PT-2026-59309

In mlflow/mlflow versions up to 3.9.0, the SearchModelVersions REST API endpoint and the mlflowSearchModelVersions GraphQL query lack proper per-model authorization checks when basic authentication is enabled. This allows any authenticated user to enumerate all model versions across all registere...

PT-2026-85206

Name of the Vulnerable Software and Affected Versions WHMCS versions 9.0.0 through 9.0.7 WHMCS versions 8.0.0 through 8.13.6 Description An unauthenticated flaw involving the deserialization of untrusted data allows remote attackers to send forged payloads to execute arbitrary code, potentially...

PT-2026-83529

Name of the Vulnerable Software and Affected Versions Coppermine Photo Gallery versions prior to 1.6.29 Description A remote cross site scripting issue exists in the edit profile endpoint within the profile.php file. The flaw allows an attacker to execute malicious scripts by manipulating the...

PT-2020-17369 · Wikimedia +2 · Mediawiki +2

Name of the Vulnerable Software and Affected Versions: MediaWiki versions through 1.35.1 GlobalUsage extension for MediaWiki versions through 1.35.1 Description: An issue was discovered in the GlobalUsage extension for MediaWiki. The SpecialGlobalUsage.php file calls WikiMap::makeForeignLink...

PT-2026-79038

Name of the Vulnerable Software and Affected Versions SourceCodester Simple Online Food Ordering System version 1.0 Description A remote SQL injection exists in the /fos/admin/view order.php endpoint. The issue occurs when the ID argument is manipulated, allowing an attacker to execute arbitrary...

PT-2025-53121

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The Linux kernel contains a flaw within the UDF filesystem implementation. Specifically, a double ‘brelse’ call occurs in the udf rename function. This happens when udf find entry return...

PT-2026-49400

Contributor Privilege Escalation in B Blocks = 2.0.31 versions...

PT-2025-8398 · Linux +1 · Linux Kernel +1

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: A buffer copy overflow issue has been identified in the Linux kernel, specifically in the erofs filesystem. The problem arises when the ztailpacking feature is used, causing a potentia...

PT-2026-67145

A flaw has been found in Wavlink WL-NU516U1 708c073-mt7628. The impacted element is an unknown function of the component Config Import. Executing a manipulation of the argument Password can lead to os command injection. The attack may be launched remotely. This attack is characterized by high...

PT-2024-22693 · Unknown · Qtranslate

Name of the Vulnerable Software and Affected Versions: Translate versions prior to 3.0.0 Description: The issue allows an attacker controlling the second variable of the translate function to perform a cache poisoning attack, changing the outcome of translation requests made by subsequent users...

PT-2024-18731 · Samsung · Galaxy Store

Name of the Vulnerable Software and Affected Versions: Galaxy Store versions prior to 4.5.63.6 Description: The issue allows local attackers to access sensitive information via implicit intent. This is related to an implicit intent hijacking vulnerability in the VoiceSearch component of the Galax...

PT-2023-5241 · 1с · 1С-Битрикс

Name of the Vulnerable Software and Affected Versions: 1С-Битрикс: Управление сайтом affected versions not specified Description: The issue is caused by synchronization errors when using a shared resource in the landing module of the 1С-Битрикс site management system. Exploitation of this issue m...

PT-2026-1014

Name of the Vulnerable Software and Affected Versions code-projects Online Guitar Store version 1.0 Description A SQL injection issue exists in code-projects Online Guitar Store version 1.0. The issue is located in an unknown function within the /admin/Create product.php file. Manipulating the dr...

PT-2025-39361

Name of the Vulnerable Software and Affected Versions H3C Magic B3 versions up to 100R002 Description A flaw exists in H3C Magic B3 that allows for remote buffer overflow. The issue is related to the AddMacList function within the /goform/aspForm file. Manipulation of the param argument can trigg...

PT-2026-78531

Name of the Vulnerable Software and Affected Versions keeper.sh calendar module versions prior to 2.18.14 Description An authenticated attacker can bypass the server-side request forgery SSRF guard to access private network addresses. This is achieved through a DNS rebinding attack targeting the...

PT-2026-64445

Name of the Vulnerable Software and Affected Versions Open Access Management OpenAM versions 13.0.0 through 16.1.1 Description The OAuth2 authorize endpoint's consent page, when using display=wap, reflects request-derived values through ConsentRequiredResource and wap/authorize.ftl without proper...

PT-2025-20373 · WordPress · Nex-Forms

Name of the Vulnerable Software and Affected Versions: NEX-Forms – Ultimate Form Builder – Contact forms and much more plugin for WordPress versions up to, and including, 8.9.1 Description: The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output...

