Linux Distros Unpatched Vulnerability : CVE-2026-98477

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - perf/core: Fix NULL pmuctx passed to pmu-schedtask perfpmuschedtask returns early when cpuctx-taskctx is set, and cpc-taskepc is only non-NULL while a task...

PT-2026-118649

Name of the Vulnerable Software and Affected Versions @fastify/middie versions 9.0.0 through 9.3.5 Description The use function joins a path-scoped middleware mount path to the plugin scope prefix in a manner that may diverge from the path served by the Fastify router. This occurs primarily when...

PT-2026-118598

A vulnerability was found in EspoCRM up to 9.3.10/10.0.10. This affects the function ImageSourceProvider::get of the file application/Espo/Tools/Pdf/Dompdf/ImageSourceProvider.php of the component PDF Rendering Pipeline. Performing a manipulation of the argument ID results in authorization bypass...

PT-2026-118419

Name of the Vulnerable Software and Affected Versions A2A Java SDK versions prior to 1.3.0.Final Description The default InMemoryTaskStore configuration does not perform authorization on task reads. The no-argument constructor sets the authorizationProvider to null, and the getString taskId...

PT-2026-118465

Stirling-PDF from 2.13.2 through 3.2.0 contains an incomplete denylist in DatabaseService.validateSqlContent that allows administrators to bypass H2 import restrictions using CREATE OR REPLACE ALIAS. Authenticated administrators can upload a crafted SQL backup to the import-database endpoint, whe...

PT-2026-118467

Configurable Reports block for Moodle before 5.3.0 contains an authorization bypass vulnerability that allows authenticated users to read restricted reports through the block configurable reports get report data web service. When check permissions fails, the function only adds a warning and still...

PT-2026-118581

Name of the Vulnerable Software and Affected Versions @apostrophecms/db-connect versions 1.0.0 through 1.0.2 ApostropheCMS versions prior to 4.33.0 Description A low-privileged authenticated user with view-draft access can trigger a persistent process-wide denial of service in environments using...

PT-2026-118512

Name of the Vulnerable Software and Affected Versions ApostropheCMS import-export module versions prior to 3.7.0 Description An authenticated user with import privileges can cause a denial of service by uploading a specially crafted tar archive. The issue exists because the system uses a literal...

PT-2026-118345

A vulnerability has been found in LeeDrOiD Labs Shortcutter 2 App 9.0.48 on Android. This issue affects the function Class.forName of the file ToggleGeneric.java. The manipulation of the argument Class leads to improper export of android application components. Local access is required to approac...

PT-2026-118353

A security flaw has been discovered in opensource-socialnetwork up to 9.11/10.1. This affects the function input of the file actions/administrator/cache/dynamic.php of the component Cache Settings. Performing a manipulation of the argument host/port/username/password/type/status results in code...

PT-2026-118356

A vulnerability was detected in DrayTek Vigor2960 1.5.1.6 Revision 8218. Affected by this vulnerability is the function set table of the file /cgi-bin/mainfunction.cgi of the component CGI Process. The manipulation of the argument sectiontype results in command injection. The attack may be launch...

PT-2026-118357

A flaw has been found in DrayTek Vigor2960 1.5.1.6 Revision 8218. Affected by this issue is the function sub 182B0 of the file /cgi-bin/mainfunction.cgi of the component CGI Interface. This manipulation of the argument usefile/usescript/option causes os command injection. Remote exploitation of t...

PT-2026-118323

A security vulnerability has been detected in arizu-id fast-tunnel 1.0.0. Affected by this issue is the function ZipArchive::extractTo of the file backend/api plugins.php of the component Plugin Installer. Such manipulation of the argument plugin file leads to unrestricted upload. The attack may ...

PT-2026-118500

Name of the Vulnerable Software and Affected Versions ApostropheCMS versions prior to 4.33.0 Description An authenticated editor with legitimate edit rights on a page nested under a restricted parent can manipulate the sibling ordering of other pages under that same parent. This occurs because th...

PT-2026-118496

Name of the Vulnerable Software and Affected Versions uploadfs versions prior to 1.28.0 Description The local storage backend of the uploadfs library fails to properly validate or sanitize user-supplied paths. The prefixPath function only removes double slashes and does not normalize paths or...

PT-2026-118406

A vulnerability was found in Nerimity Desktop up to 2.2.2. Affected by this issue is the function shell.openExternal of the file src/mainWindow.js of the component Window Open Handler. The manipulation of the argument url results in improper authorization in handler for custom url scheme. The...

PT-2026-118580

A vulnerability was found in aaPanel up to 8.25.0. The impacted element is the function GetClientIp of the file class/public/common.py. The manipulation of the argument X-Real-Ip results in improper access controls. The attack may be performed from remote. The exploit has been made public and cou...

PT-2026-118358

A vulnerability has been found in DrayTek Vigor2960 1.5.1.6 Revision 8218. This affects the function uploadlangs of the file /cgi-bin/mainfunction.cgi of the component Upload Endpoint. Such manipulation leads to command injection. The attack can be executed remotely. The exploit has been disclose...

CVE-2025-60496

The GPAC Project/MP4Box software (versions before 2.5 ) contains a Floating-Point Exception (FPE) in the reframer_send_packet function located at /filters/reframer.c. An attacker can exploit this vulnerability by providing a crafted MP4 file to cause a Denial of Service (DoS) . No specific exploi...

PT-2026-118389

Name of the Vulnerable Software and Affected Versions A2A Java SDK versions prior to 1.3.0.Final Description The parseRequestBody function in the RestHandler.java file logs the entire JSON request body at a SEVERE level when JsonFormat.parser.merge throws an InvalidProtocolBufferException. This...