PT-2026-48540

Due to the combination of checking out PR head branches attacker-controlled, reading .mcp.json from the working directory via default setting sources, and unconditionally enabling all project MCP servers via enableAllProjectMcpServers, it was possible for an attacker who opened a PR containing a...

PT-2026-43908

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified openSUSE Tumbleweed versions prior to kernel-devel-7.0.11-1.1 Description A flaw exists in the greybus gb-beagleplay component where the hdlc append function calls usleep range while the tx producer...

PT-2026-43189

Missing password field masking vulnerability in Hitachi Ops Center Analyzer Hitachi Ops Center Analyzer detail view, Hitachi Ops Center Analyzer probe modules, Hitachi Ops Center Analyzer viewpoint, Hitachi Infrastructure Analytics Advisor Data Center Analytics, Analytics probe modules. This issu...

PT-2026-41665

Authorization Bypass vulnerability in Creartia's ICMS software could allow an attacker to gain unauthorized access to protected features by manipulating the HTTP redirect headers of the login process, causing the script to continue running and enabling privilege escalation without the need for...

PT-2026-40762

Exposure of the QKEY used as input into the ‘OTA-Quantum’ device registration process and internal system keys via an unauthenticated and unencrypted HTTP GET method in the Arqit Symmetric Key Agreement Platform. This issue affects Symmetric Key Agreement Platform: before 26.03...

PT-2026-39329

Name of the Vulnerable Software and Affected Versions Hono versions prior to 4.12.18 Description Improper validation of the JWT NumericDate claims exp, nbf, and iat in hono/utils/jwt allows tokens with non-spec-compliant claim values to silently bypass time-based checks. This occurs because the...

PT-2026-38887

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Libraries. Supported versions that are affected are Oracle Java SE: 8u481, 8u481-b50, 8u481-perf, 11.0.30, 17.0.18, 21.0.10, 25.0.2, 26; Oracle GraalVM for JDK:...

PT-2026-35824

Name of the Vulnerable Software and Affected Versions Xuxueli xxl-job versions prior to 3.4.0 Description A security flaw exists in the Execution Log Handler component within the logDetailCat function of the JobLogController.java file. Remote manipulation of the logId argument leads to improper...

PT-2026-33508

Name of the Vulnerable Software and Affected Versions mcp-neo4j-cypher versions prior to 0.6.0 Description The read only mode enforcement can be bypassed using APOC CALL procedures. This may allow unauthorized write operations or server-side request forgery, which is a technique where an attacker...

PT-2026-29538

Improper authentication in the two-factor authentication 2FA feature in Devolutions Server 2026.1.11 and earlier allows a remote attacker with valid credentials to bypass multifactor authentication and gain unauthorized access to the victim account via reuse of a partially authenticated session...

PT-2026-23942

Name of the Vulnerable Software and Affected Versions SourceCodester Pet Grooming Management Software version 1.0 Description An improper authorization issue exists in the User Creation Handler component of the software. This can be triggered by manipulating the file add user.php. The attack can ...

PT-2026-23162

Name of the Vulnerable Software and Affected Versions Mikado-Themes Eona versions through 1.3 Description The software contains a flaw related to improper control of filename for include/require statements, specifically a PHP Remote File Inclusion issue. This allows for PHP Local File Inclusion...

PT-2026-26413

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.2.22 Description OpenClaw versions prior to 2026.2.22 contain an arbitrary shell execution issue in the shell environment fallback mechanism. This occurs because the software trusts the unvalidated SHELL path fr...

PT-2026-21948

Name of the Vulnerable Software and Affected Versions Cisco UCS Manager Software affected versions not specified Description A flaw exists in the NX-OS CLI privilege levels of Cisco UCS Manager Software that could allow an authenticated, local attacker with read-only privileges to modify files an...

PT-2026-5629

Name of the Vulnerable Software and Affected Versions Modem affected versions not specified Description A system crash due to an uncaught exception may lead to remote denial of service. This can occur if a User Equipment UE connects to a rogue base station controlled by an attacker, requiring no...

PT-2026-4304

Name of the Vulnerable Software and Affected Versions Omada Controllers, Gateways and Access Points affected versions not specified Description An authentication weakness exists in Omada Controllers, Gateways, and Access Points related to controller-device adoption. This is due to improper handli...

PT-2025-41811

Name of the Vulnerable Software and Affected Versions Liferay Portal versions 7.4.0 through 7.4.3.111 Liferay DXP versions 2023.Q3.1 through 2023.Q3.10 Liferay DXP versions 2023.Q4.0 through 2023.Q4.5 Liferay Portal 7.4 GA through update 92 Description An Insecure Direct Object Reference IDOR iss...