PT-2026-51102

Name of the Vulnerable Software and Affected Versions Langflow versions prior to 1.9.2 Description An issue exists in components based on BaseFileComponent, including Docling DoclingInlineComponent, Docling Serve DoclingRemoteComponent, Read File FileComponent, NVIDIA Retriever Extraction...

PT-2023-12769 · Com.Fasterxml · Java-Merge-Sort

Name of the Vulnerable Software and Affected Versions: com.fasterxml.util:java-merge-sort versions prior to 1.1.0 Description: The issue is related to an Insecure Temporary File in the StdTempFileProvider function, located in StdTempFileProvider.java. This function utilizes the permissive...

PT-2025-26989 · Xuxueli · Xuxueli Xxl-Sso

Name of the Vulnerable Software and Affected Versions: Xuxueli xxl-sso version 1.1.0 Description: A problematic issue was found in the software, affecting the /xxl-sso-server/login file. The manipulation of the errorMsg argument leads to cross-site scripting. The attack can be initiated remotely...

PT-2024-36910

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.6.74 Description A vulnerability in the Linux kernel has been resolved, specifically in the net: ieee802154 module. The issue arises when the ieee802154 create function fails, causing a dangling pointer to rema...

PT-2026-87902

🚨 CVE-2026-72992 Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally. 🎖@cveNotify...

PT-2026-62924

Name of the Vulnerable Software and Affected Versions Oracle iRecruitment versions 12.2.3 through 12.2.15 Description An issue exists in the Internal Operations component of the Oracle iRecruitment product of Oracle E-Business Suite. A high privileged attacker with network access via HTTP can...

PT-2026-57233

An issue in Invixium IXM WEB v.2.3.85.25 allows an attacker to escalate privileges via the /SystemUsers/CreateAppUser components...

PT-2026-35270

A vulnerability was detected in code-projects Employee Management System 1.0. This vulnerability affects unknown code of the file /370project/process/eprocess.php of the component Endpoint. Performing a manipulation of the argument pwd results in sql injection. The attack is possible to be carrie...

PT-2025-34936

Name of the Vulnerable Software and Affected Versions: Hyundai Navigation App version STD5W.EUR.HMC.230516.afa908d Description: An attacker can inject HTML payloads into the profile name field within the navigation application, leading to the rendering of the injected content. Recommendations:...

PT-2023-18660 · Unknown · Ncrafts Formcraft

Name of the Vulnerable Software and Affected Versions: nCrafts FormCraft plugin versions 1.2.6 and earlier Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability. This vulnerability can be exploited by contributors or users with higher authentication levels. The...

PT-2026-45657

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description Memory corruption occurs when shared buffers are accessed without validating concurrent modifications to input from user-mode...

PT-2023-22236 · Zimbra · Zimbra Collaboration

Name of the Vulnerable Software and Affected Versions: Zimbra Collaboration ZCS versions 8.8.15 through 9.0 Description: An issue in Zimbra Collaboration ZCS allows an attacker to execute arbitrary code via the sfdc preauth.jsp component. Recommendations: For versions 8.8.15 and 9.0, consider...

PT-2026-111497

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 158 Firefox ESR versions prior to 153.5 Thunderbird versions prior to 158 Thunderbird versions prior to 153.5 Description An information disclosure issue exists within the Storage: IndexedDB component. IndexedDB is a...

PT-2026-52886

Name of the Vulnerable Software and Affected Versions Envoy versions prior to 1.35.11 Envoy versions prior to 1.36.7 Envoy versions prior to 1.37.3 Envoy versions prior to 1.38.1 Description The OAuth2 HTTP filter uses AES-256-CBC in its encrypt and decrypt functions without an authentication tag...

PT-2025-36245

Name of the Vulnerable Software and Affected Versions: Easy Flash Embed versions through 1.0 Description: The software contains a cross-site scripting XSS issue due to improper neutralization of input during web page generation. This allows for stored XSS attacks. Recommendations: At the moment,...

PT-2019-13579 · Axway · Axway Securetransport

Name of the Vulnerable Software and Affected Versions: Axway SecureTransport versions 5.x through 5.3 Axway SecureTransport versions 5.x through 5.5 with certain API configuration Description: The issue concerns unauthenticated blind XML injection and XXE in the resetPassword functionality via th...

PT-2026-79413

Name of the Vulnerable Software and Affected Versions Omnigent versions prior to 0.3.0 Description The shared shell-command parser in omnigent/policies/builtins/ shell.py fails to recognize combined interpreter flags, command substitutions, a single background control operator, and wrappers such ...

