PT-2026-52676

An unauthenticated stack-based buffer overflow vulnerability exists in ssvr in GeoVision GV-LPC2011 and GV-LPC2211 V1.12 and earlier. The vulnerability is caused by insufficient bounds checking when processing RTSP custom authentication data. A remote attacker may exploit this vulnerability by...

PT-2026-52653

Name of the Vulnerable Software and Affected Versions Lemur affected versions not specified Description An authenticated user with the operator role can induce the server to make unauthorized outbound requests to internal network resources. This occurs because the software extracts CRL Distributi...

PT-2026-52498

Name of the Vulnerable Software and Affected Versions Trivy versions prior to 0.71.0 Description A security scanner issue occurs when processing Helm chart archives .tgz. The custom tar unpacker uses the io.ReadAlltr function without a size limit. An attacker can provide a specially crafted...

PT-2026-51416

Name of the Vulnerable Software and Affected Versions Nuxt versions 3.x prior to 3.21.7 Nuxt versions 4.0.0 through 4.4.6 Description The reloadNuxtApp function accepts protocol-relative paths, such as //evil.com. These paths bypass the script-protocol check and resolve to a cross-origin URL base...

PT-2026-50736

Impact Hydro contains an insufficient session expiration vulnerability in its session recreation logic. When a session is recreated, including during logout or other session renewal flows, Hydro creates a new session token but does not delete the previous server-side session token. As a result, a...

PT-2026-50676

Name of the Vulnerable Software and Affected Versions Docker Sandboxes affected versions not specified Description Docker Sandboxes sbx fail to re-apply the ICMP egress authorizer to networks rebuilt from disk after a Docker daemon restart. This allows a restart-surviving sandbox to forward ICMP...

PT-2026-53078

Name of the Vulnerable Software and Affected Versions openSUSE Tumbleweed versions prior to libblkid-devel-2.42.2-1.1 Description A local privilege escalation exists due to a Time-of-Check to Time-of-Use TOCTOU race condition in the mount8 utility within the hook owner.c file during chmod and cho...

PT-2026-49926

Vulnerability in the Identity Manager Connector product of Oracle Fusion Middleware component: Database User. Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Identity...

PT-2026-50153

Name of the Vulnerable Software and Affected Versions Deno versions prior to 2.8.1 Description When the fetch function is called, the runtime validates the destination hostname against --deny-net rules but fails to re-verify the IP addresses that the hostname resolves to. This allows an...

PT-2026-48721

Name of the Vulnerable Software and Affected Versions Vim versions prior to 9.2.0561 Description The Python omni-completion script in python3complete.vim for builds with the +python3 interpreter enabled and pythoncomplete.vim for builds with the +python interpreter executes import and from...

PT-2026-48509

Name of the Vulnerable Software and Affected Versions Fission versions prior to 1.24.0 Description Fission is a Kubernetes-native serverless framework. The Environment CRD exposes spec.runtime.podSpec and spec.builder.podSpec, which are merged into the Kubernetes pod specs for runtime and builder...

PT-2026-47158

Name of the Vulnerable Software and Affected Versions Mage AI versions prior to 0.9.80 Description A cross-site scripting issue exists in the Sign-in Flow component within the useMutation function of the file mage ai/frontend/components/Sessions/SignForm/index.tsx. Manipulation of the...

PT-2026-44233

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A NULL pointer dereference can occur in the stmmac driver when RX memory is exhausted. The driver uses a shared ring array of DMA descriptors to coordinate between the CPU and MAC. The...

PT-2026-40029

Dell PowerScale InsightIQ, versions 5.0.0 through 6.2.0, contains an execution with unnecessary privileges vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to elevation of privileges...

PT-2026-40079

Improper initialization in the UEFI firmware for some Intel platforms within Ring 0: Bare Metal OS may allow an information disclosure. System software adversary with a privileged user combined with a high complexity attack may enable data exposure. This result may potentially occur via local...

PT-2026-39923

Due to a Code Injection vulnerability in SAP Application Server ABAP for SAP NetWeaver and ABAP Platform, an authenticated attacker could send specially crafted inputs to the application. If processed by the application, this input could be delivered to users subscribed to the channel and result ...

PT-2026-39536

Name of the Vulnerable Software and Affected Versions D-Link DCS-935L versions prior to 1.10.01 Description A remote buffer overflow exists in the HNAP Service component within the '/web/cgi-bin/hnap/hnap service' file. The issue occurs during the processing of the SetDeviceSettings function when...

PT-2026-38887

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Libraries. Supported versions that are affected are Oracle Java SE: 8u481, 8u481-b50, 8u481-perf, 11.0.30, 17.0.18, 21.0.10, 25.0.2, 26; Oracle GraalVM for JDK:...

