PT-2026-103961

djehuty is a research data repository system developed by 4TU.ResearchData. Prior to version 26.3.2, An unauthenticated attacker can inject SPARQL into the search/listing queries through three separate parameters. Because the affected queries are read SELECT queries, this does not write to the...

PT-2026-105069

Improper handling of highly compressed data data amplification in ASP.NET Core allows an unauthorized attacker to deny service over a network...

PT-2026-103788

Name of the Vulnerable Software and Affected Versions n8n versions prior to 1.123.80 n8n versions 2.0.0 through 2.39.5 n8n versions 2.40.0 Description A path traversal issue exists in the Supabase node where the tableId parameter is inserted into request paths without proper validation. This allo...

PT-2026-103829

Name of the Vulnerable Software and Affected Versions Apache APISIX versions 2.3.0 through 3.6.x Description An issue exists where a request's authorization scope could persist into subsequent requests on the same route when using a supported authz-keycloak configuration. This leads to unintended...

PT-2026-104031

Name of the Vulnerable Software and Affected Versions Johnson Controls Neo Series MVP2 versions prior to 3.3b63 Description A vulnerability in the On-Chip Debug Interface allows the collection of data from common resource locations. Recommendations Update Johnson Controls Neo Series MVP2 to versi...

PT-2026-103947

Name of the Vulnerable Software and Affected Versions GraphQL Tools versions prior to 1.1.35 Description The buildWSLegacyExecutor function in the executor-legacy-ws module hardcodes the TLS certificate rejection to off for Node.js connections to wss:// endpoints. This allows applications using t...

PT-2026-104018

Name of the Vulnerable Software and Affected Versions Powertools for AWS Lambda Python versions prior to 3.35.0 Description A fail-open error handling issue exists within the data masking utility. This flaw may allow actors to read sensitive field values that the application intended to mask...

PT-2026-105603

Klever-Go: Elasticsearch bulk / painless injection via on-chain account name - explorer/indexer data forgery in github.com/klever-io/klever-go...

CVE-2026-103252: Authorization Bypass Through User-Controlled Key

n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain an authorization bypass vulnerability in the credential test endpoint that resolves project-scoped variables without validating caller access. Attackers can specify an arbitrary project ID in the request...

CVE-2026-101148: External Control of File Name or Path

The BackupSheep WordPress Backup Plugin WordPress plugin through 1.8 does not properly validate its integration key, treating an unset or blank key as valid, which allows unauthenticated attackers to create and download full site backups, including the database with user password hashes, and to...

CVE-2026-103284: Incorrect Authorization

Ghost versions from 5.125.1 before 6.57.1 contain an information disclosure vulnerability in the Admin Feedback endpoint that allows unauthorized staff users to access member data. Attackers with staff privileges can query the feedback endpoint to retrieve sensitive member information without...

PT-2026-103791

Name of the Vulnerable Software and Affected Versions n8n versions prior to 2.39.6 n8n versions 2.40.0 through 2.40.0 Description An unescaped parameter interpolation issue exists in the SendGrid, Freshservice, and ServiceNow nodes. This allows attackers to bypass filters by breaking out of query...

CVE-2026-51893

The infiniflow ragflow 0.24.0 software is vulnerable to Incorrect Access Control via the trace_mindmap function. An externally reachable path allows a caller to select an object or tenant identifier, which is then used in a data-access operation that lacks any visible owner, tenant, workspace, or...

System-Level Optimization beyond Cryptographic Kernels: An ML-KEM Case Study on Arm Cortex-M7

Recent work on embedded post-quantum cryptography has focused primarily on instruction-level optimization, including arithmetic-kernel improvements, assembly tuning, register allocation, and instruction scheduling. Using the Module-Lattice-Based Key-Encapsulation Mechanism ML-KEM on an Arm...

CVE-2026-12241: Improper Neutralization of Input During Web Page Generation

The Advanced Woo Labels – Product Labels & Badges for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to an improperly secure capability check on the 'savemetaboxes' function in all versions up to, and including, 2.51. This makes it possible for authenticat...

PT-2026-103670

Name of the Vulnerable Software and Affected Versions Advanced Woo Labels – Product Labels & Badges for WooCommerce versions prior to 2.52 Description An improperly secure capability check in the save meta boxes function allows authenticated attackers with Contributor-level access or higher to...

PT-2026-103816

Name of the Vulnerable Software and Affected Versions Ghost versions 5.125.1 through 6.57.0 Description An information disclosure issue exists in the Admin Feedback endpoint. Staff users with limited privileges can query this endpoint to retrieve sensitive member data because the system fails to...

PT-2026-104057

Mooncake transfer engine before 0.3.13 contains an untrusted pointer dereference in ServerSession::readHeader that allows unauthenticated attackers to read and write arbitrary process memory via the TCP transport data port. Attackers can send a crafted SessionHeader with arbitrary addr and size...

ROS-20261001-73-0041

The vulnerability in rclone relates to the transmission of data in an open manner. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain unauthorized access to protected information...

ROS-20261001-73-0046

The vulnerability in rclone is related to the lack of protection for service data. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain unauthorized access to protected information...