PT-2026-31285

Name of the Vulnerable Software and Affected Versions LightRAG versions prior to 1.4.14 Description The LightRAG API is susceptible to a JWT algorithm confusion attack. An attacker can forge tokens by setting 'alg': 'none' in the JWT header. The jwt.decode function does not explicitly disallow th...

Six Apart Movable Type SQL注入漏洞

Six Apart Movable Type is an application system developed by the Six Apart company in the United States. It offers features such as multi-user support, comments, Trackbacks, and themes. Six Apart Movable Type has a SQL injection vulnerability; this vulnerability makes it susceptible to SQL...

PT-2026-50309

Name of the Vulnerable Software and Affected Versions Blocksy Companion Pro versions prior to 2.1.29 Description An unauthenticated SQL Injection exists due to insufficient escaping of user-supplied parameters and a lack of proper preparation of SQL queries. This allows attackers to append...

PT-2026-31432

Name of the Vulnerable Software and Affected Versions: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack versions 19.0.0 through 19.0.4, 19.1.0 through 19.1.5, and 19.2.0 through 19.2.4. Description: A denial of service vulnerability exists in React Server...

PT-2026-31396

Name of the Vulnerable Software and Affected Versions SonicWall SMA1000 series appliances affected versions not specified Description Improper handling of Unicode encoding in SonicWall SMA1000 series appliances allows a remote authenticated SSLVPN admin to bypass AMC TOTP authentication...

PT-2026-31594

Name of the Vulnerable Software and Affected Versions Marimo versions prior to 0.23.0 Description Marimo contains a pre-authentication remote code execution RCE flaw. The terminal WebSocket endpoint /terminal/ws fails to perform authentication validation, whereas other endpoints like /ws correctl...

PT-2026-31395

Name of the Vulnerable Software and Affected Versions SonicWall SMA1000 series appliances affected versions not specified Description A remote attacker can enumerate SSL VPN user credentials due to an observable response discrepancy. Recommendations At the moment, there is no information about a...

PT-2026-34331

Name of the Vulnerable Software and Affected Versions PackageKit versions 1.0.2 through 1.3.4 Description PackageKit is a D-Bus abstraction layer used to manage packages across different distributions and architectures. A time-of-check time-of-use TOCTOU race condition exists in the handling of...

PT-2026-34987

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A memory corruption issue exists in the RxRPC subsystem of the Linux kernel, specifically within the rxgk verify response function. The function incorrectly validates the auth len...

PT-2026-31308

Name of the Vulnerable Software and Affected Versions Eclipse Jetty affected versions not specified Description Eclipse Jetty's JASPIAuthenticator class sets two ThreadLocal variables during authentication checks. Under certain conditions, the code returns early without clearing these ThreadLocal...

PT-2026-41279

Name of the Vulnerable Software and Affected Versions DAEMON Tools Lite versions 12.5.0.2421 through 12.5.0.2434 Description A supply chain attack compromised official installation packages distributed via the legitimate website daemon-tools.cc between April 8, 2026, and May 5, 2026. Attackers...

Six Apart Movable Type 代码注入漏洞

Six Apart Movable Type is an application system developed by the Six Apart company in the United States. It offers features such as multi-user access, comments, Trackbacks, and themes. Six Apart Movable Type has a code injection vulnerability; this vulnerability can be exploited by code injection...

PT-2026-31278

Name of the Vulnerable Software and Affected Versions CKThemes Flipmart versions through 2.8 Description A missing authorization issue exists in CKThemes Flipmart, allowing exploitation due to incorrectly configured access control security levels. Recommendations Update to a version greater than...

PT-2026-31283

Name of the Vulnerable Software and Affected Versions Hono versions prior to 4.12.12 Description The ipRestriction function does not properly handle IPv4-mapped IPv6 client addresses e.g., ::ffff:127.0.0.1 when applying IPv4 allow or deny rules. In dual-stack environments like Node.js, this can...

PT-2026-31321

Name of the Vulnerable Software and Affected Versions CI4MS versions prior to 0.31.4.0 Description CI4MS, a CodeIgniter 4-based CMS, is susceptible to arbitrary configuration injection via the .env file. The Install::index controller does not validate the host POST parameter before passing it to...

PT-2026-32093

Name of the Vulnerable Software and Affected Versions Acrobat DC versions prior to 26.001.21411 Acrobat Reader DC versions prior to 26.001.21411 Acrobat 2024 affected versions not specified Description An Improperly Controlled Modification of Object Prototype Attributes, also known as Prototype...

PT-2026-31402

Name of the Vulnerable Software and Affected Versions D-Link DI-8003 version 16.07.26A1 Description A buffer overflow exists due to improper handling of parameters in the /xwgl bwr.asp endpoint. An attacker can exploit this by sending a crafted HTTP GET request using the name, qq, and time...

PT-2026-31284

Name of the Vulnerable Software and Affected Versions Hono versions prior to 4.12.12 Description A discrepancy between browser cookie parsing and parse handling allows cookie prefix protections to be bypassed. Cookie names that are treated as distinct by the browser may be normalized to the same...

PT-2026-31320

Name of the Vulnerable Software and Affected Versions CI4MS versions prior to 0.31.4.0 Description The install route guard in CI4MS relies on a cache check and the existence of a .env file to prevent access to the setup wizard after installation. If the database is temporarily unreachable when th...

PT-2026-31397

Name of the Vulnerable Software and Affected Versions SonicWall SMA1000 series appliances affected versions not specified Description Improper handling of Unicode encoding in SonicWall SMA1000 series appliances allows a remote authenticated SSLVPN user to bypass Workplace/Connect Tunnel TOTP...