212496 matches found
PT-2026-50048
Vulnerability in the Oracle Advanced Outbound Telephony product of Oracle E-Business Suite component: Internal Operations. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle...
PT-2026-50078
Name of the Vulnerable Software and Affected Versions LangGraph Python SDK versions prior to 0.3.15 Description Unsafe URL path construction occurs due to unsanitized caller-supplied identifier values used in HTTP request paths for resource operations. Identifiers containing characters with speci...
PT-2026-47060
MoviePilot contains a path traversal vulnerability in the AliPan, U115, and Rclone cloud storage download handlers where the local destination path is constructed by concatenating the configured download directory with a filename taken directly from remote cloud API metadata without basename...
PT-2026-36152
A stored cross-site scripting XSS vulnerability in the /api/blade-desk/notice/submit endpoint of SpringBlade v4.8.0 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted input into the content parameter...
PT-2026-83745
Name of the Vulnerable Software and Affected Versions @pdfme/schemas versions prior to 5.5.9 Description The SVG schema plugin renders user-supplied SVG content directly to innerHTML without proper sanitization. This occurs in the ui renderer within the packages/schemas/src/graphics/svg.ts file...
PT-2025-48222
The Soundslides plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the soundslides shortcode in all versions up to, and including, 1.4.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers,...
PT-2025-48213
A weakness in Automated Logic and Carrier i-Vu Gen5 router on driver version drv gen5 106-01-2380, allows malformed packets to be sent through BACnet MS/TP network causing the devices to enter a fault state. This fault state requires a manual power cycle to return the device to network visibility...
PT-2025-38180
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A flaw exists in the Linux kernel's i2c designware driver related to the handling of device interrupts. A regression was introduced by commit c7b79a752871, causing system crashes NULL...
PT-2025-18638 · Linux +1 · Linux Kernel +1
Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: A use after free issue has been resolved in the Linux kernel's networking scheduler. The problem occurs because the skb cannot be used again after it is passed to qdisc enqueue. This f...
PT-2025-14163 · Beastthemes · Beastthemes Clockinator Lite
Name of the Vulnerable Software and Affected Versions: BeastThemes Clockinator Lite versions 1.0.0 through 1.0.7 Description: The issue is related to a Missing Authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. Recommendations: For version...
PT-2024-16023 · Telerik · Telerik Ui For Wpf
Name of the Vulnerable Software and Affected Versions: Telerik UI for WPF versions prior to 2024 Q4 2024.4.1213 Description: A code execution attack is possible through an insecure deserialization vulnerability. This issue affects Telerik UI for WPF and can be exploited, allowing for code...
PT-2024-30064 · Pligg Cms · Pligg Cms
Name of the Vulnerable Software and Affected Versions: Pligg CMS version 2.0.2 Description: The issue is related to a Cross-Site Request Forgery CSRF in Pligg CMS. This occurs via the admin/admin page.php endpoint with specific parameters: link id and mode. The link id is set to 1 and the mode is...
PT-2024-27609
Name of the Vulnerable Software and Affected Versions WooCommerce Social Login versions 2.6.3 and earlier Description The issue is related to the deserialization of untrusted data in WooCommerce Social Login. This can potentially lead to security issues. No information is provided about the...
PT-2024-19351 · Ibm · Ibm Txseries For Multiplatforms
Name of the Vulnerable Software and Affected Versions: IBM TXSeries for Multiplatforms version 8.2 Description: The issue allows web pages to be stored locally, which can then be read by another user on the system. Recommendations: For IBM TXSeries for Multiplatforms version 8.2, consider...
PT-2024-14246 · WordPress · Wpdiscuz
Name of the Vulnerable Software and Affected Versions: Comments – wpDiscuz versions n/a through 7.6.12 Description: The issue is related to improper neutralization of input during web page generation, which allows stored cross-site scripting XSS. This means that an attacker can inject malicious...
PT-2023-6214 · South River Technologies · Titan Mft +1
Name of the Vulnerable Software and Affected Versions: South River Technologies' Titan MFT and Titan SFTP servers affected versions not specified Description: A session fixation issue allows an attacker to bypass server authentication by tricking an administrator into authorizing a session ID of...
PT-2023-10006 · Unknown · Fanzila Webfinance
Name of the Vulnerable Software and Affected Versions: fanzila WebFinance version 0.5 Description: A critical issue has been found in fanzila WebFinance, affecting an unknown function of the file htdocs/admin/save roles.php. The manipulation of the id argument leads to sql injection...
