PT-2026-1405

Name of the Vulnerable Software and Affected Versions iccDEV versions prior to 2.3.1.2 Description iccDEV is a set of libraries and tools for working with ICC color management profiles. Versions 2.3.1.1 and earlier contain Undefined Behavior UB and Out of Memory errors. Undefined Behavior refers ...

PT-2026-1475

Name of the Vulnerable Software and Affected Versions AffiliateX versions through 1.3.9.3 Description An authorization issue exists in AffiliateX, allowing exploitation due to incorrectly configured access control security levels. Recommendations Update AffiliateX to a version later than 1.3.9.3...

PT-2026-1413

Name of the Vulnerable Software and Affected Versions AS Password Field In Default Registration Form plugin for WordPress versions prior to 2.0.1 Description The plugin does not properly validate a user’s identity before allowing password updates. This allows unauthenticated attackers to change...

PT-2026-1406

Name of the Vulnerable Software and Affected Versions iccDEV versions prior to 2.3.1.1 Description iccDEV is a set of libraries and tools for working with ICC color management profiles. Versions 2.3.1 and below contain a Heap-based Buffer Overflow in the CIccMBB::Validate function, which is...

CVE-2026-21633

A malicious actor with access to the adjacent network could obtain unauthorized access to a UniFi Protect Camera by exploiting a discovery protocol vulnerability in the Unifi Protect Application Version 6.1.79 and earlier. Affected Products: UniFi Protect Application Version 6.1.79 and earlier...

CVE-2026-21634

A malicious actor with access to the adjacent network could overflow the UniFi Protect Application Version 6.1.79 and earlier discovery protocol causing it to restart. Affected Products: UniFi Protect Application Version 6.1.79 and earlier. Mitigation: Update your UniFi Protect Application to...

EUVD-2026-0819

Any client who can access to Apache Kyuubi Server via Kyuubi frontend protocols can bypass server-side config kyuubi.session.local.dir.allow.list and use local files which are not listed in the config. This issue affects Apache Kyuubi: from 1.6.0 through 1.10.2. Users are recommended to upgrade t...

PT-2026-1266

Name of the Vulnerable Software and Affected Versions Awethemes AweBooking versions through 3.2.26 Description A flaw exists in Awethemes AweBooking that allows for the retrieval of embedded sensitive data due to the insertion of sensitive information into sent data. Recommendations Update...

PT-2026-1341

Name of the Vulnerable Software and Affected Versions Dify versions prior to 1.11.0 Description Dify is an open-source LLM app development platform. Before version 1.11.0, the API key was exposed in plaintext to the frontend, allowing non-administrator users to view and reuse it. This could lead ...

PT-2026-1347

Name of the Vulnerable Software and Affected Versions Frappe versions 14.99.5 and below and 15.0.0 through 15.80.1 Description Frappe, a full-stack web application framework, contains a path traversal issue in certain requests. Insufficient input sanitization allows the potential retrieval of...

PT-2026-1295

Name of the Vulnerable Software and Affected Versions Tumult Hype Animations versions through 1.9.11 Description A flaw exists in Tumult Hype Animations that allows for DOM-Based Cross-site Scripting XSS. This issue is due to improper neutralization of input during web page generation. The...

PT-2026-3200

Impact The ERC7984 contract tracks total supply using a confidential euint64 value. If a call to the internal mint function would result in the total supply overflowing, the call fails silently. The wrap and onTransferReceived functions in ERC7984ERC20Wrapper assume that mint won't fail silently...

Security Bulletin: Rational Performance Tester contains a vulnerability which could lead to potential remote code execution

Summary Due to the use of the Apache Xalan Java XLST library, Rational Performance Tester contains a vulnerability that could lead to potential remote code execution. Vulnerability Details CVEID:CVE-2022-34169 DESCRIPTION: The Apache Xalan Java XSLT library could allow a remote attacker to execut...

PT-2026-1123

Name of the Vulnerable Software and Affected Versions Langflow versions prior to 1.7.0.dev45 Description Langflow, a tool for building and deploying AI-powered agents and workflows, has several critical API endpoints missing authentication controls. This allows any unauthenticated user to access...

Information Exposure

Overview Affected versions of this package are vulnerable to Information Exposure via the /api/v1/user endpoint returning different responses for failed authentication attempts depending on whether a username exists. An attacker can enumerate valid usernames by analyzing the variations in...

PT-2026-1018

Name of the Vulnerable Software and Affected Versions eopkg versions prior to 4.4.0 Description eopkg, a Solus package manager implemented in python3, contains a flaw where a malicious package could include files that are not tracked by eopkg. This requires installation of a package from a...

PT-2025-54439

Name of the Vulnerable Software and Affected Versions Zielke Design Project Gallery versions through 2.5.0 Description The software contains a flaw related to improper input handling during web page creation, specifically a Reflected Cross-site Scripting issue. This allows for the injection of...

PT-2025-54440

Name of the Vulnerable Software and Affected Versions Matamko En Masse versions through 1.0 Description The software contains a flaw related to improper input handling during web page generation, which allows for Reflected Cross-site Scripting XSS. This allows an attacker to inject malicious...

Integer Overflow or Wraparound

Overview Magick.NET-Q8-OpenMP-arm64 is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package...

PT-2025-54203

Name of the Vulnerable Software and Affected Versions RustFS versions prior to 1.0.0-alpha.77 Description RustFS, a distributed object storage system built in Rust, uses a hardcoded static token, "rustfs rpc", for gRPC authentication in versions prior to 1.0.0-alpha.77. This token is publicly...