiting missing CSRF protections on state-changing endpoints. Attackers can craft malicious requests targeting login, registration, file upload,...

EUVD-2026-22049

Pachno 1.0.6 contains an XML external entity injection vulnerability that allows unauthenticated attackers to read arbitrary files by exploiting unsafe XML parsing in the TextParser helper. Attackers can inject malicious XML entities through wiki table syntax and inline tags in issue descriptions...