PT-2021-20859 · Unknown · Kiwi Syslog Server
Name of the Vulnerable Software and Affected Versions: Kiwi Syslog Server affected versions not specified Description: A missing HTTP header X-Frame-Options has left customers vulnerable to clickjacking. Clickjacking is an attack where an attacker uses a transparent iframe to trick a user into...
PT-2020-6867 · D Link · Dch-M225
Name of the Vulnerable Software and Affected Versions: D-Link DCH-M225 versions 1.05b01 and earlier Description: The issue is related to the lack of proper sanitization of special elements used in the operating system command when processing the media renderer parameter in the name string. This...
PT-2026-79326
Name of the Vulnerable Software and Affected Versions Apache CloudStack versions 4.20.0.0 through 4.20.3.0 Apache CloudStack versions 4.21.0.0 through 4.22.1.0 Description Command Injection occurs in the run and get diagnostics functionality for system VMs and virtual routers. An authenticated us...
PT-2026-63798
Name of the Vulnerable Software and Affected Versions odh-dashboard affected versions not specified Description A flaw in the odh-dashboard web console component of Red Hat OpenShift AI RHOAI involves incorrect network binding. This allows a malicious actor within the cluster to bypass...
PT-2026-56163
Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Armiya Information Technologies Ltd. Co. Access Control System GKS allows Stored XSS. This issue affects Access Control System GKS: before Version 2...
PT-2026-55808
Name of the Vulnerable Software and Affected Versions Pardus Update versions 0.6.3 through 0.6.5 Description A missing authorization issue in the TUBITAK BILGEM Software Technologies Research Institute Pardus Update allows for privilege escalation, which occurs when a user can gain higher levels ...
PT-2026-55282
Name of the Vulnerable Software and Affected Versions Eclipse Wakaama versions prior to snapshot/2026-05-26 Description An unbounded memory allocation issue exists in the CoAP Block1 handler within the coap/block.c file. Unauthenticated remote attackers can cause a denial of service by sending a...
PT-2026-54428
Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 150.0.7871.47 Description An inappropriate implementation in Glic allows a remote attacker to perform UI spoofing via a crafted HTML page if a user is convinced to perform specific UI gestures. Recommendations...
PT-2026-51179
GNU Savannah Administration Savane through 3.17 uses untrusted data as part of authorization...
PT-2026-53154
The WhatsApp and Linear bot adapters verify the inbound webhook HMAC signature only when a secret is configured. When the secret environment variable is unset — the default on a fresh install and common in development — verification is skipped entirely and the webhook body is parsed and dispatche...
PT-2026-50525
Name of the Vulnerable Software and Affected Versions Sonatype Nexus Repository Manager versions prior to 3.93.0 Description An authorization bypass exists in the proxy repository configuration. This issue allows a delegated repository administrator to disclose stored upstream proxy credentials...
PT-2026-47876
Name of the Vulnerable Software and Affected Versions Windows Projected File System Filter Driver affected versions not specified Description A buffer over-read in the Windows Projected File System Filter Driver allows an authorized attacker to elevate privileges locally. A buffer over-read occur...
PT-2026-48038
Name of the Vulnerable Software and Affected Versions Azure Stack Edge affected versions not specified Description External control of a file name or path allows an unauthorized attacker to execute arbitrary code over a network. Recommendations At the moment, there is no information about a newer...
PT-2026-45859
Name of the Vulnerable Software and Affected Versions authentik versions prior to 2025.12.6 authentik versions prior to 2026.2.4 authentik versions prior to 2026.5.1 Description authentik is an open-source identity provider. The Source stage can be bypassed by sending an empty POST request...
PT-2026-43534
The auto making JSON-LD plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.5.3. This is due to missing or incorrect nonce validation on the amJL certification function. This makes it possible for unauthenticated attackers to update the plugin'...
PT-2026-43652
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in tainacan Tainacan tainacan allows Blind SQL Injection.This issue affects Tainacan: from n/a through = 1.0.3...
PT-2026-42911
Name of the Vulnerable Software and Affected Versions NousResearch hermes-agent versions prior to 2026.4.23 Description An injection issue exists in the Skills Guard Multi-Word Prompt Handler component within the file agent/skills guard.py. The flaw allows remote exploitation through the...
PT-2026-40780
Name of the Vulnerable Software and Affected Versions @strapi/upload versions prior to 5.33.3 Description In the Upload plugin, Content API endpoints failed to enforce administrator-configured MIME type restrictions defined in plugin.upload.security.allowedTypes and deniedTypes. While these...
