PT-2026-30334

Name of the Vulnerable Software and Affected Versions AVideo versions 26.0 and prior Description The install/test.php diagnostic script has its CLI-only access guard disabled, allowing access via HTTP after installation. This exposes video viewer statistics, including IP addresses, session IDs, a...

PT-2026-40436

Name of the Vulnerable Software and Affected Versions cPanel affected versions not specified Description Incorrect privileges management and insufficient path filtering in the cpdavd service allow a remote, unauthenticated attacker to read arbitrary files on the server as root. This is achieved...

CVE-2018-25249: Improper Neutralization of Input During Web Page Generation

MyBB My Arcade Plugin 1.3 contains a persistent cross-site scripting vulnerability that allows authenticated users to inject malicious scripts through arcade game score comments. Attackers can add crafted HTML and JavaScript payloads in the comment field that execute when other users view or edit...

PT-2026-30321

Name of the Vulnerable Software and Affected Versions defu versions prior to 6.1.5 Description Applications using the defu software are susceptible to prototype pollution when processing unsanitized user input, such as parsed JSON request bodies, database records, or config files from untrusted...

PT-2026-30316

Name of the Vulnerable Software and Affected Versions ProfilePress versions prior to 4.16.12 Description The ProfilePress plugin for WordPress is susceptible to unauthorized membership payment bypass due to a missing ownership verification on the change plan sub id parameter within the process...

PT-2026-30324

Name of the Vulnerable Software and Affected Versions libp2p-rendezvous versions prior to 0.56.1 Description The libp2p-rendezvous server is susceptible to an Out-of-Memory OOM Denial of Service DoS condition. The server does not limit the number of namespaces a single peer can register. A...

PT-2026-30288

Name of the Vulnerable Software and Affected Versions FortiClient EMS versions 7.2.0 through 7.2.2 FortiClient EMS versions 7.4.x Description An improper access control vulnerability exists in the FortiClient Enterprise Management Server EMS that allows an unauthenticated remote attacker to execu...

PT-2026-30388

Breaking CyberSecurity News For 2026.04.04 | Pithy Cyborg | Threats. Breaches. Intel. ➔ Google patched CVE-2026-5281, a use-after-free bug in Dawn WebGPU, marking the fourth Chrome zero-day exploited in the wild this year. Affected versions were updated to 146.0.7680.177/178 for Windows, macOS, a...

GHSA-FGV4-6JR3-JGFW BentoML: Command Injection in cloud deployment setup script

Commit ce53491 March 24 fixed command injection via systempackages in Dockerfile templates and images.py by adding shlex.quote. However, the cloud deployment path in src/bentoml/internal/cloud/deployment.py was not included in the fix. Line 1648 interpolates systempackages directly into a shell...

BentoML: Command Injection in cloud deployment setup script

Commit ce53491 March 24 fixed command injection via systempackages in Dockerfile templates and images.py by adding shlex.quote. However, the cloud deployment path in src/bentoml/internal/cloud/deployment.py was not included in the fix. Line 1648 interpolates systempackages directly into a shell...

GHSA-8X5Q-PVF5-64MP Electron: Use-after-free in offscreen shared texture release() callback

Impact Apps that use offscreen rendering with GPU shared textures may be vulnerable to a use-after-free. Under certain conditions, the release callback provided on a paint event texture can outlive its backing native state, and invoking it after that point dereferences freed memory in the main...

Electron: Use-after-free in offscreen shared texture release() callback

Impact Apps that use offscreen rendering with GPU shared textures may be vulnerable to a use-after-free. Under certain conditions, the release callback provided on a paint event texture can outlive its backing native state, and invoking it after that point dereferences freed memory in the main...

harfbuzz:hb-gpu-fuzzer: Heap-buffer-overflow in hb_gpu_draw_encode

Project: https://github.com/harfbuzz/harfbuzz.git Detailed Report: https://oss-fuzz.com/testcase?key=6336503637934080 Project: harfbuzz Fuzzing Engine: libFuzzer Fuzz Target: hb-gpu-fuzzer Job Type: libfuzzerasanharfbuzz Platform Id: linux Crash Type: Heap-buffer-overflow WRITE 4 Crash Address:...

CVE-2026-5032

The W3 Total Cache plugin for WordPress is vulnerable to information exposure in all versions up to, and including, 2.9.3. This is due to the plugin bypassing its entire output buffering and processing pipeline when the request's User-Agent header contains "W3 Total Cache", which causes raw...

CVE-2025-70951

CVE-2025-70951 is supported by a connected PTSecurity entry (PT-2026-30044) describing a remote code execution in Control Web Panel. The PT entry notes an RCE vulnerability but does not specify affected versions or a patch/fix, and provides no concrete exploit details. Publicly available informat...

gpac:fuzz_probe_analyze: Heap-buffer-overflow in str2ullong

Project: https://github.com/gpac/gpac.git Detailed Report: https://oss-fuzz.com/testcase?key=6709026821046272 Project: gpac Fuzzing Engine: afl Fuzz Target: fuzzprobeanalyze Job Type: aflasangpac Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address: 0x7bf3a08a1d14 Crash State:...

haproxy:fuzz_cfg_parser: Segv on unknown address in sanitize_for_printing

Project: https://github.com/haproxy/haproxy.git Detailed Report: https://oss-fuzz.com/testcase?key=6605284020912128 Project: haproxy Fuzzing Engine: honggfuzz Fuzz Target: fuzzcfgparser Job Type: honggfuzzasanhaproxy Platform Id: linux Crash Type: Segv on unknown address Crash Address: Crash Stat...

ffmpeg:ffmpeg_AV_CODEC_ID_AAC_DEC_fuzzer: Use-of-uninitialized-value in ff_aac_ec_data_dec

Project: https://git.ffmpeg.org/ffmpeg.git https://github.com/FFmpeg/FFmpeg.git Detailed Report: https://oss-fuzz.com/testcase?key=6460684568428544 Project: ffmpeg Fuzzing Engine: libFuzzer Fuzz Target: ffmpegAVCODECIDAACDECfuzzer Job Type: libfuzzermsanffmpeg Platform Id: linux Crash Type:...

ghostscript:gs_xps_fuzzer: Heap-use-after-free in txt_impl_process

Detailed Report: https://oss-fuzz.com/testcase?key=6422215347470336 Project: ghostscript Fuzzing Engine: libFuzzer Fuzz Target: gsxpsfuzzer Job Type: libfuzzerasanghostscript Platform Id: linux Crash Type: Heap-use-after-free WRITE 1 Crash Address: 0x7c54dadcc973 Crash State: txtimplprocess...

haproxy:fuzz_cfg_parser: Global-buffer-overflow in cfg_eval_cond_term

Project: https://github.com/haproxy/haproxy.git Detailed Report: https://oss-fuzz.com/testcase?key=6039851723194368 Project: haproxy Fuzzing Engine: honggfuzz Fuzz Target: fuzzcfgparser Job Type: honggfuzzasanhaproxy Platform Id: linux Crash Type: Global-buffer-overflow READ 1 Crash Address:...