PT-2026-59901

Impact Out of bounds read in GRUBlockCellGrad python func = tf.raw ops.GRUBlockCellGrad para = 'x': 21.1, 156.2, 83.3, 115.4, 'h prev': array136.5, 136.6, 'w ru': array26.7, 0.8, 47.9, 26.1, 26.2, 26.3, 'w c': array 0.4, 31.5, 0.6, 'b ru': array0.1, 0.2 , dtype=float32, 'b c': 0x41414141, 'r':...

PT-2026-55893

Improper Input Validation, Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Camel Mail Component. The camel-mail producer MailProducer.getSender scanned the outgoing Exchange for message headers in the mail.smtp. / mail.smtps. namespace and, when any were present...

PT-2026-55971

Name of the Vulnerable Software and Affected Versions OpenAI Codex for macOS affected versions not specified Description The desktop application renders remote images from Markdown within model responses. An attacker can use indirect prompt injection—a technique where malicious instructions are...

PT-2026-55786

Name of the Vulnerable Software and Affected Versions exo-explore exo versions prior to 1.0.72 Description A security flaw exists in the Vision Feature Cache component within the image cache key function of the src/exo/worker/engines/mlx/vision.py file. The issue involves the use of a weak hash,...

PT-2026-54456

Name of the Vulnerable Software and Affected Versions Modem affected versions not specified Description An out of bounds write occurs in the Modem due to a missing bounds check. This allows a remote attacker to cause a denial of service if a User Equipment UE connects to a rogue base station...

PT-2026-52759

Unauthenticated Cross Site Scripting XSS in Automatic 3.135.1 versions...

PT-2026-50873

Name of the Vulnerable Software and Affected Versions JetBrains Hub versions prior to 2026.1.13757 JetBrains Hub versions prior to 2025.3.148033 JetBrains Hub versions prior to 2025.2.148048 JetBrains Hub versions prior to 2025.1.148120 JetBrains Hub versions prior to 2024.3.148430 JetBrains Hub...

PT-2026-51077

Name of the Vulnerable Software and Affected Versions CoreWCF versions prior to 1.8.1 CoreWCF versions prior to 1.9.1 Description The WS-Security 1.0 receive pipeline validates the SignatureMethod of an incoming ds:SignedInfo against the configured SecurityAlgorithmSuite but fails to validate the...

PT-2026-49657

A heap buffer overflow vulnerability exists in the Jansi JNI "ioctl" wrapper due to a lack of size verification for the argument array before the system call. This can lead to heap corruption and application crashes DoS. All versions are believed to be vulnerable. This project is unmaintained at...

PT-2026-49884

Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware component: Authentication Engine. Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle...

PT-2026-48511

Name of the Vulnerable Software and Affected Versions Fission versions prior to 1.24.0 Description An issue exists in the Kubernetes-native serverless framework where a tenant with environments.fission.io create/update RBAC permissions can deploy containers with privileged access,...

PT-2026-47123

Name of the Vulnerable Software and Affected Versions Integration for Freshsales – Contact Form 7, WPForms, Elementor, Gravity Forms and More plugin for WordPress versions prior to 1.0.16 Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform...

PT-2026-45553

Name of the Vulnerable Software and Affected Versions code-projects Hotel and Tourism Reservation System version 1.0 Description An issue in the Admin Login component allows remote attackers to achieve improper authentication. This occurs through the manipulation of the Password argument within t...

PT-2026-45583

Name of the Vulnerable Software and Affected Versions Android Framework affected versions not specified Description Improper input validation in multiple functions of DevicePolicyManagerService.java allows a system critical package to be hidden. This can result in a local denial of service withou...

PT-2026-45577

Name of the Vulnerable Software and Affected Versions Android Framework affected versions not specified Description An incorrect bounds check in the setTo function within ResourceTypes.cpp can lead to a read out of bounds. This issue allows for local information disclosure without requiring...

PT-2026-43545

The Enable jQuery Migrate Helper plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the downgrade jquery version function in all versions up to, and including, 1.4.1. This is due to the function only verifying a nonce without checking user...

PT-2026-42823

Name of the Vulnerable Software and Affected Versions Amazon Braket SDK versions prior to 1.117.0 Description Insecure deserialization in the job results processing component may allow a remote authenticated user with S3 write access to the job output bucket to achieve arbitrary code execution on...

PT-2026-52217

Name of the Vulnerable Software and Affected Versions Gitea versions prior to 1.26.3 Description Incomplete Server-Side Request Forgery SSRF protection exists within the webhook and migration allow-list filtering. SSRF is a flaw that allows an attacker to induce the server-side application to mak...

