PT-2026-132288

Heap-based buffer overflow in Microsoft Edge Chromium-based allows an unauthorized attacker to execute code over a network...

PT-2026-132855

Name of the Vulnerable Software and Affected Versions Veeam Management Pack for Microsoft System Center versions prior to 13.1.0.334 Description An unauthenticated attacker can perform remote code execution RCE on servers running the Veeam Virtualization Extensions service. This allows the attack...

PT-2026-132471

A buffer overflow vulnerability in the Brotli decoder c/dec/decode.c in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially...

CVE-2026-92744: Delinea Privilege Manager: Under certain conditions, privilege manager agent allows a remote unauthenticated attacker to execute arbitrary code as…

Under certain conditions, privilege manager agent allows a remote unauthenticated attacker to execute arbitrary code as LocalSystem...

CVE-2023-7357: Revera FlexNet Publisher: A remote code execution (RCE) vulnerability was identified in the FlexNet Publisher lmadmin web user interface

A remote code execution RCE vulnerability was identified in the FlexNet Publisher lmadmin web user interface. This vulnerability is addressed in the FlexNet Publisher 2023 R2 11.19.4.0 release...

PT-2026-132857

Name of the Vulnerable Software and Affected Versions Veeam Management Pack for Microsoft System Center versions 9.1 and earlier version 9 builds Description A member of the Veeam Virtualization Extensions Users group can perform remote code execution on servers running the Veeam Management Pack...

PT-2026-132856

Name of the Vulnerable Software and Affected Versions Veeam Management Pack for Microsoft System Center versions 9.1 and earlier version 9 builds Description An authenticated Windows domain user can perform remote code execution as the LocalSystem account on servers running the Veeam Management...

PT-2026-132212

IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote attacker who could reach the message broker to execute arbitrary code on the system due to the deserialization of untrusted data...

CVE-2026-18894: IBM Langflow OSS: IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote attacker to trigger pre-existing stored Python component…

IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote attacker to trigger pre-existing stored Python component code in a public workflow, executing it under the flow owner's runtime context within the server process. This bypasses the intended trust boundary where public execution paths are...

CVE-2026-107327: IBM Langflow OSS: IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to execute arbitrary code due to…

IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to execute arbitrary code due to missing authorization...

CVE-2026-104339: IBM Langflow OSS: IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote attacker to execute arbitrary code due to improper…

IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command...

PT-2026-133295

Name of the Vulnerable Software and Affected Versions Gravity Forms versions prior to 3.1.3 Description An unauthenticated attacker can perform PHP Object Injection via a Post Custom Field with a List input type. The issue occurs because the GFFormsModel::create post function passes submitted...

Progress Software WS_FTP Server path traversal vulnerability

Security vulnerabilities exist in Progress Software WSFTP Server versions prior to 2024.0.7 and prior to 2025.0.4. These vulnerabilities stem from path traversal and may allow a compromised Host Administrator to access locations outside their authorized scope and execute remote code...

CVE-2026-107238: Veeam Management Pack for Microsoft System Center: A vulnerability allowing an authenticated domain user to perform remote code execution (RCE) as the LocalSystem account…

A vulnerability allowing an authenticated domain user to perform remote code execution RCE as the LocalSystem account on servers running the Veeam Management Pack for Microsoft System Center Collector service...

PT-2026-130634

The Frontend Dashboard WordPress plugin before 3.0.5, ProfileGrid WordPress plugin before 6.0.0.5 do not prevent an unauthenticated user from storing a serialized PHP object in user metadata that is deserialized when a public profile is viewed, allowing PHP object injection that can lead to...

CVE-2026-103693: Unknown: The Frontend Dashboard WordPress plugin before 3.0.5, ProfileGrid WordPress plugin before 6.0.0.5 do not prevent an…

The Frontend Dashboard WordPress plugin before 3.0.5, ProfileGrid WordPress plugin before 6.0.0.5 do not prevent an unauthenticated user from storing a serialized PHP object in user metadata that is deserialized when a public profile is viewed, allowing PHP object injection that can lead to...

Revera FlexNet Publisher software supply chain issue vulnerability

The Revera FlexNet Publisher has a vulnerability related to the software supply chain. This vulnerability stems from a remote code execution flaw in the lmadmin web user interface, which may allow arbitrary code execution...

CVE-2026-119145: frappe: Frappe before 15.121.0 and 16.x before 16.34.0 contains a path traversal vulnerability because certain file-upload…

Frappe before 15.121.0 and 16.x before 16.34.0 contains a path traversal vulnerability because certain file-upload handling does not validate the destination path before writing to disk. Authenticated attackers can upload crafted files to locations outside the intended storage directory to achiev...

PT-2026-132334

A path traversal vulnerability in Progress Software WS FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow a delegated Host Administrator to access locations outside their authorized scope, potentially enabling remote code execution...

AjaxLoadMore Cache code injection vulnerability

AjaxLoadMore Cache versions 3.1.1 and earlier contain a code injection vulnerability. This vulnerability stems from code injection and may allow unauthenticated attackers to execute arbitrary code remotely...