PT-2026-79370

Name of the Vulnerable Software and Affected Versions Passster WordPress plugin versions prior to 4.3.9 Description The plugin fails to correctly match its public endpoint paths when determining which REST API requests should bypass global password protection. This occurs because the system...

PT-2026-45751

A stack-based buffer overflow in the export language.cgi binary in VIVOTEK FD8136 firmware FD8136-VVTK-0300a allows authenticated remote attackers to execute arbitrary code as root via a crafted POST request to the /cgi-bin/admin/export language.cgi endpoint. The handler passes the...

PT-2025-35261

Name of the Vulnerable Software and Affected Versions: QuRouter version 2.5.1 Description: A command injection vulnerability exists in QuRouter. A remote attacker gaining administrator account access can exploit this issue to execute arbitrary commands. Recommendations: Update to QuRouter version...

PT-2024-19994 · Geoserver · Geoserver

Name of the Vulnerable Software and Affected Versions: GeoServer versions prior to 2.23.2 and 2.24.1 Description: A stored cross-site scripting XSS issue exists that enables an authenticated administrator with workspace-level privileges to store a JavaScript payload in the GeoServer catalog. This...

PT-2026-23822

Name of the Vulnerable Software and Affected Versions hoppscotch versions prior to 2026.2.1 Description hoppscotch is an API development ecosystem. Prior to version 2026.2.1, the DELETE ''/v1/access-tokens/revoke'' endpoint allows any authenticated user to delete any other user's Personal Access...

PT-2024-39154 · Mercury · Mercury Mnvr816

Name of the Vulnerable Software and Affected Versions: Mercury MNVR816 versions up to 2.0.1.0.5 Description: A vulnerability has been found that allows for files or directories to be made accessible. The issue affects an unknown part of the file /web-static/. It is possible to initiate the attack...

PT-2026-46985

Name of the Vulnerable Software and Affected Versions vantage6 versions prior to 5.0.0 Description Users can reset their Multi-Factor Authentication MFA token through API routes that trigger email notifications. Because there is no limit on the number of emails that can be sent, an attacker could...

PT-2026-56834

PayRange Android app, version 7.0.7 and below, contains an SSL bypass vulnerability that allows invalid certificates to be accepted in application webviews. A remote and unauthenticated attacker can steal information that the user sends...

PT-2023-18600 · Suse · Suse Manager Server Module +1

Name of the Vulnerable Software and Affected Versions: SUSE Manager Server Module 4.2 versions prior to 4.2.50-150300.3.66.5 SUSE Manager Server Module 4.3 versions prior to 4.3.58-150400.3.46.4 NeuVector affected versions not specified Description: A user can reverse engineer the JSON Web Token...

PT-2026-65921

Name of the Vulnerable Software and Affected Versions Sourcecodester CASAP Automated Enrollment System version 1.0 Description An issue exists in the 'update student.php' endpoint where improper handling of the fname and student class parameters allows for SQL Injection. SQL Injection is a...

PT-2026-54432

Name of the Vulnerable Software and Affected Versions Storage Concentrator SC & SCVM affected versions not specified Description Storage Concentrator SC & SCVM contains hardcoded credentials for various internal services within a configuration file. Although these credentials use encoding, the...

PT-2026-58865

An authentication bypass vulnerability exists in certain releases of Ciena Navigator Network Control Suite NCS, Manage Control Plan MCP, and Blue Planet products. The issue is caused by improper handling of HTTP request paths and headers, which allows an unauthenticated attacker to manipulate...

PT-2026-53218

A vulnerability was detected in Documenso up to 2.11.0. Affected by this vulnerability is an unknown functionality of the file packages/auth/server/lib/utils/handle-oauth-callback-url.ts of the component Google OAuth Login. The manipulation results in improper authentication. It is possible to...

PT-2026-21979

Name of the Vulnerable Software and Affected Versions Kruise versions prior to 1.8.3 Kruise versions prior to 1.7.5 Description Kruise allows automated management of applications on Kubernetes. A flaw exists in the PodProbeMarker functionality where the webhook validation does not restrict the...

PT-2026-85470

A Path Traversal vulnerability in the builder endpoint in Google Cloud Agent Development Kit ADK versions 1.9.0 through 1.21.0 on Python allows an unauthenticated remote attacker to read arbitrary files using a crafted file path query parameter...

PT-2026-49301

Name of the Vulnerable Software and Affected Versions Kandji Agent versions prior to 4.7.55374 Description A client validation gap in the software allows a local attacker to escalate privileges and invoke restricted agent functionality. Recommendations Update to version 4.7.55374 or later...