PT-2026-40708

Buffer Overflow vulnerability in Ardupilot rover commit v.c56439b045162058df0ff136afea3081fcd06d38 allows a local attacker to cause a denial of service via the AP InertialSensor ADIS1647x.cpp, ArduRover, ADIS1647x Sensor component...

PT-2026-38886

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: JAXP. Supported versions that are affected are Oracle Java SE: 8u481, 8u481-b50, 8u481-perf, 11.0.30, 17.0.18, 21.0.10, 25.0.2, 26; Oracle GraalVM for JDK: 17.0.18 a...

PT-2026-34667

Name of the Vulnerable Software and Affected Versions Pipecat versions 0.0.41 through 0.0.93 Description An issue exists in the LivekitFrameSerializer class, an optional and deprecated frame serializer used for LiveKit integration. The deserialize function in src/pipecat/serializers/livekit.py us...

PT-2026-33927

Name of the Vulnerable Software and Affected Versions TYPO3 CMS version 14.2.0 Description Changing backend users passwords through the user settings module causes the cleartext password to be stored in the uc and user settings fields of the be users database table. Recommendations At the moment,...

PT-2026-37014

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.4.14 Description A redaction bypass exists that allows authenticated gateway clients with config read access to receive unredacted secrets. This occurs through the sourceConfig and runtimeConfig alias fields,...

PT-2026-56684

UEFI Firmware Parser parses BIOS, Intel ME, and UEFI firmware structures including volumes, file systems, and files. Prior to 1.14, ReadCLen in uefi firmware/compression/Tiano/Decompress.c reads Number from GetBitsSd, CBIT with CBIT = 9 and can obtain 511 entries for the 510-element Sd-mCLen heap...

PT-2026-22822

Name of the Vulnerable Software and Affected Versions Dell Command | Intel vPro Out of Band versions prior to 4.7.0 Description Dell Command | Intel vPro Out of Band software contains an Uncontrolled Search Path Element issue. A local attacker with low privileges could potentially exploit this to...

PT-2026-20414

A vulnerability has been identified in Rexroth IndraWorks. This flaw allows an attacker to execute arbitrary code on the user's system by parsing a manipulated file containing malicious serialized data. Exploitation requires user interaction, specifically opening a specially crafted file, which...

PT-2026-20213

Name of the Vulnerable Software and Affected Versions IBM Concert versions 1.0.0 through 2.1.0 Description The software uses cryptographic algorithms that are not strong enough, potentially allowing an attacker to decrypt sensitive information. Recommendations Update to a version beyond 2.1.0. At...

PT-2026-5148

A GPU device-ID validation flaw in the flow.cuda.get device capability component of OneFlow v0.9.0 allows attackers to cause a Denial of Service DoS via a crafted device ID...

PT-2026-2204

Name of the Vulnerable Software and Affected Versions EFACEC charging systems affected versions not specified Description An attacker with access to the system's internal network can cause a denial of service by establishing two concurrent connections through the Telnet service. The issue impacts...

PT-2025-33096 · Unknown · Unform Server Manager

Name of the Vulnerable Software and Affected Versions: UnForm Server Manager versions prior to 10.1.12 Description: UnForm Server Manager versions prior to 10.1.12 contain an unauthenticated file read flaw in the log file analysis interface. The vulnerability is located in the arc endpoint, which...

PT-2025-22758 · Unknown · Mojoomla School Management

Name of the Vulnerable Software and Affected Versions: mojoomla School Management versions n/a through 92.0.0 Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection attacks...

PT-2025-17581 · Mensch Und Maschine · Mum Mapedit

Name of the Vulnerable Software and Affected Versions: MuM aka Mensch und Maschine MapEdit aka mapedit-web version 24.2.3 Description: The issue allows an attacker to execute malicious SQL statements, controlling a web application's database server. This is due to a SQL Injection vulnerability...

PT-2025-28683 · Irfanview · Irfanview +1

Name of the Vulnerable Software and Affected Versions: IrfanView CADImage Plugin affected versions not specified Description: The issue resides in the CADImage plugin for IrfanView, a graphics, video, and audio file viewer and player. The vulnerability is an out-of-bounds write in memory when...

PT-2026-2885

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A flaw exists in the Linux kernel’s DRM MSM A6xx driver where a NULL pointer dereference could occur. Specifically, the preempt prepare postamble function was being called before verifyi...

