212496 matches found
PT-2025-19: Stack-based buffer overflow in Broadcom P225p NetXtreme-E Dual-port 10Gb/25Gb Ethernet PCIe Adapter, Broadcom NetXtreme-E family
The vulnerability was identified in Broadcom P225p NetXtreme-E Dual-port 10Gb/25Gb Ethernet PCIe Adapter, Broadcom NetXtreme-E family , versions 231.1.162.1 package version, 1.10.3 hwrm spec. The discovered vulnerability is related to stack-based buffer overflow. This leads to arbitrary code...
PT-2025-18: Denial of Service (DoS) in Broadcom P225p NetXtreme-E Dual-port 10Gb/25Gb Ethernet PCIe Adapter, Broadcom NetXtreme-E family
The vulnerability was identified in Broadcom P225p NetXtreme-E Dual-port 10Gb/25Gb Ethernet PCIe Adapter, Broadcom NetXtreme-E family , versions 231.1.162.1 package version, 1.10.3 hwrm spec. The discovered vulnerability is related to stack-based buffer overflow in the ChiMP core, which leads to...
PT-2025-17: Unrestricted memory access to internal memory of networking adapter in Broadcom P225p NetXtreme-E Dual-port 10Gb/25Gb Ethernet PCIe Adapter, Broadcom NetXtreme-E family
The vulnerability was identified in Broadcom P225p NetXtreme-E Dual-port 10Gb/25Gb Ethernet PCIe Adapter, Broadcom NetXtreme-E family, versions 231.1.162.1 package version, 1.10.3 hwrm spec. The discovered vulnerability is related to improper access control to the network adapter memory read/writ...
PT-2021-02: Encryption bypass when downloading a firmware update in Diebold-Nixdorf RM3/CRS
With access to the dispenser controller USB port, an attacker can install an outdated or modified firmware version with malicious content to bypass the encryption and withdraw cash. Advisory status: 07.2018 - Vendor notification date Credits: The vulnerability was discovered by Vladimir Kononovic...
PT-2021-01: Encryption bypass when downloading a firmware update in Diebold-Nixdorf CMDv5
With access to the dispenser controller USB port, an attacker can install an outdated or modified firmware version with malicious content to bypass the encryption and withdraw cash. Advisory status: 07.2018 - Vendor notification date Credits: The vulnerability was discovered by Vladimir Kononovic...
PT-2017-12727
Name of the Vulnerable Software and Affected Versions Numpy versions 1.13.1 and earlier Description The issue is related to missing input validation in the numpy.pad function. This can cause an infinite loop when an empty list or ndarray is used, potentially allowing attackers to conduct a Denial...
PT-2025-21: Local Privilege Escalation in Microsoft OneDrive
The vulnerability was identified in OneDrive, version 25.020.0202. The vulnerability in Microsoft OneDrive was discovered on MacOS. Local privilege escalation allows an attacker to escalate privileges from a normal user to root. To exploit the vulnerability a potential attacker must be able to...
PT-2026-84529
Name of the Vulnerable Software and Affected Versions Proxmox Virtual Environment VE versions 7.0 through 8.0 Description An authentication bypass exists in libpve-access-control that allows unauthenticated attackers to authenticate as any enabled user who does not have a second factor configured...
PT-2026-52966
Name of the Vulnerable Software and Affected Versions RustFS versions prior to 1.0.0-beta.8 Description RustFS is a distributed object storage system built in Rust. The real-time metrics endpoint '/rustfs/admin/v3/metrics' is accessible to any valid IAM user, regardless of their assigned policy...
PT-2026-1938
Name of the Vulnerable Software and Affected Versions Trend Micro Apex Central affected versions not specified Description A message out-of-bounds read issue exists in Trend Micro Apex Central. This could allow a remote attacker to create a denial-of-service condition on affected systems...
PT-2026-22987
Name of the Vulnerable Software and Affected Versions Wagtail versions prior to 6.3.8 Wagtail versions prior to 7.0.6 Wagtail versions prior to 7.2.3 Wagtail versions prior to 7.3.1 Description Wagtail, an open source content management system built on Django, contains a stored cross-site scripti...
PT-2025-51726
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A flaw exists in the Linux kernel’s drm/msm subsystem related to the handling of last fence. The issue occurs because last fence is not consistently updated, specifically in vm-bind...
PT-2025-2626 · Microsoft +1 · Microsoft-Httpapi +1
The vulnerable software is HCL MyXalytics. It is affected by a sensitive information disclosure vulnerability, where the HTTP response header exposes the server's name and version as Microsoft-HTTP API/2.0. This vulnerability is identified as CVE-2024-42179. The vulnerability allows attackers to...
PT-2026-77438
Name of the Vulnerable Software and Affected Versions Oracle PeopleSoft PeopleSoft Enterprise PeopleTools versions 8.61 through 8.63 Description A flaw in the nVision component allows an unauthenticated attacker with network access via HTTP to compromise the system. Exploitation requires human...
