PT-2026-30707

Name of the Vulnerable Software and Affected Versions Anthropic Claude Code CLI and Claude Agent SDK affected versions not specified Description The Anthropic Claude Code CLI and Claude Agent SDK contain an OS command injection issue in the prompt editor invocation utility. Attackers can execute...

PT-2026-30768

Name of the Vulnerable Software and Affected Versions Vite versions 6.0.0 through 6.4.1, 7.3.2, and 8.0.5 Description Vite, a frontend tooling framework for JavaScript, had a flaw where the server.fs check was not enforced for the fetchModule method exposed in the Vite dev server’s WebSocket. If ...

PT-2026-30710

Name of the Vulnerable Software and Affected Versions distribution versions 3.0.x and earlier, versions 2.8.x and earlier when redis blob descriptor cache and delete are both enabled Description distribution, a toolkit for managing container content, is susceptible to a confidentiality issue. Whe...

CVE-2026-020963

PT-2026-30585 references CVE-2026-020963 as a Windows buffer overflow with a patch released today. The connected document confirms the affected software is Windows, notes a buffer overflow vulnerability, and states a patch was issued on the same day. No additional technical specifics (affected pr...

PT-2026-30724

Name of the Vulnerable Software and Affected Versions Discount versions 1.3.1.1 through 2.2.7.3 Description A signed length truncation bug causes an out-of-bounds read in the default Markdown parse path. Inputs larger than INT MAX are truncated to a signed int before entering the native parser,...

PT-2026-30868

Name of the Vulnerable Software and Affected Versions Vite versions 7.1.0 through 7.3.1 and 8.0.0 through 8.0.4 Description Vite, a frontend tooling framework for JavaScript, allows retrieval of files blocked by server.fs.deny such as .env and .crt files with HTTP 200 responses when specific quer...

PT-2026-30585

The setup: 4 agents chain off each other in a loop, each reacting to the previous response. Dominus — finds a new vulnerability angle from the CISA KEV catalog Axiom — adds one new technical detail to the finding Cipher — identifies one specific flaw in the previous argument Vector — names one...

PT-2026-30706

Name of the Vulnerable Software and Affected Versions Anthropic Claude Code CLI and Claude Agent SDK affected versions not specified Description Anthropic Claude Code CLI and Claude Agent SDK contain an OS command injection issue in the command lookup helper and deep-link terminal launcher. Local...

PT-2026-30739

Name of the Vulnerable Software and Affected Versions Open edX Platform affected versions not specified Description The Open edX Platform allows for the creation and delivery of online learning content. The view survey API endpoint is susceptible to an open redirect issue due to the lack of...

PT-2026-30764

Name of the Vulnerable Software and Affected Versions PraisonAI versions prior to 1.5.113 Description PraisonAI, a multi-agent teams system, contains a Path Traversal vulnerability in the Action Orchestrator feature. An attacker, or a compromised agent, can write to arbitrary files outside of the...

PT-2026-30708

Name of the Vulnerable Software and Affected Versions Anthropic Claude Code CLI and Claude Agent SDK affected versions not specified Description Anthropic Claude Code CLI and Claude Agent SDK contain an OS command injection issue in authentication helper execution. Helper configuration values are...

espeak-ng:ssml-fuzzer: Stack-buffer-overflow in InterpretPhoneme

Project: https://github.com/espeak-ng/espeak-ng.git Detailed Report: https://oss-fuzz.com/testcase?key=5321099213864960 Project: espeak-ng Fuzzing Engine: libFuzzer Fuzz Target: ssml-fuzzer Job Type: libfuzzerasanespeak-ng Platform Id: linux Crash Type: Stack-buffer-overflow READ 1 Crash Address:...

Exploit for Cross-site Scripting in Exclusiveaddons Exclusive_Addons_For_Elementor

WP-Hunter MCP - Autonomous Bug Bounty Hunting MCP SERVER...

harfbuzz:hb-raster-fuzzer: Crash in hb_raster_paint_radial_gradient

Project: https://github.com/harfbuzz/harfbuzz.git Detailed Report: https://oss-fuzz.com/testcase?key=6597066439852032 Project: harfbuzz Fuzzing Engine: afl Fuzz Target: hb-raster-fuzzer Job Type: aflasanharfbuzz Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x767ea1e57920 Crash State...

36 Malicious npm Packages Exploited Redis, PostgreSQL to Deploy Persistent Implants

Cybersecurity researchers have discovered 36 malicious packages in the npm registry that are disguised as Strapi CMS plugins but come with different payloads to facilitate Redis and PostgreSQL exploitation, deploy reverse shells, harvest credentials, and drop a persistent implant. "Every package...

PT-2026-30697

Name of the Vulnerable Software and Affected Versions StrongBox in Android versions prior to security patch level 2026-04-05 Description StrongBox in Android before security patch level 2026-04-05 contains a High Severity issue. The issue is identified as A-434039170, A-467765081, A-467765894, an...

PT-2026-30461

Name of the Vulnerable Software and Affected Versions Belkin F9K1122 version 1.00.33 Description A stack-based buffer overflow occurs due to the manipulation of the webpage argument in the formWlanSetup function within the /goform/formWlanSetup file. This issue allows a remote attacker to exploit...

sqlite3:ossfuzz: Use-of-uninitialized-value in selectExpander

Detailed Report: https://oss-fuzz.com/testcase?key=6162609471815680 Project: sqlite3 Fuzzing Engine: libFuzzer Fuzz Target: ossfuzz Job Type: libfuzzermsansqlite3 Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: selectExpander sqlite3WalkSelect sqlite3SelectPr...

EUVD-2018-21751

MyBB My Arcade Plugin 1.3 contains a persistent cross-site scripting vulnerability that allows authenticated users to inject malicious scripts through arcade game score comments. Attackers can add crafted HTML and JavaScript payloads in the comment field that execute when other users view or edit...

CVE-2018-25249

MyBB My Arcade Plugin 1.3 contains a persistent cross-site scripting vulnerability that allows authenticated users to inject malicious scripts through arcade game score comments. Attackers can add crafted HTML and JavaScript payloads in the comment field that execute when other users view or edit...