PT-2026-45531

Name of the Vulnerable Software and Affected Versions Nextcloud versions 4.3.0 through 5.2.6 Description A removed collaborator retains unauthorized read access to uploaded respondent files for an affected form. This access is limited to uploaded files for forms where the user previously possesse...

PT-2026-45443

Tychon includes an OpenSSL component that specifies an OPENSSLDIR variable as a subdirectory that may be controllable by an unprivileged user on Windows. Tychon contains a privileged service that uses this OpenSSL component. A user who can place a specially-crafted openssl.cnf file at an...

PT-2026-44087

pam usb provides hardware authentication for Linux using ordinary removable media. Prior to 0.9.0, multiple pam usb helper tools resolved external binaries through the PATH environment variable rather than using absolute paths. An attacker who can influence the process environment during PAM...

PT-2026-43117

A vulnerability has been found in Dromara lamp-cloud up to 5.6.2. Impacted is the function GroovyClassLoader.parseClass of the component Message Template Handler. Such manipulation of the argument DefMsgTemplate.content leads to improper neutralization of special elements used in a template engin...

PT-2026-41842

Name of the Vulnerable Software and Affected Versions ZTE MU5250 affected versions not specified Description Improper permission control in the Web interface allows an unauthorized attacker to modify configuration settings. Recommendations At the moment, there is no information about a newer...

PT-2026-41121

Name of the Vulnerable Software and Affected Versions libyang versions prior to 5.2.15 Description The lyb read string function in src/parser lyb.c contains an integer overflow. This occurs when parsing a maliciously crafted LYB binary blob, leading to a heap buffer overflow. An attacker capable ...

PT-2026-40893

The Media Sync plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.4.9 via the 'sub dir' and 'media items' parameters. This is due to insufficient validation of user-supplied file paths, which are not checked for directory traversal sequences or restricted...

PT-2026-40382

Name of the Vulnerable Software and Affected Versions AOS-8 affected versions not specified Description A session management issue allows previously authenticated users to maintain network access after their accounts have been administratively disabled. Because existing sessions are not invalidat...

PT-2026-39544

Name of the Vulnerable Software and Affected Versions Open5GS versions prior to 2.7.8 Description A remote denial of service issue exists in the SMF component. The flaw is located in the update authorized pcc rule and qos function within the /src/smf/npcf-handler.c file. Manipulation of this...

PT-2026-33222

Name of the Vulnerable Software and Affected Versions MuPDF mutool affected versions not specified Description MuPDF mutool fails to sanitize PDF metadata fields before writing them to terminal output. This allows the injection of arbitrary ANSI escape sequences—codes used to control terminal...

PT-2026-30482

UniSharp Laravel File Manager v2.0.0-alpha7 and v2.0 contain an arbitrary file upload vulnerability that allows authenticated attackers to upload malicious files by sending multipart form data to the upload endpoint. Attackers can upload PHP files with the type parameter set to Files and execute...

PT-2026-23291

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in ThemeREX DroneX dronex allows PHP Local File Inclusion.This issue affects DroneX: from n/a through = 1.1.12...

PT-2026-21948

Name of the Vulnerable Software and Affected Versions Cisco UCS Manager Software affected versions not specified Description A flaw exists in the NX-OS CLI privilege levels of Cisco UCS Manager Software that could allow an authenticated, local attacker with read-only privileges to modify files an...

PT-2026-4802

Name of the Vulnerable Software and Affected Versions Shenzhen Tenda W30E V2 versions up to and including V16.01.0.195037 Description The device features an insecure Cross-Origin Resource Sharing CORS policy on authenticated administrative endpoints. The configuration sets...

PT-2026-1982

Name of the Vulnerable Software and Affected Versions D-Link DI-8200G version 17.12.20A1 Description A flaw exists in D-Link DI-8200G version 17.12.20A1 that allows for command injection. The issue is related to the manipulation of the path argument within an unknown function of the /upgrade...

PT-2026-8147

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The Linux kernel contains a flaw in the mac80211 module related to the handling of TID-To-Link Mapping TTLM elements. Specifically, the parsing of TTLM elements with a default link map i...