PT-2026-38592

Name of the Vulnerable Software and Affected Versions 8421bit MiniClaw versions prior to e8bd4e17e9428260f2161378356affc5ce90d6ed Description A path traversal issue exists in the executeSkillScript component within the isPathInside function of the src/kernel.ts file. This flaw allows a remote...

PT-2026-38545

A vulnerability has been found in router-for-me CLIProxyAPI 6.9.29. Affected by this issue is some unknown functionality of the file internal/api/handlers/management/api tools.go of the component API Interface. The manipulation of the argument url leads to server-side request forgery. Remote...

PT-2026-41172

Name of the Vulnerable Software and Affected Versions Open WebUI versions prior to 0.9.0 Description A Server-Side Request Forgery SSRF bypass exists in the validate url function located in backend/open webui/retrieval/web/utils.py. The function calls validators.ipv6ip, private=True, but because...

PT-2026-28073

Multiple Stored XSS vulnerabilities exist in Seafile Server version 13.0.15,13.0.16-pro,12.0.14 and prior and fixed in 13.0.17, 13.0.17-pro, and 12.0.20-pro, via the Seadoc sdoc editor. The application fails to properly sanitize WebSocket messages regarding document structure updates. This allows...

PT-2026-23932

Name of the Vulnerable Software and Affected Versions Tenda F453 version 1.0.0.3 Description A stack-based buffer overflow exists in the function sub 3C6C0 of the file /goform/QuickIndex. The issue is triggered by manipulating the mit linktype/PPPOEPassword argument, allowing for remote attacks. ...

PT-2026-1644

Veeam Backup & Replication and Affected Versions Veeam Backup & Replication versions 13.0.1.180 and earlier Description A critical remote code execution RCE vulnerability exists in Veeam Backup & Replication software. This flaw, tracked as CVE-2025-59470, has a CVSS score of 9.0 and allows a user...

PT-2025-37200

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: A flaw exists in the Linux kernel’s drm/xe/migrate module related to handling copy sizes during migration. Specifically, when dealing with non-page aligned copies and pitches, the...

PT-2026-51214

Name of the Vulnerable Software and Affected Versions picklescan versions prior to 0.0.28 Description An issue exists where the software fails to detect malicious pickle files that invoke the load config function within the torch.utils. config module module inside reduce methods. This allows...

PT-2025-26822 · WordPress · Everest Forms

Name of the Vulnerable Software and Affected Versions: The Everest Forms Pro plugin for WordPress versions up to, and including, 1.9.4 Description: The issue is related to insufficient file path validation in the delete entry files function, allowing unauthenticated attackers to delete arbitrary...

PT-2025-12811 · Appsmith · Appsmith

Name of the Vulnerable Software and Affected Versions: Appsmith versions prior to 1.51 Description: An issue was discovered in Appsmith where a user without admin permissions can trigger the restart API, causing a server restart. This is due to incorrect access control checks, which should check...

PT-2025-23501 · Froxlor · Froxlor

Name of the Vulnerable Software and Affected Versions: Froxlor versions prior to 2.2.6 Description: The issue is an HTML Injection vulnerability in the customer account portal, allowing an attacker to inject malicious HTML payloads in the email section. This can lead to phishing attacks, credenti...

PT-2025-1569 · Nvidia · Cuml +2

Name of the Vulnerable Software and Affected Versions: NVIDIA RAPIDS affected versions not specified Description: The issue is related to a deserialization of untrusted data in cuDF and cuML, which could lead to code execution, data tampering, denial of service, and information disclosure...

PT-2025-4705 · Unknown · Thorsten Krug Multilang Contact Form

Name of the Vulnerable Software and Affected Versions: Thorsten Krug Multilang Contact Form versions n/a through 1.5 Description: The issue is related to improper neutralization of input during web page generation, also known as 'Cross-site Scripting'. This allows for Reflected XSS...

PT-2024-8731 · Siemens · Scalance Wam766-1 +14

Name of the Vulnerable Software and Affected Versions: RUGGEDCOM RM1224 LTE4G EU versions prior to V8.2 RUGGEDCOM RM1224 LTE4G NAM versions prior to V8.2 SCALANCE M804PB versions prior to V8.2 SCALANCE M812-1 ADSL-Router versions prior to V8.2 SCALANCE M816-1 ADSL-Router versions prior to V8.2...

PT-2024-30600 · WordPress · List Categories

Name of the Vulnerable Software and Affected Versions: List categories plugin for WordPress versions up to, and including, 0.4 Description: The issue arises from insufficient input sanitization and output escaping on user-supplied attributes in the plugin's 'categories' shortcode. This allows...

