PT-2026-56675

Name of the Vulnerable Software and Affected Versions DSpace versions prior to 7.6.7 DSpace versions 8.0 through 8.3 DSpace versions 9.0 through 9.2 Description When ingesting an aggregated ORE resource by URI using the OAI-ORE Harvester, the ORE Ingestion Crosswalk fails to validate the URI...

PT-2026-56337

Name of the Vulnerable Software and Affected Versions The product name cannot be determined. affected versions not specified Description A crash occurs when the application opens a PDF and JavaScript deletes a form field object, followed by an attempt to access that invalid object. Recommendation...

PT-2026-56349

When the application opens a PDF and JavaScript resets the form fields, the script re-enters the interface. The underlying native object is damaged, but the application does not perform validation. The function call on the damaged object leads to the application crashing...

PT-2026-56359

Name of the Vulnerable Software and Affected Versions Foxit PDF Editor/Reader affected versions not specified Description An issue occurs when the application opens a PDF file containing an abnormal Unity 3D object. During the parsing process, the application incorrectly resolves a portion of the...

PT-2026-56333

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description When opening a PDF file, JavaScript uses a damaged field tree to trigger field traversal. This causes the program to hold an invalid form object when accessing t...

IBM WebSphere eXtreme Scale code injection vulnerability

IBM WebSphere eXtreme Scale is an elastic data caching and object grid platform developed by American company IBM. IBM WebSphere eXtreme Scale has a code injection vulnerability. This vulnerability stems from the Object Query Language engine, which parses the names of classes provided by attacker...

PT-2026-56355

Name of the Vulnerable Software and Affected Versions Foxit Editor/Reader affected versions not specified Description When the application opens a PDF and executes JavaScript, it performs abnormal operations on the list box field, which are repeated after the form is reset. The application fails ...

PT-2026-56341

Name of the Vulnerable Software and Affected Versions Foxit PDF Editor/Reader affected versions not specified Description A use-after-free issue occurs when the application opens a PDF and JavaScript modifies the form. Due to incomplete lifecycle management and a lack of null value validation for...

PT-2026-56353

Name of the Vulnerable Software and Affected Versions Foxit PDF Editor/Reader affected versions not specified Description An issue exists where the application fails to perform proper type checking when parsing a PDF containing an abnormal annotation referenced by other objects. This type confusi...

IBM WebSphere eXtreme Scale server request forgeing vulnerability

IBM WebSphere eXtreme Scale is an elastic data caching and object grid platform developed by American company IBM. IBM WebSphere eXtreme Scale has a server-side request forgeing vulnerability. This vulnerability arises from the Java deserialization of approximately 50 CORBA stub classes in the...

PT-2026-56343

After JavaScript resetting the form, the synchronization process lacks re-entry protection and object lifecycle verification, resulting in the failure of the control pointer during the traversal process. After the pointer fails, it still continues to dereference, causing the application to crash...

PT-2026-56347

Name of the Vulnerable Software and Affected Versions Foxit PDF Editor/Reader affected versions not specified Description Insufficient object type and argument checks occur when the application opens a PDF file and JavaScript writes annotation attributes. This leads to damage in the internal...

PT-2026-56352

Name of the Vulnerable Software and Affected Versions Foxit PDF Editor/Reader affected versions not specified Description An abnormal image object causes the renderer to enter an incorrect processing branch. During the conversion of scan lines, the application uses an invalid image buffer pointer...

PT-2026-56601

Name of the Vulnerable Software and Affected Versions OpenCTI versions prior to 7.260326.0 Description An authorization bypass allows authenticated users with KNOWLEDGE KNUPDATE permission to circumvent Confidence Level validation and Object Marking restrictions. This is achieved by injecting the...

PT-2026-56401

The User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.3.1 via the payment page function due to missing validation on the 'user id' user...

GHSA-26RH-24RG-J3VV Goploy: Cross-namespace IDOR and RCE via body-supplied row id in project and project_file handlers

Summary Project.AddFile, Project.EditFile, Project.RemoveFile, and Project.Edit in cmd/server/api/project/handler.go accept a project or project-file row id from the JSON body and act on it without checking that the project belongs to the caller's namespace. The corresponding...

CVE-2026-55418

FastGPT is an open source AI knowledge base platform. Prior to v4.15.0-beta5, two FastGPT file handlers authorize an unrelated resource and then sign or read an S3 object using a key taken directly from the request, without checking that the key belongs to the caller's team. Because S3 object key...

CVE-2026-55418 FastGPT: S3 presign/read handlers do not bind the object key to the caller's team (cross-team file disclosure)

FastGPT is an open source AI knowledge base platform. Prior to v4.15.0-beta5, two FastGPT file handlers authorize an unrelated resource and then sign or read an S3 object using a key taken directly from the request, without checking that the key belongs to the caller's team. Because S3 object key...

kernel: drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs()

A flaw was found in the Linux kernel's Direct Rendering Manager DRM Graphics Execution Manager GEM component. This vulnerability arises from an inconsistent calculation of plane dimensions, which can lead to incorrect memory allocation checks. A local attacker could exploit this by creating a...

PYSEC-2026-1810 pyasn1 has a DoS vulnerability in decoder

Summary After reviewing pyasn1 v0.6.1 a Denial-of-Service issue has been found that leads to memory exhaustion from malformed RELATIVE-OID with excessive continuation octets. Details The integer issue can be found in the decoder as reloid += subId 7 + nextSubId,:...