PT-2024-6816 · Moxa · Moxa Nat-102 Oncell G4302-Lte4 +5

Name of the Vulnerable Software and Affected Versions: Moxa EDR-8010 versions affected versions not specified Moxa EDR-G9004 versions affected versions not specified Moxa EDR-G9010 versions affected versions not specified Moxa EDR-G1002-BP versions affected versions not specified Moxa NAT-102...

PT-2024-39278 · Livemesh · Elementor Addons

Name of the Vulnerable Software and Affected Versions: Elementor Addons by Livemesh plugin for WordPress versions up to, and including, 8.5 Description: The issue is related to Stored Cross-Site Scripting via the piechart settings parameter due to insufficient input sanitization and output...

PT-2024-38897 · Unknown +1 · Opa Go Library +1

Name of the Vulnerable Software and Affected Versions: OPA for Windows versions prior to 0.68.0 Description: A SMB force-authentication vulnerability exists due to improper input validation, allowing a user to pass an arbitrary SMB share instead of a Rego file as an argument to OPA CLI or to one ...

PT-2024-5125 · Sicam Egs +1 · Sicam Egs +4

Name of the Vulnerable Software and Affected Versions: CPCI85 Central Processing/Communication versions prior to V5.40 SICORE Base system versions prior to V1.4.0 SICAM CP-8031, CP-8050, SICAM EGS affected versions not specified Description: The issue is related to the lack of necessary...

PT-2024-13882 · Realtek · Realtek Rtl819X Jungle Sdk

Name of the Vulnerable Software and Affected Versions: Realtek rtl819x Jungle SDK version 3.4.11 Description: Two stack-based buffer overflow vulnerabilities exist in the boa set RadvdInterfaceParam functionality. A specially crafted series of network requests can lead to remote code execution. A...

PT-2024-1691 · Elastic · Kibana

Name of the Vulnerable Software and Affected Versions: Kibana affected versions not specified Description: The issue is related to insufficient access control in the Kibana data visualization service. It allows a remote attacker to impact the confidentiality of protected information. Specifically...

PT-2023-26906 · Unknown · Siberiancms

Name of the Vulnerable Software and Affected Versions: SiberianCMS affected versions not specified Description: A malicious user with administrative privileges may be able to upload a dangerous filetype via an unspecified method. This issue is related to the unrestricted upload of files with...

PT-2023-23959 · Lima · Lima

Name of the Vulnerable Software and Affected Versions: Lima versions prior to 0.16.0 Description: A virtual machine instance with a malicious disk image could read a single file on the host filesystem, even when no filesystem is mounted from the host. The attacker has to embed the target file pat...

PT-2020-6248 · Python Imaging Library +2 · Pillow +2

Name of the Vulnerable Software and Affected Versions: Pillow versions prior to 7.1.0 Pillow versions 7.x prior to 7.0.1 Pillow version 6.2.2 and earlier Description: The issue is related to multiple out-of-bounds reads in the libImaging/FliDecode.c library. This could allow a remote attacker to...

PT-2026-91590

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. Processing a maliciously crafted 3D scene may lead to...

PT-2026-90859

A vulnerability was determined in jaychouchannel Tourism-Management-System up to d984d172dceca907f8b447efbdb06dc233f7938d. Impacted is the function resetPass of the file UsersController.java of the component Password Recovery. This manipulation causes weak password recovery. The attack can be...

PT-2026-88454

The administrative panel of the Auth0 AD/LDAP Connector versions 6.5.0 and earlier listens on the local loopback interface without requiring authentication. This allows a local, low-privileged user or process on the host system to access the panel's management endpoints without credentials. Throu...

PT-2026-87172

Name of the Vulnerable Software and Affected Versions ClassCMS 1CMS version 5.6 Description An authenticated stored cross-site scripting XSS issue exists in the Column Management component. This allows an attacker to execute arbitrary web scripts or HTML by injecting a crafted payload into the...

PT-2026-84507

Name of the Vulnerable Software and Affected Versions SVGO versions 1.0.0 through 2.8.3 SVGO versions 3.0.0 through 3.3.4 SVGO versions 4.0.0 through 4.0.9 Description The removeScripts plugin known as removeScriptElement in versions 2 and 3, implemented in plugins/removeScripts.js, fails to...

PT-2026-77741

Name of the Vulnerable Software and Affected Versions Oracle Hyperion Financial Reporting version 11.2.25.0.000 Description A flaw in the Server component allows a low privileged attacker with network access via HTTPS to compromise the system. Successful exploitation can lead to a complete takeov...

PT-2026-73084

Name of the Vulnerable Software and Affected Versions Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin versions prior to 1.6.12.11 Description An Insecure Direct Object Reference exists due to missing validation on a user-controlled key within ssa past appointments...