PT-2025-18858 · Linux +2 · Linux Kernel +2

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: A race condition in the Linux kernel's serial driver, specifically in the fsl lpuart component, can lead to a NULL pointer dereference when the DMA completion interrupt occurs during D...

PT-2024-15734

Name of the Vulnerable Software and Affected Versions Plone CMS versions prior to 6.0.5 Description A Cross-Frame Scripting issue has been found in Plone CMS. This issue allows an attacker to store a malicious URL that can be opened by an administrator, potentially leading to the execution of a...

PT-2023-36414 · Mitsubishi · Gs21 +7

Уязвимость функции Data Transfer Security программного обеспечения создания и управления графическими интерфейсами операторов на промышленных панелях управления GT Designer3, GOT2000 Series, GOT SIMPLE Series, GT SoftGOT2000 связана со слабой криптографией паролей. Эксплуатация уязвимости может...

PT-2023-21874 · Sourcecodester · Sourcecodester Theme Park Ticketing System

Name of the Vulnerable Software and Affected Versions: SourceCodester Theme Park Ticketing System version 1.0 Description: A critical issue affects the GET Parameter Handler component in the print ticket.php file, allowing for SQL injection through the manipulation of the id argument. This can be...

PT-2021-7636

Name of the Vulnerable Software and Affected Versions Grafana versions 8.0.0-beta1 through 8.3.0 Description Grafana is vulnerable to a directory traversal vulnerability, allowing attackers to access local files. The vulnerable URL path is: /public/plugins//, where is the plugin ID for any...

PT-2021-1575 · Microsoft +3 · Visual Studio +5

Name of the Vulnerable Software and Affected Versions: ASP.NET Core and Visual Studio affected versions not specified Description: The issue is related to insufficient input validation in ASP.NET Core and Visual Studio, which can lead to a denial-of-service condition. This can be exploited by a...

PT-2020-7489 · Red Hat · Red Hat Openshift

Name of the Vulnerable Software and Affected Versions: Red Hat Openshift 1 affected versions not specified Description: The deployment script in the unsupported "OpenShift Extras" set of add-on scripts installs a default public key in the root user's authorized keys file. Recommendations: At the...

PT-2012-1848 · Moodle · Moodle

Name of the Vulnerable Software and Affected Versions: Moodle versions 2.0.0 through 2.0.4 Moodle versions 2.1.0 through 2.1.1 Description: The file browser component does not properly restrict access to category and course data, allowing remote attackers to obtain potentially sensitive informati...

PT-2026-88221

In setupLayout of PickActivity.java, there is a possible bypass of the "Install unknown apps" security restriction due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

PT-2026-88173

A missing permission check in Jenkins 2.579 and earlier, LTS 2.568.2 and earlier allows attackers with Item/Read permission on at least one job to read build parameter names and values of jobs they have no access to...

PT-2026-88333

When a Quarkus application has multiple endpoints secured by individual OIDC provider tenants, such as "/oidc-provider1" that is secured by the OIDC Provider 1 and "/oidc-provider2" that is secured by the OIDC Provider 2, and an optional token introspection cache is also enabled, then a valid tok...

PT-2026-67527

Misskey is an open source, federated social media platform. All Misskey servers running versions 2024.5.0 and later, but prior to 2026.5.4, contain a vulnerability in the Server Announcements API where insufficient permission checks allow attackers to access limited portions of data that they...

PT-2026-67334

Name of the Vulnerable Software and Affected Versions Vikunja versions 0.22.0 through 2.3.0 Description Failure to validate the principal type in API token management allows an authenticated attacker to impersonate other users. User IDs and link-share IDs are independent numeric sequences that bo...

PT-2026-67025

The Everest Toolkit WordPress plugin through 1.2.3 does not validate the type of files uploaded during demo-content import the WordPress file-type test is disabled, allowing high-privilege users Administrator by default, including non-super-admin site administrators on multisite to upload...

PT-2026-66332

Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofing via a crafted HTML page. Chromium security severity: Low...

PT-2026-66545

Name of the Vulnerable Software and Affected Versions Leantime version 3.6.2 Description An issue exists where the Laravel VerifyCsrfToken middleware is excluded from the global middleware stack in app/Http/Kernel.php. This allows unauthenticated attackers to perform state-changing actions on...

PT-2026-64991

Name of the Vulnerable Software and Affected Versions VeloCloud Orchestrator VCO on-prem affected versions not specified Description A security issue in the on-premises version of the orchestrator allows a remote attacker to access privileged internal functionality, which may lead to OS command...