PT-2025-47837

Name of the Vulnerable Software and Affected Versions ashraf-kabir travel-agency versions prior to 1f25aa03544bc5fb7a9e846f8a7879cecdb0cad3 Description A security issue exists in ashraf-kabir travel-agency. The manipulation of the edit pack argument in the /admin area/index.php file leads to SQL...

PT-2025-47522

Name of the Vulnerable Software and Affected Versions FileCodeBox versions prior to 2.3 Description A stored cross-site scripting XSS issue exists in the text sharing feature. Insufficient input validation allows attackers to inject arbitrary JavaScript code into shared text "codeboxes". This...

PT-2025-41433

Name of the Vulnerable Software and Affected Versions Juniper Networks Junos Space versions prior to 24.1R4 Description An Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' issue exists in Juniper Networks Junos Space. An attacker can inject script tags in the CLI...

PT-2025-33637 · Portabilis · I-Diario

Name of the Vulnerable Software and Affected Versions: The product name cannot be determined. affected versions not specified Description: The component Login Page contains an issue with improper restriction of rendered UI layers due to manipulation of an unknown function. This issue can be...

PT-2025-35973

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The Linux kernel contains a flaw within the libiscsi component. Specifically, the iscsi conn-dd data field is initialized regardless of whether memory allocation succeeds. If ib fast reg...

PT-2024-21680 · Toshiba · Toshiba Printers

Name of the Vulnerable Software and Affected Versions: Toshiba printers affected versions not specified Description: The issue concerns a Local Privilege Escalation vulnerability, allowing an attacker to remotely compromise Toshiba printers. Recommendations: At the moment, there is no information...

PT-2025-18858 · Linux +2 · Linux Kernel +2

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: A race condition in the Linux kernel's serial driver, specifically in the fsl lpuart component, can lead to a NULL pointer dereference when the DMA completion interrupt occurs during D...

PT-2025-16122 · Apple · Ipados +4

Name of the Vulnerable Software and Affected Versions: iOS versions prior to 17 iPadOS versions prior to 17 macOS Sonoma versions prior to 14 macOS Ventura versions prior to 13.6 macOS Monterey versions prior to 12.7 Description: An app may be able to break out of its sandbox due to improper...

PT-2023-3288 · Adobe · Substance3D - Designer

Name of the Vulnerable Software and Affected Versions: Adobe Substance 3D Designer versions 12.4.1 and earlier Description: The issue is related to an Access of Uninitialized Pointer vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of th...

PT-2023-17369 · Unknown · Sourcecodester Online Computer/Laptop Store

Name of the Vulnerable Software and Affected Versions: SourceCodester Online Computer and Laptop Store version 1.0 Description: A critical vulnerability was found in the Image Handler component of the affected software, specifically in the /classes/Master.php file, where the path argument is...

PT-2022-17940 · Pax Technology · Paydroid +1

Name of the Vulnerable Software and Affected Versions: PAX A930 device with PayDroid versions 7.1.1 Virgo V04.3.26T1 20210419 through 7.1.1 Virgo V04.4.02 20211201 Description: The issue allows an unauthorized attacker to perform privileged actions through the execution of specific binaries liste...

PT-2022-5142 · Linux +4 · Linux Kernel +4

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: A use-after-free flaw was found in the Linux kernel’s Amateur Radio AX.25 protocol functionality. This issue arises in the way a user connects with the protocol, allowing a local user ...

PT-2020-15503 · Jenkins · Jenkins Elastest Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins ElasTest Plugin versions 1.2.1 and earlier Description: The issue concerns the storage of the server password in an unencrypted form within the global configuration file on the Jenkins controller. This allows users with access to the...

PT-2011-4732 · Unknown · Elegant Grunge Theme

Name of the Vulnerable Software and Affected Versions: Elegant Grunge theme versions prior to 1.0.4 Description: The issue is related to a cross-site scripting XSS vulnerability, which allows remote attackers to inject arbitrary web script or HTML. This is achieved via the s parameter...

PT-2011-5237 · Opensuse +4 · Systemtap-Client-Debuginfo +16

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 3.6.9 openSUSE systemtap-runtime-debuginfo affected versions not specified openSUSE systemtap-sdt-devel affected versions not specified openSUSE systemtap affected versions not specified openSUSE libvmtools0...

