1219720 matches found
PT-2026-82685
CakePHP Queue is a queue-interop compatible queueing library. From 0.1.11 until 2.3.1, QueueManager::getUniqueId generates identifiers for jobs with shouldBeUnique enabled from the job class, method, and parameters, but sorting parameter values drops associative-array keys. An unauthenticated...
PT-2026-82625
Affected versions of Flowintel contain an authorization flaw in the administrative user-edit API. The existing authorization check correctly prevented an organization administrator from editing users in another organization, but it did not prevent them from editing a full administrator within the...
PT-2026-82382
A flaw has been found in boxpositron with-context-mcp up to 3.0.7. This affects the function ingest notes/teleport notes/sync notes/project folder of the file src/index.ts. Executing a manipulation can lead to path traversal. It is possible to launch the attack remotely. The exploit has been...
CVE-2026-30062
CVE-2026-30062 affects the NGAP handler in free5gc v4.0.1 , an open-source 5G Core implementation. An unauthenticated remote attacker can send a crafted NAS PDU to trigger a Denial of Service , with the CVSS 3.1 score of 7.5 (HIGH) reflecting a network attack vector requiring no privileges or use...
PT-2026-82751
A relative path traversal issue in the zip extraction functionality in AWS diagram-as-code awsdac in versions 0.10 through 0.23 can allow a third party to write arbitrary files to the local filesystem via crafted zip entry names containing path traversal sequences. This could allow the third part...
PT-2026-82680
Trilium is an open-source hierarchical note-taking application. In versions up to and including 0.103.0, the default-on "Safe import" filter does not sanitize note titles, and the GeoMap note view interpolates a marker note's title into raw HTML that is rendered as innerHTML, allowing an...
PT-2026-82800
A flaw was found in jwcrypto. A remote attacker can send a specially crafted JSON Web Encryption JWE token containing numerous period delimiters. This malformed token can force the JWE.deserialize function to allocate excessive memory, leading to a MemoryError. This issue results in a denial of...
PT-2026-82796
cpp-httplib is a C++ header-only HTTP/HTTPS library. In versions 0.33.0 through 0.50.0, the TLS-enabled WebSocket client frees the TLS session before closing the WebSocket that still uses it, producing a use-after-free. In WebSocketClient::shutdown and close the SSL object is freed and the pointe...
PT-2026-82449
Name of the Vulnerable Software and Affected Versions Apache APISIX version 3.17.0 Description An inefficient algorithmic complexity issue exists where a single small request can cause a gateway worker to reach 100% CPU usage for an extended period when using graphql-limit-count routes...
PT-2026-82593
openssl encrypt pip: openssl-encrypt versions 1.4.8 and earlier fail to validate the 36-bit STREAMINFO total samples field of FLAC files before using it to size an allocation np.random.randintsize=total samples, channels. A 50-byte crafted FLAC file declaring 100 million samples causes a...
PT-2026-82773
Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. In versions 4.14.0 through 4.14.6, an authenticated low-privilege user can read the cluster secret from the manager configuration because the logic that masks sensitive values is...
CVE-2026-75417
A SQL injection vulnerability was found in YzmCMS 7.5. The issue occurs in the getarrchildid function within application/admin/controller/category.class.php, where the user-controlled parentid parameter is concatenated directly into a FINDINSET SQL clause without proper sanitization. This allows ...
CVE-2026-30073
An issue in the NssaiAvailabilitySubscriptionCreate component of free5gc v4.0.1 allows attackers to cause a Denial of Service DoS via a crafted POST request...
PT-2026-82537
An issue in the NssaiAvailabilitySubscriptionCreate component of free5gc v4.0.1 allows attackers to cause a Denial of Service DoS via a crafted POST request...
EUVD-2026-67121
An issue in the NssaiAvailabilitySubscriptionCreate component of free5gc v4.0.1 allows attackers to cause a Denial of Service DoS via a crafted POST request...
CVE-2026-30612
An issue in Time4 Popcorn for Windows = 6.2.1.18 and Time4Popcorn for MacOS = 6.2.1.17 and Time4Popcorn for Android = 3.5.0.173 allows a remote attacker to execute arbitrary code via the updater.exe for windows, PT.updd on MacOS components...
EUVD-2026-67256
An issue in Time4 Popcorn for Windows = 6.2.1.18 and Time4Popcorn for MacOS = 6.2.1.17 and Time4Popcorn for Android = 3.5.0.173 allows a remote attacker to execute arbitrary code via the updater.exe for windows, PT.updd on MacOS components...
PT-2026-82686
Silverstripe Advanced Workflow is a highly configurable step-based workflow module. Prior to 6.4.5, 7.1.3, and 7.2.1, an attacker with permission to author the advanced workflow email template can place a specially crafted server-side template payload in NotifyUsersWorkflowAction.EmailTemplate...
PT-2026-82656
DNG SDK versions 1.7.1 2502 and earlier are affected by an out-of-bounds read vulnerability that could lead to memory exposure. An attacker could leverage this vulnerability to disclose sensitive information from memory. Exploitation of this issue requires user interaction in that a victim must...