PT-2026-98202

Name of the Vulnerable Software and Affected Versions Discourse versions prior to 2026.1.8 Discourse versions prior to 2026.6.3 Discourse versions prior to 2026.7.2 Discourse versions prior to 2026.8.0 Description The topic small-action and nested-activity-log components interpolate the free-form...

PT-2026-98250

Name of the Vulnerable Software and Affected Versions ruoyi-vue-pro versions prior to 2026.09 Description A cross site scripting issue exists in the File Upload component within the file yudao-module-infra/src/main/java/cn/iocoder/yudao/module/infra/controller/admin/file/FileController.java. This...

PT-2026-97683

Name of the Vulnerable Software and Affected Versions Forma LMS versions prior to 4.1.44 Description A SQL injection issue exists in the Multi-User-Selector AJAX Endpoint. This occurs when the Name argument is manipulated within the UserselectorAdmController::getDataTask function, located in the...

PT-2026-97780

Name of the Vulnerable Software and Affected Versions O2OA versions prior to 9.5.4 O2OA versions prior to 10.0.3 Description An issue exists in the Cipher Connection Handler component within the list function of the o2server/x base core...

PT-2026-97778

Name of the Vulnerable Software and Affected Versions ManageEngine EventLog Analyzer versions prior to build 13071 Log360 versions prior to build 13071 Description A Denial of Service DoS issue exists where an attacker can crash the log collector by sending malformed syslog packets. A DoS is an...

PT-2026-97694

Name of the Vulnerable Software and Affected Versions MantisZip versions prior to 0.4.6 Description A path traversal flaw exists in the Preview component within the MainWindow.UI.cs file. The issue occurs in the Path.Combine function, allowing a remote attacker to manipulate file paths to access...

PT-2026-98047

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An unauthenticated RDMA client can trigger an integer underflow in the RTRS RDMA Transparent RPC Service component. The issue occurs in the process read and process write functions, wher...

PT-2026-98093

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the iwlwifi component of the Linux kernel related to Multi-Link Device MLD handling. A kernel panic can occur during a reconfiguration failure when a firmware error...

PT-2026-98097

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the acrn virtual machine component. A race condition can occur between the acrn irqfd deassign function and the eventfd EPOLLHUP wakeup, leading to the...

PT-2026-98112

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the drm/amdgpu component where the GPIO I2C table entry count from the VBIOS is not properly bounded. This can lead to an overrun of the adev-i2c bus array or cause th...

PT-2026-98234

A flaw has been found in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.08. The affected element is the function AiKnowledgeDocumentServiceImpl.readUrl of the file AiKnowledgeDocumentServiceImpl.java of the component AI Knowledge Module. This manipulation of the argument url causes server-side...

PT-2026-98117

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the drm/amdgpu/userq component where mqd and fw objects, which are essential queue core objects, could be unmapped and evicted. If these buffers are evicted, the...

PT-2026-98132

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use after free issue exists in the wave5 media component. A null pointer dereference occurs if an IRQ thread obtains a spinlock between the release of m2m ctx and the removal of the...

CVE-2026-97366: Improper Neutralization of Special Elements used in an OS Command

A security flaw has been discovered in jhen0409 react-native-debugger up to 0.14.0. The impacted element is the function openDevTools of the file electron/window.js of the component Open in Editor Handler. The manipulation of the argument host results in os command injection. It is possible to...

CVE-2026-97326: Server-Side Request Forgery (SSRF)

A weakness has been identified in songxinjianqwe Chat up to ac63d25297079eed5e4ba7e88d3b7a032637150d. Affected by this issue is some unknown functionality of the file chat-server/src/main/java/cn/sinjinsong/chat/server/ChatServer.java of the component chat-server. This manipulation causes...

CVE-2026-97320: Server-Side Request Forgery (SSRF)

A flaw has been found in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.08. The affected element is the function AiKnowledgeDocumentServiceImpl.readUrl of the file AiKnowledgeDocumentServiceImpl.java of the component AI Knowledge Module. This manipulation of the argument url causes server-side...

CVE-2026-97322: Improper Neutralization of Input During Web Page Generation

A vulnerability was found in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.08. This affects an unknown function of the file yudao-module-infra/src/main/java/cn/iocoder/yudao/module/infra/controller/admin/file/FileController.java of the component File Upload. Performing a manipulation results in...

CVE-2026-97233: Improper Neutralization of Input During Web Page Generation

A vulnerability was identified in volotat Anagnorisis up to 0.4.11. Affected by this issue is the function html of the file PlaylistManager.js of the component Media Filename Handler. Such manipulation of the argument filepath leads to cross site scripting. The attack can be launched remotely. Th...

CVE-2026-91119: Improper Neutralization of Input During Web Page Generation

Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, the topic small-action and nested-activity-log components interpolated the free-form actioncodewho value into mention-link href attributes without URL encoding. A quote-bearing display name could...

CVE-2026-97231: Missing Authentication for Critical Function

A vulnerability was found in volotat Anagnorisis up to 0.3.1/0.4.0. Affected is an unknown function of the file app.py of the component Socket.IO Connect Interface. The manipulation results in missing authentication. It is possible to launch the attack remotely. The exploit has been made public a...