PT-2025-18134 · Unknown · Libsnowflakeclient

Name of the Vulnerable Software and Affected Versions: libsnowflakeclient versions 0.5.0 through 2.2.0 Description: The issue concerns the Snowflake Connector for C/C++, which incorrectly treats malformed requests that cause the HTTP response status code 400 as able to be retried. This could hang...

PT-2025-17030 · WordPress · Autoglot – Automatic Wordpress Translation

Name of the Vulnerable Software and Affected Versions: Autoglot – Automatic WordPress Translation versions n/a through 2.4.7 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This allows for Reflected XSS in...

PT-2025-23501 · Froxlor · Froxlor

Name of the Vulnerable Software and Affected Versions: Froxlor versions prior to 2.2.6 Description: The issue is an HTML Injection vulnerability in the customer account portal, allowing an attacker to inject malicious HTML payloads in the email section. This can lead to phishing attacks, credenti...

PT-2025-2983 · Rezgo · Rezgo

Name of the Vulnerable Software and Affected Versions: Rezgo versions n/a through 4.15 Description: The issue is related to improper control of filename for Include/Require Statement in PHP Program, also known as 'PHP Remote File Inclusion' or 'PHP Local File Inclusion'. This problem allows the...

PT-2024-8731 · Siemens · Scalance Wam766-1 +14

Name of the Vulnerable Software and Affected Versions: RUGGEDCOM RM1224 LTE4G EU versions prior to V8.2 RUGGEDCOM RM1224 LTE4G NAM versions prior to V8.2 SCALANCE M804PB versions prior to V8.2 SCALANCE M812-1 ADSL-Router versions prior to V8.2 SCALANCE M816-1 ADSL-Router versions prior to V8.2...

PT-2024-15734

Name of the Vulnerable Software and Affected Versions Plone CMS versions prior to 6.0.5 Description A Cross-Frame Scripting issue has been found in Plone CMS. This issue allows an attacker to store a malicious URL that can be opened by an administrator, potentially leading to the execution of a...

PT-2023-31302 · WordPress · Pubydoc Wordpress Plugin

Name of the Vulnerable Software and Affected Versions: PubyDoc WordPress plugin versions 2.0.6 and earlier Description: The issue allows high privilege users, such as admins, to perform Cross-Site Scripting attacks. This is possible because the plugin does not properly sanitise and escape some of...

PT-2023-12631 · Sourcecodester · Sourcecodester Royale Event Management System

Name of the Vulnerable Software and Affected Versions: SourceCodester Royale Event Management System version 1.0 Description: A critical issue affects the processing of the file /royal event/userregister.php, leading to improper authentication. The attack can be initiated remotely. Recommendation...

PT-2022-10578 · Thimpress · Thimpress Wp Hotel Booking

Name of the Vulnerable Software and Affected Versions: ThimPress WP Hotel Booking plugin versions = 1.10.5 Description: A Cross-Site Request Forgery CSRF issue exists, which is a type of attack that tricks a user into performing unintended actions on a web application. This occurs because the...

PT-2025-8631

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A vulnerability in the Linux kernel has been resolved. The issue was related to the use of prandom instead of get random u32 in the netfilter component. This could potentially lead to a...

PT-2020-15021 · Powerdns +4 · Powerdns Authoritative Server +4

Name of the Vulnerable Software and Affected Versions: PowerDNS Authoritative Server versions prior to 4.3.1 Description: An issue has been found where an authorized user with the ability to insert crafted records into a zone might be able to leak the content of uninitialized memory...

PT-2020-12538 · Facebook · Osquery

Name of the Vulnerable Software and Affected Versions: osquery versions prior to 4.4.0 Description: The issue allows for a privilege escalation. If a Windows system has a PATH containing a user-writable directory, a local user can create a zlib1.dll DLL that osquery will attempt to load, enabling...

PT-2026-92059

crawl4ai before 0.9.3 contains an arbitrary file write vulnerability in PDFContentScrapingStrategy where the filter untrusted fields function fails to validate untrusted configuration fields. Attackers can submit crafted config bodies with malicious image save dir paths to write attacker-controll...

PT-2026-92961

Name of the Vulnerable Software and Affected Versions Oracle Hyperion Data Relationship Management version 11.2.26.0.000 Description An issue exists in the Access and security component that allows an unauthenticated attacker with network access via SOAP to compromise the system. Successful...

PT-2026-88221

Name of the Vulnerable Software and Affected Versions Android affected versions not specified Description A confused deputy issue exists in the setupLayout function within PickActivity.java. This flaw allows a bypass of the "Install unknown apps" security restriction, potentially leading to local...

PT-2026-88433

The Okta Verify for Windows uninstaller does not verify whether the user data directory is a filesystem junction before deleting its contents with elevated privileges. The delete operation follows the junction target, resulting in recursive deletion of unintended directory contents...

