PT-2026-30341

Name of the Vulnerable Software and Affected Versions pyLoad affected versions not specified Description pyLoad, a Python-based download manager, has a flaw where a user with SETTINGS and ADD permissions can redirect downloads to the Flask filesystem session store. This allows planting a maliciou...

Vikunja has an IDOR in Task Comments Allows Reading Arbitrary Comments

An authenticated user can read any task comment by ID, regardless of whether they have access to the task the comment belongs to, by substituting the task ID in the API URL with a task they do have access to...

📄 OpenEMR Remote Code Execution

OpenEMR versions prior to 8.0.0.1 contain multiples command injection vulnerabilities in the backup functionality that can be exploited by authenticated attackers. CVE-2026-32238 - Remote Code Execution in OpenEMR Weakness CWE-78 : Improper Neutralization of Special Elements used in an OS Command...

PT-2026-26686

Name of the Vulnerable Software and Affected Versions CTEK Chargeport affected versions not specified Description WebSocket endpoints lack proper authentication mechanisms, enabling attackers to perform unauthorized station impersonation and manipulate data sent to the backend. An unauthenticated...

PT-2026-29171

Summary The EventStream class in h3 fails to sanitize carriage return r characters in data and comment fields. Per the SSE specification, r is a valid line terminator, so browsers interpret injected r as line breaks. This allows an attacker to inject arbitrary SSE events, spoof event types, and...

PT-2026-26619

D-Link DIR-513 Web Service formEasySetPassword stack-based overflow CVE: CVE-2026-4486 PT-Identifier: PT-2026-26619 Vendor: D-link Product: DIR-513 CVSS: 8.7 Credits: AttackingLin VulDB User Description: A vulnerability was found in D-Link DIR-513 1.10. This affects the function formEasySetPasswo...

PT-2026-26751

Name of the Vulnerable Software and Affected Versions Vikunja affected versions not specified Description An authenticated user can access task comments without proper authorization checks. Specifically, an attacker can read any task comment by ID, even if they do not have access to the associate...

PT-2026-35394

Name of the Vulnerable Software and Affected Versions Apache Camel versions 4.14.0 through 4.14.5 Apache Camel versions prior to 4.18.1 Apache Camel version 4.19.0 Description The camel-coap component is susceptible to message header injection. The CamelCoapResource.handleRequest function iterate...

Exploit for OS Command Injection in Php

╔═══════════════════════════════════════════════════════╗...

assimp:assimp_fuzzer: Crash in Assimp::MDLImporter::ProcessFrames_3DGS_MDL7

Project: https://github.com/assimp/assimp.git Detailed Report: https://oss-fuzz.com/testcase?key=6077223328350208 Project: assimp Fuzzing Engine: libFuzzer Fuzz Target: assimpfuzzer Job Type: libfuzzerubsanassimp Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x58c4b71f6002 Crash Stat...

hostap:pasn-init: Heap-buffer-overflow in wpa_pasn_auth_rx

Project: git://w1.fi/srv/git/hostap.git Detailed Report: https://oss-fuzz.com/testcase?key=6425366330933248 Project: hostap Fuzzing Engine: libFuzzer Fuzz Target: pasn-init Job Type: libfuzzerasani386hostap Platform Id: linux Crash Type: Heap-buffer-overflow READ 2 Crash Address: 0xf4c006ac Crash...

pcapplusplus:FuzzTargetNg: Use-of-uninitialized-value in pcpp::IDnsResource::decodeName

Project: https://github.com/seladb/PcapPlusPlus.git Detailed Report: https://oss-fuzz.com/testcase?key=6299230322098176 Project: pcapplusplus Fuzzing Engine: libFuzzer Fuzz Target: FuzzTargetNg Job Type: libfuzzermsanpcapplusplus Platform Id: linux Crash Type: Use-of-uninitialized-value Crash...

harfbuzz:hb-vector-fuzzer: Heap-use-after-free in hb_vector_paint_glyph

Project: https://github.com/harfbuzz/harfbuzz.git Detailed Report: https://oss-fuzz.com/testcase?key=6065382371950592 Project: harfbuzz Fuzzing Engine: libFuzzer Fuzz Target: hb-vector-fuzzer Job Type: libfuzzerasani386harfbuzz Platform Id: linux Crash Type: Heap-use-after-free READ 4 Crash...

PT-2026-26372

Name of the Vulnerable Software and Affected Versions Microsoft Bing Images affected versions not specified Description Improper neutralization of special elements used in a command, known as command injection, allows an unauthorized remote attacker to execute arbitrary code over a network. The...

PT-2026-26352

Name of the Vulnerable Software and Affected Versions M365 Copilot affected versions not specified Description An improper neutralization of special elements used in a command 'command injection' exists in M365 Copilot. This allows an unauthorized attacker to disclose information over a network...

CVE-2026-216670

PT-2026-26287 associates CVE-2026-216670 with Veeam Backup & Replication (Veeam B&R). The entry notes fixes: CVEs resolved in Veeam B&R 12.3.2.4165 (released 12 Mar 2026) and in 13.0.1.x (also released 12 Mar 2026). No root-cause details are provided in the connected document, only that these CVE...

PT-2026-26297

Name of the Vulnerable Software and Affected Versions Claude Code versions prior to 2.1.53 Description Claude Code is an agentic coding tool that experienced a loading order issue in its settings loader. The software resolved the permission mode from settings files, such as the...

PT-2026-26488

Summary A Server-Side Request Forgery SSRF vulnerability exists in plugin/Live/standAloneFiles/saveDVR.json.php. When the AVideo Live plugin is deployed in standalone mode the intended configuration for this file, the $ REQUEST'webSiteRootURL' parameter is used directly to construct a URL that is...

PT-2026-26489

Name of the Vulnerable Software and Affected Versions AVideo versions prior to 26.0 Description AVideo, an open source video platform, contains an unauthenticated SQL injection flaw in the objects/category.php file within the getAllCategories method. The doNotShowCats request parameter undergoes...

PT-2026-26287

We're not migrating to Veeam B&R 13.0.1 until the end of the year, as Veeam B&R is supported until 01 Feb 2027, and we're not find of adopting applications before a couple of version releases have been made. We noticed Action1 appears to be incorrectly assigning CVE's affecting Veeam B&R 13.0.1.x...