PT-2026-88454

The administrative panel of the Auth0 AD/LDAP Connector versions 6.5.0 and earlier listens on the local loopback interface without requiring authentication. This allows a local, low-privileged user or process on the host system to access the panel's management endpoints without credentials. Throu...

PT-2026-87862

Use of uninitialized resource in Windows Task Scheduler allows an authorized attacker to disclose information locally...

PT-2026-87172

An authenticated stored cross-site scripting XSS vulnerability in the Column Management component of ClassCMS 1CMS v5.6 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the title field...

PT-2026-87795

Use of uninitialized resource in Windows Win32 Kernel Subsystem allows an authorized attacker to disclose information locally...

PT-2026-78327

Vulnerability in NetScaler ADC and NetScaler Gateway. This issue affects ADC: from 14.1 through 73.32 and from 13.1 through 63.21; Gateway: from 14.1 through 73.32 and from 13.1 through 63.21...

PT-2026-67142

A weakness has been identified in mz-automation libiec61850 up to 1.6.1. This issue affects the function checkDataSetAccess of the file src/iec61850/server/mms mapping/mms mapping.c of the component MMS Request Handler. This manipulation causes out-of-bounds read. The attack can be initiated...

PT-2026-67338

FlowIntel is affected by a stored cross-site scripting vulnerability through multiple user-controlled or administrator-controlled fields. Persisted values—including case titles, ticket identifiers, recurring-case information, user profile attributes, organisation names, and role names—were render...

PT-2026-67138

Name of the Vulnerable Software and Affected Versions Keycloak affected versions not specified Description A flaw in the keycloak-services component, used for managing authentication and authorization flows, allows a bypass of client access-type policy conditions. When a realm administrator...

PT-2026-67129

The Kadence Blocks — Page Builder Toolkit for Gutenberg Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Identity Block Inner Image Content in all versions up to, and including, 3.7.8.1 due to insufficient input sanitization and output escaping. This makes it possible...

PT-2026-65400

The ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.4.5 via the 'optionSection' parameter due to missing validation on a user controlled key. This makes it possible...

PT-2026-60697

Name of the Vulnerable Software and Affected Versions Pheditor versions 2.0.1 through 2.0.5 Description The terminal feature in Pheditor contains a flaw in how it sanitizes user-supplied commands before passing them to the shell exec function. While a blocklist is used to filter dangerous...

PT-2026-58254

Integer overflow or wraparound in Microsoft Defender allows an unauthorized attacker to execute code locally...

PT-2026-58061

Summary Cloudflare quiche was discovered to be vulnerable to memory resource exhaustion due to unbounded queuing of post-handshake client migration events. Impact quiche supports the connection migration features described in Section 9 of RFC 9000, which allows a single QUIC connection to survive...

PT-2026-56664

Name of the Vulnerable Software and Affected Versions Drupal UI Patterns SDC in Drupal UI versions 2.0.0 through 2.0.17 Description An issue exists where the module does not sufficiently sanitize markup passed to components in certain scenarios, leading to Stored Cross-site Scripting XSS...

PT-2026-56084

Name of the Vulnerable Software and Affected Versions 9Router versions prior to 0.4.80 Description The dashboard login rate limiter derives client identity from the X-Forwarded-For HTTP header, which is controlled by the user. When the application is directly exposed or deployed behind a reverse...

PT-2026-55786

Name of the Vulnerable Software and Affected Versions exo-explore exo versions prior to 1.0.72 Description A security flaw exists in the Vision Feature Cache component within the image cache key function of the src/exo/worker/engines/mlx/vision.py file. The issue involves the use of a weak hash,...

PT-2026-55444

Name of the Vulnerable Software and Affected Versions AR for WordPress versions prior to 8.41 Description An unauthenticated directory traversal flaw exists in the file handling logic of the plugin. The issue occurs when the public AJAX functionality accepts a user-controlled file parameter witho...

PT-2026-54456

Name of the Vulnerable Software and Affected Versions Modem affected versions not specified Description An out of bounds write occurs in the Modem due to a missing bounds check. This allows a remote attacker to cause a denial of service if a User Equipment UE connects to a rogue base station...

PT-2026-54519

Name of the Vulnerable Software and Affected Versions buffa affected versions not specified Description The buffa protobuf decoder contains a memory-amplification issue. A malformed message can cause the library to consume up to 22 times the expected amount of RAM, leading to a denial of service...