PT-2023-19286 · Unknown · Jamie Poitra M Chart Plugin
Name of the Vulnerable Software and Affected Versions: Jamie Poitra M Chart plugin versions 1.9.4 and earlier Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability. This vulnerability can be exploited by contributors or users with higher authentication levels. There...
PT-2024-13652 · Zoho · Zoho Manageengine Adaudit Plus
Name of the Vulnerable Software and Affected Versions: Zoho ManageEngine ADAudit Plus versions through 7250 Description: The issue is related to SQL Injection in the report export option. Recommendations: For Zoho ManageEngine ADAudit Plus versions through 7250, update to a version later than 725...
PT-2026-84669
Craft CMS versions before 5.10.11 contain a site scope bypass vulnerability in GraphQL entry mutation resolvers that fail to validate siteId through ArgumentManager::prepareArguments. Attackers with tokens scoped to one site can read, modify, or delete entries across unauthorized sites by passing...
PT-2026-29871
Open edX Platform enables the authoring and delivery of online learning at any scale. From the maple release to before the ulmo release, an unauthenticated attacker can fully bypass the email verification process by combining two issues: the OAuth2 password grant issuing tokens to inactive users...
PT-2022-25237 · Microsoft +1 · Wmi +1
Name of the Vulnerable Software and Affected Versions: Lenovo affected versions not specified Description: The issue is related to an information leak vulnerability in the SMI Handler, which is used to configure platform settings over WMI in some Lenovo models. This vulnerability may allow an...
PT-2026-86768
Affected versions of MISP expose organisation metadata through the dashboard organisation picker without applying the same visibility restrictions enforced by the normal organisation index and per-organisation view. The affected endpoint returned fields including: organisation ID; UUID; name. Whe...
PT-2026-34027
FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.214, the undo-send route GET /conversation/undo-reply/thread id checks only whether the current user can view the parent conversation. It does not verify that the current user created the reply being undone. In a...
PT-2026-88586
Clickjacking in TrustedWebActivities in Google Chrome on on Android prior to 153.0.8010.36 allowed a local attacker to spoof address bar via a co-installed app. Chromium security severity: Medium...
PT-2026-78094
Name of the Vulnerable Software and Affected Versions Oracle Business Intelligence Enterprise Edition Analytics Server version 8.2.0.0.0 Oracle Business Intelligence Enterprise Edition Analytics Server version 26.01.0.0.0 Description An unauthenticated attacker with network access via HTTP can...
PT-2023-3517
Name of the Vulnerable Software and Affected Versions: Redis versions prior to 6.0.19 Redis versions prior to 6.2.12 Redis versions prior to 7.0.11 Description: The issue is related to insufficient input validation in the Redis database management system. Exploitation of this issue can allow a...
PT-2026-73326
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: ImageIO. Supported versions that are affected are Oracle Java SE: 8u491, 8u491-perf, 11.0.31, 17.0.19, 21.0.11, 25.0.3, 26.0.1; Oracle GraalVM for JDK: 17.0.19 and...
PT-2025-18011 · Nortikin · Sverchok
Name of the Vulnerable Software and Affected Versions: nortikin Sverchok version 1.3.0 Description: A problematic issue was found in the function SvSetPropNodeMK2 of the file sverchok/nodes/object nodes/getsetprop mk2.py of the component Set Property Mk2 Node. This issue leads to improperly...
PT-2025-4434 · Unknown · Social Media Share Buttons | Mashshare
Name of the Vulnerable Software and Affected Versions: Social Media Share Buttons | MashShare versions n/a through 4.0.47 Description: The issue is related to a Missing Authorization vulnerability in Social Media Share Buttons | MashShare. This vulnerability affects the authorization process,...
PT-2026-71506
Unauthenticated SQL Injection in WP Directory Kit = 1.5.4 versions...
PT-2026-87038
SiYuan before 3.8.2 trusts the attacker-writable text/siyuan clipboard MIME type and skips sanitization in the paste handler, allowing code execution in the Node-enabled desktop renderer. Attackers can craft malicious web pages that write to the clipboard, and when pasted into SiYuan, injected...
PT-2026-85677
An information disclosure vulnerability in the opcua-configuration method of /cgi-bin/wwwugw.cgi in MBS-Solutions X-Serie Gateway firmware V6 00 05 allows any remote authenticated user, including users with the low-privileged Standard role, to retrieve the configured OPC-UA authentication...
PT-2026-69326
Name of the Vulnerable Software and Affected Versions Almico Speedfan version 4.52 Description A weakness in the MSR Index Handler component allows a local attacker to cause a memory leak. This issue occurs within the KiSystemCall64 function located in the speedfan.sys library. Recommendations At...
PT-2025-53609
Name of the Vulnerable Software and Affected Versions FreshRSS versions prior to 1.28.0 Description FreshRSS utilizes weak random number generators mt rand and uniqid for creating remember-me authentication tokens and challenge-response nonces. This allows attackers to predict valid session token...
