PT-2026-70661

Name of the Vulnerable Software and Affected Versions Visual Studio Code CoPilot Chat Extension affected versions not specified Description An unauthorized attacker can bypass a security feature over a network within the Visual Studio Code CoPilot Chat Extension. Recommendations At the moment,...

PT-2026-70544

Name of the Vulnerable Software and Affected Versions Windows LDAP affected versions not specified Description A use after free issue in the Lightweight Directory Access Protocol LDAP allows an unauthorized attacker to execute arbitrary code over a network, potentially affecting the system...

PT-2026-70396

Server-side request forgery ssrf in Microsoft PowerShell Core allows an unauthorized attacker to disclose information over a network...

PT-2026-70370

Improper neutralization of special elements used in a command 'command injection' in Visual Studio Code allows an unauthorized attacker to disclose information over a network...

PT-2026-70649

Improper neutralization of special elements used in a command 'command injection' in Microsoft Office allows an unauthorized attacker to execute code locally...

CVE-2025-32736

PingFederate Administrative Console is affected by a CSRF vulnerability affecting versions before 13.1. An attacker could trigger unauthorized actions via specially crafted links while an admin has an active session. Underlying issue is CSRF in the Administrative Console; exploitation is indicate...

CVE-2026-72910

CVE-2026-72910 affects ERPNext prior to versions 15.112.0 and 16.22.0. The issue arises because the functions merge_account, pause_job_for_doc, trigger_job_for_doc, change_release_date, and update_cost_center (across ERPNext code paths: erpnext/accounts/doctype/account/account.py, erpnext/account...

CVE-2026-72906

CVE-2026-72906 details (NORMAL): ERPNext (open-source ERP) contains a permission validation issue in the send_auto_email function within erpnext/accounts/doctype/process_statement_of_accounts/process_statement_of_accounts.py. The root cause is the absence of a Process Statement Of Accounts permis...

CVE-2026-14450

A flaw was found in the MaaS API. This vulnerability allows any pod within the cluster to bypass the Kuadrant AuthPolicy gateway by forging HTTP headers, specifically X-MaaS-Username and X-MaaS-Group, which are trusted verbatim. This lack of first-party authentication enables an attacker to gain...

GHSA-P9J2-GV94-2WF4

creationtimestamp| type| source ---|---|--- 2026-08-10 19:39:37+00:00| seen| https://gist.github.com/klemmanton-lgtm/8b54bdd2fe9905dc89b9c8ccf42f5fc4 2026-08-10 19:39:38+00:00| seen| https://gist.github.com/klemmanton-lgtm/4a24aedae8017b5aebed0300d07c7ee9 2026-08-17 10:21:36+00:00| seen|...

CVE-2026-72873 Dokploy: Cross-tenant Git provider secrets are disclosed to low-privileged service readers via `application.one`

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, application.one in apps/dokploy/server/api/routers/application.ts returns provider relations loaded by findApplicationById in packages/server/src/services/application.ts without redacting githubClientSecret,...

CVE-2026-72873

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, application.one in apps/dokploy/server/api/routers/application.ts returns provider relations loaded by findApplicationById in packages/server/src/services/application.ts without redacting githubClientSecret,...

CVE-2026-72866

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, the WebSocket handler in apps/dokploy/server/wss/terminal.ts validates a session but does not authorize access to the requested server. An authenticated user can connect to /terminal?serverId=local, select the special...

CVE-2026-72732

Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, the discoursetemplates endpoint exposed hidden tag names because DiscourseTemplates::TemplatesSerializer in plugins/discourse-templates/app/serializers/discoursetemplates/templatesserializer.rb d...

CVE-2026-72726

CVE-2026-72726 affects the Discourse open-source discussion platform. Before versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, an authenticated user could eavesdrop on private AI bot conversations through the AI bot reply stream. This is fixed in 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0. Rem...

CVE-2026-72719 Chatwoot: Cross-Account Resource Transfer via `account_id` Parameter

Chatwoot is a customer engagement suite. Prior to 4.9.0, Chatwoot allowed authenticated account administrators to transfer Portals, Automation Rules, Macros, and Twilio Channels to other accounts through the writable accountid parameter. This could break tenant isolation and cause cross-account...

CVE-2026-6373

Exposure of sensitive system information to an unauthorized control sphere vulnerability in Zyxel Networks WAH7601 allows Web Application Fingerprinting. This issue affects WAH7601: through 20072026...

CVE-2026-68300

In the Linux kernel, the following vulnerability has been resolved: sctp: auth: verify auth requirement when authchunk is NULL sctpauthchunkverify returns true unconditionally when chunk-authchunk is NULL, silently skipping authentication. This is incorrect when: 1. skbclone failed in the BH...

CVE-2026-19278

A flaw was found in StackRox/RHACS Central's Auth Machine-to-Machine M2M token exchange. When an administrator configures M2M role mappings, the system uses unanchored regular expressions for matching claim values. This allows an attacker with a valid OpenID Connect OIDC token, whose claim value ...

CVE-2026-12984 Exposure of Sensitive Information to an Unauthorized Actor in Zyxel's WAH7601

Insufficiently Protected Credentials vulnerability in Zyxel Networks WAH7601 allows Retrieve Embedded Sensitive Data. This issue affects WAH7601: through 20072026...