PT-2026-86785

A weakness has been identified in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. This affects an unknown part of the file App/Home/Model/UserModel.class.php of the component Cookie Helper. Executing a manipulation of the argument Username can lead...

PT-2026-86388

Coolify through 4.3.17 contains an authentication bypass vulnerability in the OAuth callback handler that signs users into existing accounts based solely on email address without verifying provider assertions or binding OAuth identities. Attackers can register a victim's email address on any...

PT-2026-81256

Name of the Vulnerable Software and Affected Versions Apache Hive versions prior to 4.2.1 Description An authenticated remote attacker with CREATE TABLE privileges can execute a Server-Side Request Forgery SSRF during Avro SerDe schema resolution. By setting the avro.schema.url table property on ...

PT-2026-70089

Name of the Vulnerable Software and Affected Versions JBoss marshalling affected versions not specified Description A flaw exists in the Infinispan session replication path where replicated session data is deserialized using the JBoss Marshalling River unmarshaller without class filtering. This...

PT-2026-67025

Name of the Vulnerable Software and Affected Versions Everest Toolkit versions prior to 1.2.4 Description Insufficient validation of uploaded file types occurs during the demo-content import process because the WordPress file-type test is disabled. This allows high-privilege users, such as...

PT-2026-64065

These are all security issues fixed in the prometheus-ha cluster exporter-1.4.2-1.1 package on the GA media of openSUSE Tumbleweed...

PT-2026-62073

Name of the Vulnerable Software and Affected Versions bytebot-ai affected versions not specified Description An issue allows attackers to execute arbitrary code by providing a crafted path to the computer write file function. Recommendations At the moment, there is no information about a newer...

PT-2026-61555

Name of the Vulnerable Software and Affected Versions SurrealDB versions prior to 3.1.5 Description An arbitrary file read issue exists in the DEFINE ANALYZER mapper filter. Database users with EDITOR or OWNER roles can read files accessible to the SurrealDB process by specifying arbitrary file...

PT-2026-58388

Name of the Vulnerable Software and Affected Versions Windows Overlay Filter affected versions not specified Description An issue in the Windows Overlay Filter allows an authorized local attacker to disclose sensitive information. This flaw enables local users to access data that should be...

PT-2026-56664

Name of the Vulnerable Software and Affected Versions Drupal UI Patterns SDC in Drupal UI versions 2.0.0 through 2.0.17 Description An issue exists where the module does not sufficiently sanitize markup passed to components in certain scenarios, leading to Stored Cross-site Scripting XSS...

PT-2026-55793

Name of the Vulnerable Software and Affected Versions AIAnytime Awesome-MCP-Server versions up to a884bb51bcd99e08e14fd712c749d55d9d9a13ab Description A flaw in the mcp-wiki/wiki-summary component, specifically within the mcp-wiki/src/mcp wiki/server.py file, allows for server-side request forger...

PT-2026-55444

Name of the Vulnerable Software and Affected Versions AR for WordPress versions prior to 8.41 Description An unauthenticated directory traversal flaw exists in the file handling logic of the plugin. The issue occurs when the public AJAX functionality accepts a user-controlled file parameter witho...

PT-2026-54913

Name of the Vulnerable Software and Affected Versions Horde IMP versions prior to 7.0.1 Description A path traversal issue exists in the lib/Compose.php file. Authenticated attackers can read arbitrary files from the server filesystem by embedding traversal sequences after a CKEditor path prefix ...

PT-2026-53645

A heap-based buffer overflow exists in the qr reader match centers function of ZBar 0.23.90. Specially crafted QR codes may lead to information disclosure and/or arbitrary code execution. To trigger this vulnerability, an attacker can digitally input the malicious QR code, or prepare it to be...

PT-2026-52653

Name of the Vulnerable Software and Affected Versions Lemur affected versions not specified Description An authenticated user with the operator role can induce the server to make unauthorized outbound requests to internal network resources. This occurs because the software extracts CRL Distributi...

PT-2026-51536

Name of the Vulnerable Software and Affected Versions Control Builder A versions prior to 1.4/4 800xA for Advant Master versions prior to 6.0.3-1 800xA for Advant Master versions prior to 6.1.1-1 800xA for Advant Master version 6.1.1-3 800xA for Advant Master version 6.2.0-1 Description An...

PT-2026-50989

Name of the Vulnerable Software and Affected Versions Joomla! Component VMap version 1.9.6 Description An SQL injection allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code into the latlngbound parameter. This is achieved by sending GET requests to the...

PT-2026-51031

Name of the Vulnerable Software and Affected Versions Azure Active Directory affected versions not specified Description Improper authentication allows an unauthorized attacker to elevate privileges over a network. Recommendations At the moment, there is no information about a newer version that...

