PT-2026-28176

Name of the Vulnerable Software and Affected Versions Streamlit versions prior to 1.54.0 Description Streamlit Open Source versions running on Windows hosts are affected by an unauthenticated Server-Side Request Forgery SSRF issue. This arises from insufficient validation of filesystem paths...

PT-2026-23919

A security vulnerability has been detected in code-projects Simple Flight Ticket Booking System 1.0. This impacts an unknown function of the file /Adminadd.php. The manipulation of the argument flightno/airplaneid/departure/dtime/arrival/atime/ec/ep/bc/bp leads to sql injection. Remote exploitati...

PT-2026-20533

FileOptimizer 14.00.2524 contains a denial of service vulnerability that allows attackers to crash the application by manipulating the FileOptimizer32.ini configuration file. Attackers can overwrite the TempDirectory parameter with a 5000-character buffer to cause the application to crash when...

PT-2026-20554

Name of the Vulnerable Software and Affected Versions InvoicePlane versions prior to 1.7.1 Description InvoicePlane is an open source application used for managing invoices, clients, and payments. A Stored Cross-Site Scripting XSS issue exists that allows an authenticated user with the necessary...

PT-2026-7751

Name of the Vulnerable Software and Affected Versions macOS Sequoia versions 15.7.4 macOS Tahoe version 26.3 macOS Sonoma versions 14.8.4 Description A privacy issue existed where an application could potentially access sensitive user data. The issue was resolved with improved checks...

PT-2026-7130

A vulnerability was identified in CCExtractor up to 183. This affects the function parse PAT/parse PMT in the library src/lib ccx/ts tables.c of the component MPEG-TS File Parser. Such manipulation leads to out-of-bounds read. The attack can only be performed from a local environment. The exploit...

PT-2026-6753

Name of the Vulnerable Software and Affected Versions Xerox CentreWare versions through 7.0.6 Description A flaw exists in Xerox CentreWare on Windows that allows for Stored Cross-site Scripting XSS. This issue involves improper neutralization of input during web page generation. The vulnerabilit...

PT-2026-6692

Name of the Vulnerable Software and Affected Versions Code Snippets plugin for WordPress versions up to and including 3.9.4 Description The Code Snippets plugin for WordPress is susceptible to Cross-Site Request Forgery. This is a result of a lack of nonce validation on the cloud snippet download...

PT-2026-1876

Name of the Vulnerable Software and Affected Versions TIM BPM Suite/ TIM FLOW versions through 9.1.2 Description The software contains multiple Hibernate Query Language injection flaws. A user with limited privileges can exploit these to obtain passwords of other users and access sensitive data...

PT-2025-52397

A security vulnerability has been detected in CodeAstro Real Estate Management System 1.0. Affected is an unknown function of the file /admin/userdelete.php of the component Administrator Endpoint. Such manipulation of the argument ID leads to sql injection. The attack may be launched remotely. T...

PT-2025-48465

Name of the Vulnerable Software and Affected Versions Kerlink gateways versions prior to 5.10 Description Kerlink gateways running KerOS prior to version 5.10 expose their web interface exclusively over HTTP, lacking HTTPS support. This absence of transport layer security enables a...

PT-2025-47522

Name of the Vulnerable Software and Affected Versions FileCodeBox versions prior to 2.3 Description A stored cross-site scripting XSS issue exists in the text sharing feature. Insufficient input validation allows attackers to inject arbitrary JavaScript code into shared text "codeboxes". This...

PT-2026-52614

Name of the Vulnerable Software and Affected Versions Flowise versions 3.0.0 through 3.0.7 Description Flowise fails to invalidate existing sessions and session tokens after a user changes their password. This allows an attacker who possesses an active session, such as through a stolen session...

PT-2025-36002

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The Linux kernel contains a flaw in the ALSA subsystem related to USB audio. Specifically, UAC3 power domain descriptors require validation of their bLength variable to prevent...

PT-2025-31834

Name of the Vulnerable Software and Affected Versions Claude Code versions prior to 0.2.111 Description Claude Code is an agentic coding tool affected by a path validation issue. This flaw uses prefix matching instead of canonical path comparison, allowing bypass of directory restrictions and...

PT-2025-27351 · Code Projects · Code-Projects Simple Forum

Name of the Vulnerable Software and Affected Versions: code-projects Simple Forum version 1.0 Description: A critical issue has been found in the processing of the file /forum1.php, allowing unrestricted upload through the manipulation of the File argument. This can be initiated remotely. The...

