CVE-2026-38725

The xipblog module (v2.0.1 and before) for PrestaShop contains a Stored Cross-Site Scripting (XSS) vulnerability. Unauthenticated remote attackers can inject arbitrary JavaScript via the name and content parameters in ajax.php. The input is stored in the database without HTML sanitization and ren...

PT-2026-83091

Budibase before 3.41.3 fails to enforce per-table role restrictions on the POST /api/datasources/query endpoint, allowing low-privilege BASIC users to read, create, update, or delete rows in any table regardless of configured permissions. Attackers with BASIC role can submit crafted query request...

PT-2026-83052

This update for dovecot24 fixes the following issues: Update to 2.4.5. - CVE-2026-33263: submission-login: panic when mail max userip connections is reached bsc1276794. - CVE-2026-27852: DoS by sending mail with bad header bsc1276799. - CVE-2026-33604: SMTP smuggling via missing dot-stuffing afte...

PT-2026-83174

Cross-Site Scripting XSS vulnerability in the DNS lookup/management component of oPanel before v1.20.25 allows remote attackers to execute arbitrary JavaScript and perform session hijacking via a crafted DNS TXT record...

PT-2026-83357

multer is a middleware for handling multipart/form-data in Node.js. When an application uses an asynchronous fileFilter together with the fileSize limit, a race condition in multer's file stream handling can allow a file that exceeds the configured size limit to bypass the size-limit rejection. A...

PT-2026-83374

Name of the Vulnerable Software and Affected Versions MariaDB Connector/J versions prior to 2.7.14 MariaDB Connector/J versions prior to 3.3.5 MariaDB Connector/J versions prior to 3.4.3 MariaDB Connector/J versions prior to 3.5.9 Description The connector encodes and decodes protocol text and...

PT-2026-83368

Name of the Vulnerable Software and Affected Versions Silverstripe Versioned versions prior to 3.2.1 Description In the RestoreAction::getRestoreMessage function within src/RestoreAction.php, restore notifications in ArchiveAdmin are rendered as CAST HTML. The system fails to apply Convert::raw2x...

CVE-2026-33604

An attacker that can get Dovecot to relay a message, for example through Sieve redirect or submission relay, can use a crafted line ending in the message body to bypass the outbound protection that prevents message content from being interpreted as SMTP commands. A downstream mail server that...

PT-2026-83375

Name of the Vulnerable Software and Affected Versions MariaDB Connector/R2DBC versions prior to 1.4.1 Description The driver encodes and decodes all character data assuming the connection character set is UTF-8. A server can announce a mid-session change to the character set client variable throu...

PT-2026-83232

Name of the Vulnerable Software and Affected Versions Vikunja versions 0.24.6 through 2.3.x Description An authenticated user can destroy Kanban bucket assignments and task ordering of any project view across the entire instance. This occurs because the ProjectView.Delete function in...

PT-2026-83105

gitoxide Rust crates gix = 0.72.0 and gix-validate = 0.10.0 contains a path traversal vulnerability. The submodule name validation function in gix-validate only checks the first occurrence of '..' via name.findb"..", allowing crafted names such as 'a..b/../../../.git/' to bypass the check;...

PaperCut NG < 24.1.9.76516 / 25.x < 25.0.12.76510 / 26.x < 26.0.4.76508 Multiple Vulnerabilities

The version of PaperCut NG installed on the remote Windows host is prior to 24.1.9.76516 or 25.x prior to 25.0.12.76510, or 26.x prior to 26.0.4.76508. It is, therefore, affected by the following vulnerabilities: - An authentication bypass vulnerability exists in the web management interface due ...

openSUSE 16: ansible-rmt-server / rmt-server / rmt-server-config / etc (openSUSE-SU-2026:21640-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21640-1 advisory. Update to version 3.1 bsc1274715. Security issues fixed: - CVE-2026-26961: rack: greedy multipart boundary parsing can lead to parser...

FreeBSD : Gitlab -- Vulnerabilities (161b1c49-a29b-11f1-a883-2cf05da270f3)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 161b1c49-a29b-11f1-a883-2cf05da270f3 advisory. Gitlab reports: Inclusion of Functionality from Untrusted Control Sphere issue in Duo Claude A...

Microsoft Edge (Chromium) < 152.0.4191.53 Multiple Vulnerabilities

The version of Microsoft Edge installed on the remote Windows host is prior to 152.0.4191.53. It is, therefore, affected by multiple vulnerabilities as referenced in the August 28, 2026 advisory. - Information leak in Animation in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to...

PT-2026-83316

Name of the Vulnerable Software and Affected Versions JFrog Artifactory versions prior to 7.111.21 JFrog Artifactory versions prior to 7.117.28 JFrog Artifactory versions prior to 7.125.20 JFrog Artifactory versions prior to 7.133.29 JFrog Artifactory versions prior to 7.146.38 JFrog Artifactory...

Breaking Darknet CAPTCHAs with General Purpose LLM

Our work evaluates the effectiveness of automated methods for solving CAPTCHA challenges commonly encountered in darknet environments. These CAPTCHAs are typically designed to operate without JavaScript, resulting in distinct characteristics compared to mainstream CAPTCHA systems. Our study...

CVE-2026-38725

xipblog module v2.0.1 and before for PrestaShop allows unauthenticated remote attackers to inject arbitrary JavaScript via the name and content parameters in ajax.php. The input is stored in the database without HTML sanitization and rendered in Smarty templates without output escaping, resulting...

CVE-2026-38725

xipblog module v2.0.1 and before for PrestaShop allows unauthenticated remote attackers to inject arbitrary JavaScript via the name and content parameters in ajax.php. The input is stored in the database without HTML sanitization and rendered in Smarty templates without output escaping, resulting...

PT-2026-82880

The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to Stored Cross-Site Scripting via customer name fields in versions up to and including 2.2. This is due to an authentication bypass where the AddBookingCommand explicitly skips nonce verification...