CGA-G2JF-RFQX-9Q9V

Bulletin has no description...

CGA-QV4Q-P394-PGP2

Bulletin has no description...

CGA-3JF3-MHJ7-HMV4

Bulletin has no description...

CGA-2R6V-23PC-5HP7

Bulletin has no description...

CGA-9RRM-RVPC-62C6

Bulletin has no description...

CGA-CPWF-Q7CR-8XPR

Bulletin has no description...

CGA-5P69-H6W2-994C

Bulletin has no description...

CGA-4VXQ-GH2X-WPF5

Bulletin has no description...

CGA-RP33-GWMW-Q5GM

Bulletin has no description...

CGA-45GV-W4P3-GMGR

Bulletin has no description...

CGA-R89F-2V5X-P77C

Bulletin has no description...

CGA-XHXM-M8QC-VHFH

Bulletin has no description...

PT-2026-132122

JeeSite 5.11.0 through 5.19.1 contains an insecure direct object reference vulnerability in the AI CMS chat module that allows authenticated users to access other users' conversations due to missing and reversed ownership checks. Attackers who know or derive a victim's conversation id can call...

PT-2026-132846

Lightdash is an open source business intelligence platform. In affected versions through 0.3213.0, the dbt Cloud webhook POST /api/v1/projects/projectUuid/dbt-cloud/webhook has no authentication middleware or signature validation. In packages/backend/src/controllers/projectController.ts,...

PT-2026-132848

WeGIA is a web manager for charitable institutions. Prior to 3.8.7, a stored DOM cross-site scripting vulnerability in web/html/memorando/listar despachos.php results from unsafe handling of the texto field. The affected flow spans web/controle/memorando/DespachoControle.php and...

PT-2026-132123

FreeMail before 5.3.2 contains an authorization bypass vulnerability that allows authenticated users to claim another user's existing mailbox via the POST /api/create endpoint. Attackers who know a victim's address can become co-owners through assignMailboxToUser to read messages and verification...

PT-2026-132102

oapi-codegen 2.0.0 before 2.8.1 contains a code injection vulnerability that allows attackers to inject Go code by supplying non-literal enum entries in integer, number, or boolean schemas. Attackers controlling an OpenAPI document can craft an enum entry that closes the const block in...

PT-2026-132840

Nx is a monorepo solution for TypeScript and polyglot codebases. From 22.0.2 until 22.7.9 and 23.1.2 for @nx/maven, and from 21.0.0 until 22.7.9 and 23.1.2 for @nx/gradle, the plugins' project-graph analyzers launch through a shell and interpolate plugin options from nx.json into command argument...

PT-2026-132503

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.2, FishActivator inherits ViaTemplateActivator.quote, which uses POSIX shlex.quote even though fish interprets backslashes and single quotes differently. An attacker-influenced environment path, --prompt, or...

PT-2026-132071

OmniRoute 3.8.0 before 3.8.52 contains an unverified password change vulnerability that allows holders of manage- or admin-scoped API keys or oma access tokens to change the management password without the current password. Attackers can send POST requests to /api/settings/require-login to lock o...