PT-2026-59208

Summary In Kiwi TCMS the fields TestCase.extra link and TestPlan.extra link were meant to represent URLs to external resources however in versions prior to 16.1 user input was not being sanitized and values were rendered verbatim which represents an opportunity for cross-site scripting...

PT-2026-57851

Cross-site scripting vulnerability in phoenixframework phoenix live view allows an attacker to bypass URL scheme validation and execute JavaScript in a victim's browser session. The Phoenix.LiveView.Utils.valid destination!/2 and Phoenix.LiveView.Utils.valid live navigation destination!/2 functio...

PT-2026-59505

Symbolic-link path traversal CWE-61, CWE-22 in pgAdmin 4 File Manager. check access permission used os.path.abspath, which resolves '..' but does not resolve symbolic links, while the subsequent kernel write follows symlinks. An authenticated user could plant a symbolic link inside their own...

PT-2026-59301

Summary A ReDoS Regular Expression Denial of Service vulnerability in LINK TITLE RE allows an attacker who can supply Markdown for parsing to cause denial of service. A crafted 58-byte Markdown document blocks the parser for approximately 6 seconds measured on Apple M2, Python 3.14.3, with...

PT-2026-60069

Name of the Vulnerable Software and Affected Versions Decidim versions prior to 0.30.9 Decidim versions 0.31.0 through 0.31.4 Decidim version 0.32.0.rc1 Description An issue exists in the download your data flow where the resulting Active Storage blob redirect URL can be replayed without...

extract-zip Symbolic Link RCE

The vulnerability of the npm library extract-zip’s mechanism for handling symbolic links is related to errors in link processing. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code...

drivers/pinctrl/nomadik/pinctrl-nomadik.c Heap Buffer Overflow DoS

The vulnerability of the nmkpinctrldtsubnodetomap function in the drivers/pinctrl/nomadik/pinctrl-nomadik.c driver for Linux kernel-based GPIO controllers is related to errors during link counters updates. Exploiting this vulnerability could allow an attacker to cause a service failure...

D-link DIR-823G Router Privilege Escalation

The vulnerability of the /etc/boa/boa.conf file of the D-link DIR-823G router microprogramming software interface is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker to elevate their privileges to the root level...

PT-2026-59168

Summary The programmatic remote project scanning path rewrites attacker-controlled repository URLs using a blind string replacement and then sends the caller's GitHub credentials with the resulting request. This allows an attacker who can influence the scanned repository URL to trigger SSRF and...

PT-2026-59000

Summary A stored cross-site scripting XSS vulnerability exists in NukeViet CMS versions 4.x through 4.5.08. A low-privileged authenticated user can store a JavaScript payload in their profile's display name fields. The payload executes in the browser of any visitor — including administrators — wh...

PT-2026-60030

Stored XSS via Unescaped License Attribution Fields Summary The AbstractLicenseModel.attribution link property in wger/utils/models.py constructs HTML strings by directly interpolating user-controlled fields license author, license title, license object url, license author url, license derivative...

PT-2026-59013

A vulnerability was identified in modelscope agentscope up to 1.0.18. Affected by this issue is the function parse url/prepare image/openai audio to text of the file src/agentscope/tool/ multi modality/ openai tools.py of the component Cloud Metadata Endpoint. Such manipulation of the argument...

PT-2026-57663

Mattermost versions 11.7.x = 11.7.2, 11.6.x = 11.6.4 fail to verify whether a guest account is deactivated before creating a session in the magic-link token login path, which allows a deactivated guest user to obtain a fully functional session via a magic-link token issued prior to deactivation...

CVE-2026-9597: Authentication Bypass by Primary Weakness

Mattermost versions 11.7.x = 11.7.2, 11.6.x = 11.6.4 fail to verify whether a guest account is deactivated before creating a session in the magic-link token login path, which allows a deactivated guest user to obtain a fully functional session via a magic-link token issued prior to deactivation...

CVE-2026-52533

The D-Link DIR-1253 (version v.1.0.1.250923.142435 ) is affected by a vulnerability that allows an attacker to escalate privileges via the etc/shadow component file. The vulnerability has a CRITICAL CVSS v3.1 score of 9.8 , with high impact on confidentiality, integrity, and availability. While t...

PT-2026-60024

web2py versions 2.27.1-stable+timestamp.2023.11.16.08.03.57 and prior contain an Open Redirect vulnerability. If this vulnerability is exploited, the user may be redirected to an arbitrary website when accessing a specially crafted URL. As a result, the user may become a victim of a phishing atta...

GHSA-2FFJ-W4MJ-PG37

creationtimestamp| type| source ---|---|--- 2026-07-12 22:58:01+00:00| seen| https://gist.github.com/wyattgill9/990529c04d4b62e11a1f63fb789c30e4...

CVE-2020-6110

creationtimestamp| type| source ---|---|--- 2026-07-12 22:00:18+00:00| seen| https://t.me/pleyadesit/6631 2026-07-13 00:00:41+00:00| seen| https://t.me/pleyadesit/6631 2026-07-14 00:00:49+00:00| seen| https://t.me/pleyadesit/6631 2026-07-18 15:00:05+00:00| seen| https://t.me/reverseame/182...

CVE-2020-3961

creationtimestamp| type| source ---|---|--- 2026-07-12 22:00:18+00:00| seen| https://t.me/pleyadesit/6702 2026-07-13 00:00:41+00:00| seen| https://t.me/pleyadesit/6702 2026-07-14 00:00:49+00:00| seen| https://t.me/pleyadesit/6702...

CVE-2020-15896

creationtimestamp| type| source ---|---|--- 2026-07-12 22:00:17+00:00| seen| https://t.me/pleyadesit/7083 2026-07-13 00:00:41+00:00| seen| https://t.me/pleyadesit/7083 2026-07-14 00:00:50+00:00| seen| https://t.me/pleyadesit/7083...