PT-2026-84508

SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version 1.0.0 until versions 2.8.4, 3.3.5, and 4.1.0, the opt-in removeScripts plugin, named removeScriptElement in versions 2 and 3, incompletely filters executable links in...

PT-2026-84095

Missing Authorization vulnerability in ash-project ash allows an actor to update records forbidden by resource policies through the atomic path of Ash.update many/4. Ash.update many/4 runs as a single atomic statement a data-layer update many, for example a SQL MERGE whenever an atomic strategy i...

EUVD-2026-69413

An issue in fast-note-sync-service =2.13.7 allows a remote attacker to escalate privileges via the admin configuration endpoint exposes authTokenKey...

PT-2026-84138

NULL pointer dereference vulnerability in Samsung Open Source mTower allows Pointer Manipulation. This issue affects mTower: before afef59aa6f55c5d5ebf9b14bc020bf1c2c37489a...

CVE-2026-52111

An issue in fast-note-sync-service =2.13.7 allows a remote attacker to escalate privileges via the admin configuration endpoint exposes authTokenKey...

PT-2026-84273

xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. From 0.9.0 until 0.9.12, the shared reg builder in lib/grammar.js compiles the anchored QName exact validator with the multiline flag, so ^ and $ validate only one line instead of the complete...

PT-2026-84418

Name of the Vulnerable Software and Affected Versions HPE Networking Fabric Composer affected versions not specified Description A sensitive information disclosure issue exists in the API of HPE Networking Fabric Composer. An authenticated user with low privilege operator permissions can access...

PT-2026-84251

xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.14 and 0.9.11, and in xmldom version 0.6.0 and earlier, Element.setAttribute calls the private createAttributename path without validating the attribute nam...

PT-2026-84272

xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, and in xmldom version 0.6.0 and earlier, the DOCUMENT TYPE NODE branch in lib/dom.js validates publicId, systemId, and internalSubset under...

PT-2026-84278

xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, and in xmldom versions 0.3.0 through 0.6.0, two independent quadratic paths can cause denial of service. In lib/sax.js, parseElementStartPart...

PT-2026-84518

Name of the Vulnerable Software and Affected Versions SonicWall SMA1000 Appliances affected versions not specified Description A pre-authentication Server-Side Request Forgery SSRF issue exists in the Work Place interface. This occurs due to an unintended alternate access path, allowing a remote...

RHCOS 4 : Red Hat build of MicroShift 4.21.31 (RHSA-2026:60668)

The remote Red Hat Enterprise Linux CoreOS 4 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:60668 advisory. - net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGSMAXFRAMESIZE frame CVE-2026-33814 No...

EUVD-2026-69415

An issue in kamailio v.6.1.1 and before allows a remote attacker to cause a denial of service via the IMS P-CSCF registration handling components...

PT-2026-84286

Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in TMT Machine Industry and Trade Ltd. Co. Talassoft Industrial Management Software allows SQL Injection. This issue affects Talassoft Industrial Management Software: from V.4 before V.16...

PT-2026-84211

A denial-of-service security issue exists within FactoryTalk® Historian Machine Edition. A network adjacent attacker who is authenticated could send crafted requests to the web interface, resulting in buffer overflow conditions that may cause the device to crash and become unresponsive...

PT-2026-84540

Name of the Vulnerable Software and Affected Versions AVideo versions prior to 30.0 Description An information disclosure issue exists in the MobileManager plugin. An unauthenticated visitor can send a GET request to the 'plugin/MobileManager/getConfiguration.json.php' endpoint to retrieve...

PT-2026-84395

Name of the Vulnerable Software and Affected Versions Elasticsearch affected versions not specified Description Inconsistent interpretation of HTTP requests, known as HTTP Request Smuggling, allows a network attacker to obtain confidential responses intended for other authenticated users. This...

PT-2026-84429

Name of the Vulnerable Software and Affected Versions HPE Networking Fabric Composer affected versions not specified Description A local privilege-escalation issue exists that allows a local attacker to execute arbitrary code with root privileges. This could result in a complete compromise of the...

PT-2026-84166

Name of the Vulnerable Software and Affected Versions ArmorStart® LT affected versions not specified Description A denial-of-service issue exists in the embedded web server due to improper handling of a specially crafted HTTP PUT request. This flaw can lead to a loss of web server availability...

PT-2026-84192

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 155 Firefox ESR versions prior to 153.2 Thunderbird versions prior to 155 Thunderbird versions prior to 153.2 Description A clickjacking issue exists within the DOM: Events component. Clickjacking is a technique where...