PT-2026-40607
Name of the Vulnerable Software and Affected Versions bandit versions 1.4.0 through 1.11.0 Description An unauthenticated remote attacker can cause a denial of service via memory exhaustion. The read data/2 function in Elixir.Bandit.HTTP1.Socket ignores the :length option when processing HTTP/1...
PT-2026-37289
Name of the Vulnerable Software and Affected Versions WWBN AVideo versions prior to 29.0 Description An issue exists where the endpoint 'plugin/CloneSite/cloneClient.json.php' echoes the local CloneSite shared secret, stored in the variable myKey a constant generated via md5$global'systemRootPath...
PT-2026-34667
Name of the Vulnerable Software and Affected Versions Pipecat versions 0.0.41 through 0.0.93 Description An issue exists in the LivekitFrameSerializer class, an optional and deprecated frame serializer used for LiveKit integration. The deserialize function in src/pipecat/serializers/livekit.py us...
PT-2026-33508
Name of the Vulnerable Software and Affected Versions mcp-neo4j-cypher versions prior to 0.6.0 Description The read only mode enforcement can be bypassed using APOC CALL procedures. This may allow unauthorized write operations or server-side request forgery, which is a technique where an attacker...
PT-2026-22822
Name of the Vulnerable Software and Affected Versions Dell Command | Intel vPro Out of Band versions prior to 4.7.0 Description Dell Command | Intel vPro Out of Band software contains an Uncontrolled Search Path Element issue. A local attacker with low privileges could potentially exploit this to...
PT-2026-21340
Name of the Vulnerable Software and Affected Versions Lettermint Node.js SDK versions 1.5.0 and below Description The Lettermint Node.js SDK has an issue where email properties to, subject, html, text, and attachments are not reset between calls to the .send function when the same client instance...
PT-2026-4533
Name of the Vulnerable Software and Affected Versions Sourcecodester Modern Image Gallery App version 1.0 Description A Remote Code Execution RCE issue exists in the gallery/upload.php component of the application. The application does not properly validate uploaded file contents and preserves...
PT-2025-38480
Name of the Vulnerable Software and Affected Versions The product name cannot be determined. affected versions not specified Description The secret used for validating authentication tokens is hardcoded in device firmware. An attacker who obtains the signing key can bypass authentication, gaining...
PT-2025-31794 · Power Hal · Power Hal
Name of the Vulnerable Software and Affected Versions: Power HAL affected versions not specified Description: Power HAL contains a possible out-of-bounds write due to a missing bounds check. Successful exploitation of this issue could lead to local privilege escalation if an attacker already...
PT-2025-30237 · Openssl · Openssl
Name of the Vulnerable Software and Affected Versions: OpenSSL affected versions not specified Description: A locally authenticated, privileged user can create a malicious OpenSSL configuration file, potentially causing the agent to load an arbitrary local library. This could compromise endpoint...
PT-2025-22758 · Unknown · Mojoomla School Management
Name of the Vulnerable Software and Affected Versions: mojoomla School Management versions n/a through 92.0.0 Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection attacks...
PT-2025-9980
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A issue in the Linux kernel has been resolved, related to the blkdev read iter function. This function has odd checks, such as gating the position and count adjustment based on the resul...
PT-2024-36539 · Raisecom · Raisecom Msg2200 +3
Name of the Vulnerable Software and Affected Versions: Raisecom MSG1200 version 3.90 Raisecom MSG2100E version 3.90 Raisecom MSG2200 version 3.90 Raisecom MSG2300 version 3.90 Description: A problem exists in the web interface of the affected devices, specifically in the /upload ipslib.php...
PT-2024-6816 · Moxa · Moxa Nat-102 Oncell G4302-Lte4 +5
Name of the Vulnerable Software and Affected Versions: Moxa EDR-8010 versions affected versions not specified Moxa EDR-G9004 versions affected versions not specified Moxa EDR-G9010 versions affected versions not specified Moxa EDR-G1002-BP versions affected versions not specified Moxa NAT-102...
PT-2024-26050 · Samsung · Samsung Notes
Name of the Vulnerable Software and Affected Versions: Samsung Notes versions prior to 4.4.21.62 Description: The issue is related to an out-of-bounds read in uuid parsing, allowing a local attacker to access unauthorized memory. Recommendations: For versions prior to 4.4.21.62, update to version...