PT-2025-38480

Name of the Vulnerable Software and Affected Versions The product name cannot be determined. affected versions not specified Description The secret used for validating authentication tokens is hardcoded in device firmware. An attacker who obtains the signing key can bypass authentication, gaining...

PT-2025-31357

DSM Version: 7.2.2-72806 Update 4 とな https://t.co/oSE7NaDt69 1.Fixed a security vulnerability regarding SDK library CVE-2025-8024. 2.Fixed multiple security vulnerabilities...

PT-2025-28475 · Frappe · Press

Name of the Vulnerable Software and Affected Versions: Press versions affected versions not specified Description: The issue concerns a lack of server-side validation for 2FA login, allowing users to circumvent this security measure. Press is a Frappe custom app that manages infrastructure,...

PT-2025-9980

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A issue in the Linux kernel has been resolved, related to the blkdev read iter function. This function has odd checks, such as gating the position and count adjustment based on the resul...

PT-2025-49195

Name of the Vulnerable Software and Affected Versions KDE Connect versions prior to 1.33.0 Valent versions prior to 1.0.0.alpha.47 GSConnect versions prior to 59 KDE Connect on Android versions prior to 1.33.0 KDE Connect on desktop versions prior to 25.04 KDE Connect on iOS versions prior to 0.5...

PT-2024-26482 · Totolink · Totolink Cp900L

Name of the Vulnerable Software and Affected Versions: TOTOLINK CP900L version 4.1.5cu.798 B20221228 Description: A stack overflow issue was discovered via the desc parameter in the setIpPortFilterRules function. Recommendations: For TOTOLINK CP900L version 4.1.5cu.798 B20221228, consider disabli...

PT-2024-1383 · Google +5 · Google Chrome +5

Name of the Vulnerable Software and Affected Versions: Google Chrome versions prior to 121.0.6167.85 Microsoft Edge affected versions not specified Description: The issue is related to insufficient policy enforcement in the Security UI of Google Chrome and Microsoft Edge browsers, which can be...

PT-2022-12632 · Sourcecodester · Employee/Visitor Gate Pass Logging System

Name of the Vulnerable Software and Affected Versions: Sourcecodester Employee and Visitor Gate Pass Logging System version 1.0 Description: An SQL Injection issue exists via the username parameter. Recommendations: For version 1.0, avoid using the username parameter in the affected API endpoint...

PT-2026-106642

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.2.10-1.1 Description An issue exists in the DisplayPort DP driver where the msm dp display atomic disable function writes DP STATE CTRL PUSH IDLE and waits for a completion signal even if the link was never...

PT-2026-88509

Impact The Instance AI workflow summary built its result with get-or-create-then-nested-write idioms keyed by node names and connection keys taken from the stored workflow. Those are arbitrary strings: the restricted-name guard n8n shows in the editor is client-side and is bypassed by posting the...

PT-2026-87069

A reflected cross-site scripting XSS vulnerability in the grid datasource.php component of AppNitro MachForm v30 allows attackers to execute arbitrary Javascript in the context of the victim's browser via injecting a crafted payload into the filterfilters0field parameter...

PT-2026-87136

A malicious webpage could repeatedly trigger external URL schemes, causing system prompts or external application launches. This could make Firefox for iOS temporarily unusable until the page is closed. This vulnerability was fixed in Firefox for iOS 155.1...

PT-2026-87795

Name of the Vulnerable Software and Affected Versions Windows Win32 Kernel Subsystem affected versions not specified Description Use of an uninitialized resource in the Windows Win32 Kernel Subsystem allows an authorized attacker to disclose sensitive information locally. Recommendations At the...

PT-2026-86637

A vulnerability was found in SourceCodester Syllabus-Aligned Learning Management & Examination System 1.0. The affected element is an unknown function of the file manage subjects.php. The manipulation of the argument msg/title/content results in cross site scripting. The attack may be performed...

PT-2026-86611

Name of the Vulnerable Software and Affected Versions MiracastService affected versions not specified Description An escalation of privilege exists in MiracastService caused by a confused deputy, a situation where a privileged entity is tricked by a less privileged entity into performing an actio...

PT-2026-85420

Name of the Vulnerable Software and Affected Versions WPLP Cookie Consent versions prior to 4.4.2 Description Insufficient validation and escaping of a user-supplied pagination parameter allows authenticated users with administrator privileges to perform SQL injection attacks. This occurs because...

