CVE-2026-51376

An issue in BitChat for iOS v1.15.0 allows a remote attacker to cause a denial of service via an unauthenticated MESSAGE packet into the mesh gossip cache...

PT-2026-83240

JS Recon is a JavaScript enumeration and SAST tool. From 1.2.1-beta.1 until 1.3.1-beta.2, the PR Branch Checker workflow in .github/workflows/pr checker.yml places github.head ref and github.event.pull request.head.repo.full name into BRANCH NAME and SOURCE REPO and interpolates those untrusted...

PT-2026-82959

In the Linux kernel, the following vulnerability has been resolved: mmc: vub300: defer reset until cmd mutex is unlocked vub300 cmndwork thread holds cmd mutex while it sends a command and waits for the command response. If the response wait times out, vub300 command response kills the command UR...

PT-2026-83367

Name of the Vulnerable Software and Affected Versions multer versions prior to 2.3.0 Description A denial of service issue exists in the middleware used for handling multipart/form-data in Node.js. A remote attacker can block the event loop by sending a multipart request containing two specially...

PT-2026-83014

Name of the Vulnerable Software and Affected Versions Linux Kernel affected versions not specified Description An issue exists in the ipvs module where synced connections may incorrectly inherit the IP VS CONN F ONE PACKET flag during the ip vs bind dest function execution. This occurs when a...

PT-2026-83244

Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs allows a user with SystemPrivilege.ControlArchiving to create a double-quoted StreamSQL column name that is interpolated into generated Java source by Expression.fillCode InputDefVars and Expression.sanitizeName. A sum...

PT-2026-83161

A flaw was found in the file-pvr plugin in GIMP. When processing a specially crafted PVR image file, the VQ compressed decoder does not properly perform memory bounds checking. This missing validation results in a heap out-of-bounds read. This issue can result in an application crash, leading to ...

PT-2026-83082

Authentication Bypass by Spoofing vulnerability in WPDeveloper Essential Addons for Elementor allows Identity Spoofing. This issue affects Essential Addons for Elementor: from n/a through 6.8.0...

PT-2026-83348

Name of the Vulnerable Software and Affected Versions MariaDB Connector/Node.js versions prior to 3.2.4 MariaDB Connector/Node.js versions prior to 3.3.3 MariaDB Connector/Node.js versions prior to 3.4.6 MariaDB Connector/Node.js versions prior to 3.5.3 Description MariaDB Connector/Node.js can...

PT-2026-83227

Name of the Vulnerable Software and Affected Versions Klever-Go versions prior to 1.7.19 Description A time-of-check/time-of-use TOCTOU issue exists in the marketplace settlement process. While the system ensures that the combined referral and royalty percentages do not exceed 100% at the time of...

CVE-2026-40017

An attacker that can send mail to a user can craft a message header whose values are chosen to collide in an internal hash table, which makes the IMAP THREAD command consume CPU disproportionate to the size of the message. This is a separate issue from CVE-2026-40014 and is not addressed by that...

PT-2026-83129

An issue in the seekdir function /dirent/mod.rs of relibc commit 61f42d allows attackers to cause a Denial of Service DoS via a crafted input...

PT-2026-82960

In the Linux kernel, the following vulnerability has been resolved: hwmon: occ unregister sysfs devices outside occ lock occ activefalse and occ shutdown unregister sysfs-backed devices while occ-lock is held. hwmon device unregister and sysfs remove group can wait for active sysfs callbacks to...

CVE-2026-51376

An issue in BitChat for iOS v1.15.0 allows a remote attacker to cause a denial of service via an unauthenticated MESSAGE packet into the mesh gossip cache...

CVE-2026-37736

An issue in the JsonSanitizer.sanitize component of OWASP json-sanitizer v1.2.3 allows attackers to cause a Denial of Service DoS via a crafted input...

CVE-2026-38638

An issue in the withargv function /unistd/mod.rs of relibc commit 61f42d allows attackers to cause a Denial of Service DoS via a crafted input...

PT-2026-83158

A flaw was found in the file-iff IFF/ILBM plugin in GIMP. When processing a specially crafted IFF/ILBM image file, the plugin does not properly validate the HAM row size and improperly handles cases where the number of color planes nPlanes is zero. This causes a row size mismatch that bypasses...

PT-2026-83083

A vulnerability was detected in iswalle getnote-mcp up to 1.5.0. The affected element is the function fs.readFileSync of the file src/index.ts of the component upload image. Performing a manipulation of the argument image path results in path traversal. The attack can be initiated remotely. The...

PT-2026-83151

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Crocoblock JetEngine allows Reflected XSS. This issue affects JetEngine: from n/a through 3.8.14.2...

PT-2026-83136

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Dayneks Software Industry and Trade Inc. E-Commerce Platform allows Reflected XSS. This issue affects E-Commerce Platform: through 28082026. NOTE: The vendor was contacted early about this disclosu...