PT-2025-23108 · Netwrix · Netwrix Directory Manager

Name of the Vulnerable Software and Affected Versions: Netwrix Directory Manager versions 11.0.0.0 and earlier, as well as versions after 11.1.25134.03 Description: The issue is related to a lack of authentication for a critical function. Recommendations: For versions 11.0.0.0 and earlier, as wel...

PT-2024-34196 · Cloudways · Cloudways Breeze

Name of the Vulnerable Software and Affected Versions: Cloudways Breeze versions 2.1.14 and earlier Description: The issue is related to a Missing Authorization vulnerability in Cloudways Breeze, which allows exploitation due to incorrectly configured access control security levels...

PT-2024-38319 · Chargepoint · Chargepoint Home Flex

Name of the Vulnerable Software and Affected Versions: ChargePoint Home Flex affected versions not specified Description: This issue allows network-adjacent attackers to disclose sensitive information on affected installations of ChargePoint Home Flex charging devices. The specific flaw exists...

PT-2024-30600 · WordPress · List Categories

Name of the Vulnerable Software and Affected Versions: List categories plugin for WordPress versions up to, and including, 0.4 Description: The issue arises from insufficient input sanitization and output escaping on user-supplied attributes in the plugin's 'categories' shortcode. This allows...

PT-2024-6108 · Microsoft +1 · Ntasn1.Dll +3

Name of the Vulnerable Software and Affected Versions: CORSAIR iCUE version 5.9.105 Description: The issue is related to insufficient protection of service data due to the loading of dynamic libraries, including MSASN1.dll, NTASN1.dll, and profapi.dll, in the cuepkg-1.2.6 subdirectory of the...

PT-2024-14484 · Monster Insights · Google Analytics

Name of the Vulnerable Software and Affected Versions: Google Analytics by Monster Insights versions 8.21.0 and earlier Description: The issue is related to a Missing Authorization vulnerability. This vulnerability affects the MonsterInsights Google Analytics plugin by Monster Insights...

PT-2024-17728 · WordPress · Essential Addons For Elementor

Name of the Vulnerable Software and Affected Versions: The Essential Addons for Elementor plugin for WordPress versions up to, and including, 5.9.8 Description: The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping, specifically via the...

PT-2024-18503 · Ged · Ged

Name of the Vulnerable Software and Affected Versions: ged affected versions not specified Description: The issue is related to a possible out of bounds write due to an integer overflow in ged. This could lead to local denial of service, with System execution privileges needed. User interaction i...

PT-2023-15605 · Lenovo · Thinkpad X13 Gen3 +1

Name of the Vulnerable Software and Affected Versions: ThinkPad T14s Gen 3 affected versions not specified ThinkPad X13 Gen3 affected versions not specified Description: A vulnerability was reported that could cause the BIOS tamper detection mechanism to not trigger under specific circumstances,...

PT-2023-3288 · Adobe · Substance3D - Designer

Name of the Vulnerable Software and Affected Versions: Adobe Substance 3D Designer versions 12.4.1 and earlier Description: The issue is related to an Access of Uninitialized Pointer vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of th...

PT-2023-17369 · Unknown · Sourcecodester Online Computer/Laptop Store

Name of the Vulnerable Software and Affected Versions: SourceCodester Online Computer and Laptop Store version 1.0 Description: A critical vulnerability was found in the Image Handler component of the affected software, specifically in the /classes/Master.php file, where the path argument is...

PT-2023-1225

Name of the Vulnerable Software and Affected Versions MySQL Server versions 8.0.31 and prior Description The issue is related to insufficient input validation in the Server: Optimizer component of MySQL Server, allowing a high-privileged attacker with network access via multiple protocols to...

PT-2022-17940 · Pax Technology · Paydroid +1

Name of the Vulnerable Software and Affected Versions: PAX A930 device with PayDroid versions 7.1.1 Virgo V04.3.26T1 20210419 through 7.1.1 Virgo V04.4.02 20211201 Description: The issue allows an unauthorized attacker to perform privileged actions through the execution of specific binaries liste...

PT-2022-23571 · Unknown · Ingredients Stock Management System

Name of the Vulnerable Software and Affected Versions: Ingredients Stock Management System version 1.0 Description: The issue is related to a SQL injection vulnerability. This vulnerability can be exploited via the Id parameter at the "/stocks/manage stockout.php" API endpoint. There is no...

PT-2009-5362 · Bingo! · Bingo!Cms

Name of the Vulnerable Software and Affected Versions: bingo!CMS versions 1.2 and earlier Description: A cross-site request forgery issue allows remote attackers to hijack the authentication of other users for requests that modify configuration or change content. Recommendations: For versions 1.2...