PT-2025-27382 · Unknown · Sourcecodester Simple Company Website
Name of the Vulnerable Software and Affected Versions: SourceCodester Simple Company Website version 1.0 Description: A critical issue has been discovered, affecting an unknown part of the file /classes/Login.php. The manipulation of the Username argument leads to SQL injection. This issue can be...
PT-2024-26352 · Unknown · Hidden Depth Sticky Banner
Name of the Vulnerable Software and Affected Versions: Hidden Depth Sticky banner versions 1.2.0 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Stored XSS. This means that an attacker can...
PT-2019-4207 · Linux +2 · Linux Kernel +2
Name of the Vulnerable Software and Affected Versions: Linux kernel versions through 5.3.11 Description: A memory leak in the spi gpio probe function in drivers/spi/spi-gpio.c allows attackers to cause a denial of service by triggering devm add action or reset failures. This issue is disputed by...
PT-2019-3103 · Linux +2 · Linux Kernel +2
Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 5.2.8 Description: The issue is related to a NULL pointer dereference in the sound/usb/helper.c motu microbookii driver of the Linux kernel. This can be caused by a malicious USB device. Exploitation of this iss...
PT-2026-72750
In the Linux kernel, the following vulnerability has been resolved: bpf: Cancel special fields on map value recycle Map update and delete paths currently call bpf obj free fields when a value is being replaced or recycled. That makes field destruction depend on the context of the update/delete...
PT-2026-87481
Heap-based buffer overflow in Windows Remote Access Connection Manager allows an authorized attacker to elevate privileges locally...
PT-2023-26903 · Forescout · Forescout Secureconnector
Name of the Vulnerable Software and Affected Versions: ForeScout NAC SecureConnector version 11.2 Description: The issue is related to an uncontrolled search path element, which is a type of security weakness. This weakness can potentially be exploited, although specific details about real-world...
PT-2023-26227 · Unknown · Chengdu Flash Flood Disaster Monitoring/Warning System
Name of the Vulnerable Software and Affected Versions: Chengdu Flash Flood Disaster Monitoring and Warning System version 2.0 Description: A critical issue has been discovered, affecting the /App Resource/UEditor/server/upload.aspx file, where the manipulation of the file argument leads to...
PT-2023-16885 · Cockpit Hq · Cockpit
Name of the Vulnerable Software and Affected Versions: cockpit-hq/cockpit versions prior to 2.4.1 Description: The issue concerns an unrestricted upload of files with dangerous types. There is no information provided about the estimated number of potentially affected devices worldwide or details...
PT-2026-48345
This update for govulncheck-vulndb fixes the following issues: - Update to version 0.0.20260723T184607 2026-07-23T18:46:07Z jscPED-11136. Go CVE Numbering Authority IDs added or updated with aliases: GO-2026-4730 CVE-2026-33022 GHSA-cv4x-93xx-wgfj GO-2026-4761 CVE-2026-33211 GHSA-j5q5-j9gm-2w5c...
PT-2025-27187 · Unknown · Antoineh Football Pool
Name of the Vulnerable Software and Affected Versions: AntoineH Football Pool versions n/a through 2.12.5 Description: The issue is related to improper neutralization of input during web page generation, which allows for Stored Cross-site Scripting XSS. This means that an attacker can inject...
PT-2026-58940
Summary Kimai 2.56.0 contains an authenticated improper authorization vulnerability in the preset-project activity creation flow. A user with the generic create activity permission, but without access to a target project, can still create a new Activity under that unauthorized project by visiting...
PT-2026-65107
Name of the Vulnerable Software and Affected Versions JFrog Artifactory affected versions not specified Description A deserialization weakness exists in the way JFrog Artifactory handles packages. This flaw could allow a low-privileged user to compromise confidentiality, integrity, and availabili...
PT-2026-88190
These are all security issues fixed in the distribution-registry-3.1.1-6.1 package on the GA media of openSUSE Tumbleweed...
PT-2026-59309
In mlflow/mlflow versions up to 3.9.0, the SearchModelVersions REST API endpoint and the mlflowSearchModelVersions GraphQL query lack proper per-model authorization checks when basic authentication is enabled. This allows any authenticated user to enumerate all model versions across all registere...
PT-2023-26996 · Unknown · Prestashop
Name of the Vulnerable Software and Affected Versions: PrestaShop versions prior to 8.1.1 Description: The issue allows files to be compromised using path traversal by replaying the import file deletion query with a specified file path that uses the traversal path in the back office. There are no...
PT-2026-87138
The vtoken-minting and slpx pallets in Bifrost contain an improper authorization vulnerability in channel commission attribution. A signed account can supply an arbitrary registered channel id when minting tokens without verifying that the caller is authorized to mint on behalf of that channel...
PT-2026-55265
Craft CMS is a content management system CMS. Versions 5.7.0 and above, prior to 5.9.21 contain a mass-assignment flaw in the bulk-duplicate element action. An attacker who is only able to duplicate their own entires can submit an arbitrary id through the newAttributes request parameter. The...