CVE-2026-82715: Insecure Temporary File

Insecure Temporary File vulnerability in Hitachi Disk Array Driver for AIX and Hitachi Disk Array Driver for Virtual I/O Server. This issue affects Hitachi Disk Array Driver for AIX: from 01-00 before 01-23-/A; Hitachi Disk Array Driver for Virtual I/O Server: from 01-04 before 01-23-/A...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: flatpak (UTSA-2026-130041)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-130041 advisory. In Flatpak before 1.18.1, a malicious sandboxed app can obtain arbitrary read and write access to files on the host, which can be escalated to arbitrary code executi...

Ubuntu 18.04 LTS / 20.04 LTS : Linux kernel vulnerabilities (USN-8919-1)

The remote Ubuntu 18.04 LTS / 20.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-8919-1 advisory. Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update...

Copeland XWEB and XWEB Pro Improper Limitation of a Pathname to a Restricted Directory (CVE-2026-22877)

An arbitrary file-read vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling unauthenticated attackers to read arbitrary files on the system, and potentially causing a denial-of-service attack. This plugin only works with Tenable.ot. Please visit...

PT-2026-113593

The BP Profile Search plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 5.9 via the 'ajax template' value parsed from the client-controlled 'bps directory' cookie during BuddyPress AJAX directory requests. The bps directory ajax filter hooked onto bp...

PT-2026-113601

The Printcart Store PCDesigner / NB Designer plugin for WooCommerce is vulnerable to unauthenticated arbitrary file upload leading to remote code execution in all versions up to, and including, 2.9.1 The nbdesigner copy image from url AJAX action is registered for logged-out callers wp ajax nopri...

PT-2026-113597

Insecure Temporary File vulnerability in Hitachi Disk Array Driver for AIX and Hitachi Disk Array Driver for Virtual I/O Server. This issue affects Hitachi Disk Array Driver for AIX: from 01-00 before 01-23-/A; Hitachi Disk Array Driver for Virtual I/O Server: from 01-04 before 01-23-/A...

PT-2026-113608

Epic Games Unreal Engine versions up to and including 5.8.0 ship with an insecure default configuration for the LaunchURL Blueprint node UKismetSystemLibrary::LaunchURL. The URL scheme filter FURLRequestFilter is empty by default, which permits all URL schemes. On Windows, this results in a call ...

PT-2026-114424

Name of the Vulnerable Software and Affected Versions curl versions prior to 8.23.0-1.1 Description When using the --remote-header-name -J option, the software fails to maintain anti-clobbering protection under specific conditions. This occurs if an intermediate 103 Early Hints response precedes...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: rsync (UTSA-2026-130127)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-130127 advisory. rsync before 3.5.0contains a path traversal vulnerability that allows remote clients to access files outside the intended module root when use chroot is disabled and...

PT-2026-113604

The Snazzy Social Media Feed plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.5 via the file scope function. This is due to missing WordPress bootstrap, authentication, capability, and nonce checks in the standalone save-to-cache.php script,...

PT-2026-113737

Name of the Vulnerable Software and Affected Versions Cisco Secure Email Gateway versions prior to 15.5.5-014 Cisco Secure Email Gateway 16.0 Cisco Secure Email Gateway versions prior to 16.5.0-780 Description A relative path traversal issue exists in the Advanced Malware Protection AMP feature o...

PT-2026-113671

The Ultimate Multisite WordPress plugin before 2.17.2 does not validate a user-supplied value used to select a file to include, allowing unauthenticated attackers to include and read arbitrary local files, including the WordPress configuration file...

PT-2026-113989

Name of the Vulnerable Software and Affected Versions PgBouncer versions 1.17.0 through 1.26.0 Description Improper authentication occurs during the SCRAM authentication process. A remote attacker who possesses the password of a user listed in the auth file can authenticate as any other user that...

PT-2026-114174

GitPython from 3.1.62 before 3.2.0 contains a symlink-following flaw in Submodule.move, which checks the destination only lexically and does not reject symbolic links in intermediate path components. An untrusted repository can commit a symlink such as vendor pointing outside the worktree, so an...

PT-2026-114124

Godot Engine through 4.7.2 has an out-of-bounds read in the optimized translation loader core/string/optimized translation.cpp, OptimizedTranslation::get message. Offsets read from the hash table of a crafted .translation resource are used as indices into the bucket table without bounds validatio...

PT-2026-114145

FreeRDP versions 3.13.0 before 3.32.0 contain a resource retention flaw in drive process irp create, which registers an opened local file in the drive dictionary before applying the allocation size and does not remove it when that operation fails. A malicious RDP server connected to a client with...

PT-2026-114118

unshield through 1.6.2 contains a heap out-of-bounds read vulnerability in unshield get file table that allows attackers to read past heap allocations via unchecked cabinet header offsets. Attackers can supply a crafted InstallShield cabinet with out-of-range file table offset or large file count...

PT-2026-113620

The JTL-Connector for WooCommerce plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.4.3 via the saveImage function. This is due to the startSession function accepting an empty jtlauth parameter as a valid credential, combined with insufficient fil...

PT-2026-113707

The ShopMagic – email automation for WordPress plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.9.0 via the 'billing address.first name' parameter parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary .ph...