PT-2026-81990

A vulnerability was found in Keycloak. This flaw allows attackers to bypass brute force protection by exploiting the timing of login attempts. By initiating multiple login requests simultaneously, attackers can exceed the configured limits for failed attempts before the system locks them out. Thi...

PT-2026-73033

Name of the Vulnerable Software and Affected Versions @fastify/multipart versions 5.3.0 through 10.1.0 Description An issue exists in the multipart form-data parser where the plugin clears its internal current-file reference while the underlying stream remains open when the busboy fileSize limit...

PT-2026-67630

CVE-2026-17002 - Rejected reason: This CVE ID has been rejected or CVE ID :CVE-2026-17002 Published : Aug. 1, 2026, 11:16 p.m. | 42 minutes ago Description :Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. Severity: 0.0 | NA Visit the link for more...

PT-2026-66864

Name of the Vulnerable Software and Affected Versions libiec61850 version 1.6 Description An issue exists in the parseGoosePayload function located in /goose/goose receiver.c that allows attackers to bypass authentication by using a captured GOOSE frame. GOOSE Generic Object Oriented Substation...

PT-2026-65869

Name of the Vulnerable Software and Affected Versions joserfc versions prior to 1.7.2 Description The library accepts JSON Web Tokens JWTs containing trailing padding ==, which does not conform to JSON Object Signing and Encryption JOSE specifications. This results in token malleability, where a...

PT-2026-65450

The Chatbot plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 8.5.9 via the wpcs send email AJAX handler. This is due to the wpcs send email function being registered on both wp ajax wpcs send email and wp ajax nopriv wpcs send email with no nonce...

PT-2026-64138

Summary Prompty loaders expanded $file:... references in .prompty frontmatter without enforcing that the resolved path stayed within an authorized directory. An attacker-controlled prompt file could use path traversal or an absolute path to cause the host application to read files accessible to t...

PT-2026-63077

Name of the Vulnerable Software and Affected Versions Oracle Agile Engineering Data Management version 6.2.1 Description A flaw in the Core component of the Oracle Agile Engineering Data Management product allows a low privileged attacker with network access via TCP to compromise the system...

PT-2026-59901

Impact Out of bounds read in GRUBlockCellGrad python func = tf.raw ops.GRUBlockCellGrad para = 'x': 21.1, 156.2, 83.3, 115.4, 'h prev': array136.5, 136.6, 'w ru': array26.7, 0.8, 47.9, 26.1, 26.2, 26.3, 'w c': array 0.4, 31.5, 0.6, 'b ru': array0.1, 0.2 , dtype=float32, 'b c': 0x41414141, 'r':...

PT-2026-55893

Improper Input Validation, Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Camel Mail Component. The camel-mail producer MailProducer.getSender scanned the outgoing Exchange for message headers in the mail.smtp. / mail.smtps. namespace and, when any were present...

PT-2026-55971

Name of the Vulnerable Software and Affected Versions OpenAI Codex for macOS affected versions not specified Description The desktop application renders remote images from Markdown within model responses. An attacker can use indirect prompt injection—a technique where malicious instructions are...

PT-2026-55786

Name of the Vulnerable Software and Affected Versions exo-explore exo versions prior to 1.0.72 Description A security flaw exists in the Vision Feature Cache component within the image cache key function of the src/exo/worker/engines/mlx/vision.py file. The issue involves the use of a weak hash,...

PT-2026-54456

Name of the Vulnerable Software and Affected Versions Modem affected versions not specified Description An out of bounds write occurs in the Modem due to a missing bounds check. This allows a remote attacker to cause a denial of service if a User Equipment UE connects to a rogue base station...

PT-2026-52759

Unauthenticated Cross Site Scripting XSS in Automatic 3.135.1 versions...

PT-2026-50873

Name of the Vulnerable Software and Affected Versions JetBrains Hub versions prior to 2026.1.13757 JetBrains Hub versions prior to 2025.3.148033 JetBrains Hub versions prior to 2025.2.148048 JetBrains Hub versions prior to 2025.1.148120 JetBrains Hub versions prior to 2024.3.148430 JetBrains Hub...

PT-2026-51077

Name of the Vulnerable Software and Affected Versions CoreWCF versions prior to 1.8.1 CoreWCF versions prior to 1.9.1 Description The WS-Security 1.0 receive pipeline validates the SignatureMethod of an incoming ds:SignedInfo against the configured SecurityAlgorithmSuite but fails to validate the...

PT-2026-49657

A heap buffer overflow vulnerability exists in the Jansi JNI "ioctl" wrapper due to a lack of size verification for the argument array before the system call. This can lead to heap corruption and application crashes DoS. All versions are believed to be vulnerable. This project is unmaintained at...