PT-2026-50912

Name of the Vulnerable Software and Affected Versions AnyDesk version 2.5.0 Description An unquoted service path issue exists in the service installation, allowing local users to execute arbitrary code with SYSTEM privileges. This occurs when a service path contains spaces and is not enclosed in...

PT-2026-50942

Name of the Vulnerable Software and Affected Versions Joomla! Component Flip Wall version 8.0 Description An SQL injection allows unauthenticated attackers to execute arbitrary SQL queries. This is achieved by injecting malicious code through the wallid parameter via GET requests to the 'index.ph...

PT-2026-50229

Name of the Vulnerable Software and Affected Versions Android versions prior to June 2026 Description A logic error in the setAllowedCarriers function within PhoneInterfaceManager.java allows for the disabling of carrier restrictions. This flaw can lead to local escalation of privilege without...

PT-2026-50038

Name of the Vulnerable Software and Affected Versions Oracle Complex Maintenance, Repair and Overhaul versions 12.2.3 through 12.2.15 Description An issue exists in the Internal Operations component of the Oracle Complex Maintenance, Repair and Overhaul product of Oracle E-Business Suite. A low...

PT-2026-50144

Name of the Vulnerable Software and Affected Versions vLLM versions 0.3.0 through 0.21.0 Description An authentication bypass exists in the OpenAI API AuthenticationMiddleware due to improper trust in the reconstructed URL path from the ASGI scope. The url path is derived from a URL object...

PT-2026-49247

Name of the Vulnerable Software and Affected Versions Angular versions prior to 22.0.1 Angular versions prior to 21.2.17 Angular versions prior to 20.3.25 Description Angular supports Hydration via provideClientHydration to optimize client-side bootstrap in Server-Side Rendered SSR environments...

PT-2026-49097

Name of the Vulnerable Software and Affected Versions Koha Community Koha versions 22.11.0 through 22.11.37 Koha Community Koha versions 23.x Koha Community Koha versions 24.0 through 24.11.15 Koha Community Koha versions 25.05.0 through 25.05.10 Koha Community Koha versions 25.11.0 through...

PT-2026-48619

Name of the Vulnerable Software and Affected Versions Spring Web Services versions 5.0.0 through 5.0.1 Spring Web Services versions 4.1.0 through 4.1.3 Spring Web Services versions 4.0.0 through 4.0.18 Spring Web Services versions 3.1.0 through 3.1.8 Description Wss4jSecurityInterceptor sets the...

PT-2026-48384

A vulnerability has been found in some Dahua products could allow an authenticated remote attacker to send a specially crafted packet, triggering an exception that causes the system to reboot unexpectedly, resulting in a denial of service...

PT-2026-48481

Name of the Vulnerable Software and Affected Versions Nezha Monitoring versions 1.0.0 through 2.0.13 Description A cross-site request forgery CSRF issue exists where a cross-site GET request can trigger stored cron commands on a victim's agents. The dashboard exposes a manual-trigger action via t...

PT-2026-46232

Name of the Vulnerable Software and Affected Versions Langflow versions prior to 1.9.2 Description The Shareable Playground also known as Public Flows feature allows unauthenticated users to execute workflows via a link. A flaw in the '/api/v1/build public tmp' endpoint enables attackers to execu...

PT-2026-46890

Name of the Vulnerable Software and Affected Versions Shopware versions prior to 6.6.10.18 Shopware versions prior to 6.7.10.1 Description A vertical authorization bypass exists in the Admin API affecting order state transition features. The issue occurs because certain routes in...

PT-2026-45443

Tychon includes an OpenSSL component that specifies an OPENSSLDIR variable as a subdirectory that may be controllable by an unprivileged user on Windows. Tychon contains a privileged service that uses this OpenSSL component. A user who can place a specially-crafted openssl.cnf file at an...

PT-2026-45502

A weakness has been identified in Enderfga claw-orchestrator up to 3.5.5. This affects the function EmbeddedServer of the file src/embedded-server.ts of the component API Endpoint. This manipulation causes missing authentication. The attack may be initiated remotely. The exploit has been made...

PT-2026-45452

FlexRIC v2.0.0 uses hardcoded assertions to validate Information Element IE counts in decoded E2AP messages. A remote unauthenticated attacker can send a valid E2AP PDU containing an unexpected number of IEs e.g., an E2setupRequest with extra optional fields to crash the near-RT RIC port 36421 or...

PT-2026-45422

A vulnerability was detected in CodeAstro Online Job Portal 1.0. The impacted element is an unknown function of the file /admin/jobs-admins/delete-jobs.php. Performing a manipulation of the argument ID results in sql injection. It is possible to initiate the attack remotely. The exploit is now...