PT-2026-57868

A vulnerability was identified in SourceCodester Class and Exam Timetabling System 1.0. The impacted element is an unknown function of the file /subject.php. Such manipulation of the argument subject leads to cross site scripting. It is possible to launch the attack remotely. The exploit is...

PT-2026-57876

Name of the Vulnerable Software and Affected Versions EIPStackGroup OpENer version 2.3.0 commit 76b95cf Description An out-of-bounds read occurs in the Connection Manager when handling ForwardOpen requests during the processing of short malformed packets. An unauthenticated remote attacker can...

PT-2026-57808

Name of the Vulnerable Software and Affected Versions CodeAstro Simple Online Leave Management System version 1.0 Description Remote SQL injection is possible due to improper handling of the ID variable in the '/SimpleOnlineLeave/admin/deletemp.php' endpoint. SQL injection is a technique where an...

PT-2026-59109

A vulnerability has been found in datapizza-labs datapizza-ai 0.0.7. Affected by this vulnerability is the function RedisCache of the file datapizza-ai-cache/redis/datapizza/cache/redis/cache.py. Such manipulation leads to deserialization. The attack requires being on the local network. A high...

PT-2026-59589

A flaw has been found in PrefectHQ prefect up to 3.6.13. Affected is an unknown function of the file /api/events/in of the component WebSocket Endpoint. Executing a manipulation can lead to missing authentication. The attack may be performed from remote. The exploit has been published and may be...

PT-2026-59303

A vulnerability was found in douinc mkdocs-mcp-plugin up to 0.4.1. This affects the function read document/list documents of the file server.py. Performing a manipulation of the argument docs dir/file path results in path traversal. The attack is possible to be carried out remotely. The exploit h...

PT-2026-59060

A vulnerability was detected in AstrBotDevs AstrBot up to 4.23.5. Impacted is the function post file of the file astrbot/dashboard/routes/chat.py of the component File Upload Handler. The manipulation of the argument filename results in path traversal. It is possible to launch the attack remotely...

PT-2026-59177

A vulnerability was found in NousResearch hermes-agent 2026.4.23. The impacted element is the function scan context content of the file agent/prompt builder.py. The manipulation results in injection. The attack may be performed from remote. The exploit has been made public and could be used. The...

PT-2026-60014

A vulnerability was identified in ByteDance verl up to 0.7.1. Affected is the function math equal of the file prime math/grader.py. The manipulation leads to a sandbox issue. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is told to ...

PT-2026-59590

A vulnerability has been found in PrefectHQ prefect up to 3.6.28.dev1. Affected by this vulnerability is the function validate restricted url of the component Webhook/Notification. The manipulation leads to time-of-check time-of-use. It is possible to initiate the attack remotely. The attack is...

PT-2026-59150

A security vulnerability has been detected in lm-sys fastchat up to 0.2.36. This issue affects the function api generate of the component Worker API Endpoint. The manipulation leads to resource consumption. The attack can be initiated remotely. The exploit has been disclosed publicly and may be...

PT-2026-57582

A vulnerability was detected in MacCMS Pro up to 2022.1000.3005. Impacted is the function step5 of the file application/install/controller/Index.php of the component Installation Module. The manipulation results in authorization bypass. The attack may be launched remotely. The attack requires a...

PT-2026-57649

A vulnerability was determined in Shibby Tomato up to 1.28.0000. Affected is the function getupsvar of the file www/apcupsd/tomatodata.cgi of the component apcupsd. This manipulation of the argument Field causes stack-based buffer overflow. The attack may be initiated remotely. The exploit has be...

PT-2026-57669

A weakness has been identified in waooAI waoowaoo up to 0.4.1. Affected by this vulnerability is the function getInternalTaskSession/getAuthSession/requireUserAuth/requireProjectAuth/requireProjectAuthLight in the library src/lib/api-auth.ts of the component Internal Task Header Handler. This...

PT-2026-59332

A security vulnerability has been detected in edvardlindelof notes-mcp up to 0.1.4. This affects an unknown function of the file notes mcp.py. The manipulation of the argument root dir/path leads to path traversal. The attack is possible to be carried out remotely. The exploit has been disclosed...

PT-2026-57608

A vulnerability was identified in makafeli n8n-workflow-builder up to 0.11.0. Affected is an unknown function of the file build/server.cjs of the component update node from file. The manipulation of the argument filePath leads to path traversal. An attack has to be approached locally. The exploit...

PT-2026-60009

A flaw has been found in vanna-ai vanna up to 2.0.2. This impacts the function remove training data of the file src/vanna/legacy/google/bigquery vector.py. This manipulation of the argument ID causes sql injection. The attack can be initiated remotely. The exploit has been published and may be...

The vulnerabilities of the functions ParseConfigYamlFile() and backup.GetInfo() in the container management system and the virtual machine manager Incus allow a hacker to trigger a service failure.

The vulnerabilities of the functions ParseConfigYamlFile and backup.GetInfo in the container management system and the virtual machine manager Incus are related to the use of a null pointer. Exploiting these vulnerabilities could allow an attacker to cause service interruptions...

The vulnerability of the aiohttp HTTP client, related to the failure to handle CRLF sequences in HTTP headers, allows attackers to inject arbitrary HTTP headers.

The vulnerability of the aiohttp HTTP client is related to the failure to handle CRLF sequences in HTTP headers when processing the reason parameter. Exploiting this vulnerability allows an attacker who operates remotely to inject arbitrary HTTP headers...

The vulnerability of the splunkd component of the Splunk Enterprise platform for operational analytics allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the splunkd component of the Splunk Enterprise platform relates to the disclosure of information. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to protected information...