PT-2026-114400

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the mac80211 wifi component where the system may attempt to process a WLAN TDLS SETUP CONFIRM without a valid peer station. This leads to a warning during frame...

PT-2026-93316

The FluentBoards WordPress plugin before 2.0.15 does not properly verify that a user holds board-manager privileges before performing several board-management operations, checking only board membership. This allows any member of a board to carry out manager-only actions on it, including adding or...

PT-2026-92392

Concrete CMS 8.5.3 through 9.5.2 enabled the OAuth 2.0 refresh-token grant using the unmodified upstream League grant, which issued new access tokens from a valid refresh token without re-checking the associated account's active status. A user who obtained a refresh token while active could...

PT-2026-87882

Heap-based buffer overflow in Windows Network Connection Broker allows an authorized attacker to elevate privileges locally...

PT-2026-88173

A missing permission check in Jenkins 2.579 and earlier, LTS 2.568.2 and earlier allows attackers with Item/Read permission on at least one job to read build parameter names and values of jobs they have no access to...

PT-2026-67527

Misskey is an open source, federated social media platform. All Misskey servers running versions 2024.5.0 and later, but prior to 2026.5.4, contain a vulnerability in the Server Announcements API where insufficient permission checks allow attackers to access limited portions of data that they...

PT-2026-65573

The SpeedyCache plugin for WordPress is vulnerable to Arbitrary File Read via Path Traversal in all versions up to, and including, 1.3.8. This is due to a mismatch between CSS URL validation which allows query strings like .css?... and path resolution which strips query strings, combined with no...

PT-2026-62026

Name of the Vulnerable Software and Affected Versions libsoup affected versions not specified Description SoupAuthManager caches proxy authentication credentials without scoping them to the proxy authority host:port. If the proxy configuration changes through system settings or Web Proxy...

PT-2026-60879

Name of the Vulnerable Software and Affected Versions IBM Langflow OSS versions 1.0.0 through 1.10.1 Description The software contains hard-coded credentials, such as passwords or cryptographic keys. These credentials are used for inbound authentication, outbound communication with external...

PT-2026-58674

Name of the Vulnerable Software and Affected Versions Devolutions Server version 2026.2.11 Devolutions Server version 2026.1.22 Description Improper authorization in the secure messages deletion endpoint allows an authenticated user to delete messages belonging to other users. This is achieved...

PT-2026-58282

Improper link resolution before file access 'link following' in Window PC Manager allows an authorized attacker to elevate privileges locally...

PT-2026-57111

Name of the Vulnerable Software and Affected Versions Happyforms – Form Builder for WordPress versions prior to 1.26.13 Description The plugin is subject to Local File Inclusion, a condition where an application includes files from the local file system without proper validation. This occurs...

PT-2026-56884

Name of the Vulnerable Software and Affected Versions Open WebUI versions 0.9.0 through 0.9.x Description When Redis is configured, the authentication process for Socket.IO connect, user-join, join-channels, join-note, and the terminal websocket first-message uses the decode token function withou...

PT-2026-56326

The Eventer plugin for WordPress is vulnerable to time-based SQL Injection via the ‘code’ parameter in all versions up to, and including, 4.4.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for...

PT-2026-56178

Name of the Vulnerable Software and Affected Versions Apache Airflow versions prior to 3.3.0 Description The Config API exposes per-key secrets-backend overrides, such as environment variables AIRFLOW SECRETS BACKEND KWARG SECRET ID and AIRFLOW WORKERS SECRETS BACKEND KWARG SECRET ID, as syntheti...

PT-2026-55831

Name of the Vulnerable Software and Affected Versions itsourcecode Hospital Management System version 1.0 Description A SQL injection issue exists in the /paymentdischarge.php endpoint. This occurs when the patientid variable is manipulated, allowing a remote attacker to execute unauthorized...

PT-2026-55438

It was discovered that the nghttp2 nghttpx proxy incorrectly handled HTTP/1.1 Upgrade requests that included a Content-Length header and body. A remote attacker could possibly use this issue to perform HTTP request and response smuggling attacks against backend services...

PT-2026-55052

Name of the Vulnerable Software and Affected Versions WP EasyCart versions prior to 5.9.1 Description An issue exists that allows users with contributor privileges to perform a SQL Injection. SQL Injection is a technique where malicious SQL statements are inserted into entry fields for execution,...

PT-2026-55112

Summary A memory-safety vulnerability in Open Babel's ChemKin parser caused a heap buffer overflow when reading a crafted input file. Details The flaw was in ChemKinFormat::CheckSpecies. A malformed species record caused the parser to write past the end of a heap-allocated buffer. Impact Open Bab...