PT-2026-5120

The Passster – Password Protect Pages and Content plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'content protector' shortcode in all versions up to, and including, 4.2.24. This makes it possible for authenticated attackers, with Contributor-level access and...

PT-2026-4679

A security vulnerability has been detected in Beetel 777VR1 up to 01.00.09/01.00.09 55. This issue affects some unknown processing of the component UART Interface. The manipulation leads to improper restriction of excessive authentication attempts. It is possible to launch the attack on the...

PT-2026-3906

Name of the Vulnerable Software and Affected Versions Grist versions prior to 1.7.9 Description Grist is spreadsheet software that utilizes Python as its formula language. When configured to run formulas in the Pyodide sandbox GRIST SANDBOX FLAVOR set to pyodide, a crafted spreadsheet formula can...

PT-2026-4329

Name of the Vulnerable Software and Affected Versions HPE Alletra 6000/5000 and Nimble Storage versions prior to 6.1.2.800 HPE Alletra 6000/5000 and Nimble Storage versions prior to 6.1.3.300 Description A privilege escalation flaw exists in HPE Alletra 6000/5000 and Nimble Storage arrays. An...

PT-2026-2178

Name of the Vulnerable Software and Affected Versions Open eClass versions prior to 4.2 Description The Open eClass platform, previously known as GUnet eClass, is a course management system. Prior to version 4.2, a flaw exists in the theme import functionality that allows an attacker with...

PT-2026-1007

Name of the Vulnerable Software and Affected Versions PHPEMS versions up to 11.0 Description A cross-site request forgery condition exists in PHPEMS. The issue is triggered by manipulation of an unknown function and can be exploited remotely. Recommendations Versions prior to 11.0 should be updat...

PT-2025-52212

Name of the Vulnerable Software and Affected Versions Bitrix24 versions prior to 25.100.301 Description Remote Code Execution is possible because an actor with SOURCE/WRITE permissions for the Translate Module can upload and execute code by sending a PHP file and a .htaccess file. The supplier...

PT-2025-51217

Name of the Vulnerable Software and Affected Versions Wekan versions prior to 18.16 Description An issue exists in Wekan, an open-source kanban board system, where uploaded attachments can be served with a Content-Type controlled by an attacker specifically, text/html. This allows for the executi...

PT-2026-42467

Name of the Vulnerable Software and Affected Versions Trend Micro Apex One/SEP agent affected versions not specified Description An origin validation error in the agent's named pipe communication mechanism allows a local attacker to escalate privileges. To exploit this issue, the attacker must...

PT-2025-43375

Name of the Vulnerable Software and Affected Versions TOTOLINK N600R version 4.3.0cu.7866 B20220506 Description The TOTOLINK N600R device contains a stack overflow in the ssid parameter within the setWiFiBasicConfig function. This issue allows attackers to cause a Denial of Service DoS by providi...

PT-2024-35863 · Unknown · Cultbooking Hotel Booking Engine

Name of the Vulnerable Software and Affected Versions: CultBooking Hotel Booking Engine versions n/a through 2.1 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS in the CultBooking Hotel Booking Engine. This means an attacker can perform unauthorize...

PT-2024-40380 · Softwarex · Softwarex

Name of the Vulnerable Software and Affected Versions: SoftwareX versions prior to 3.1.14 Description: The issue arises during installation, where certain parameters admin username and admin password are not properly escaped in the setup form. Recommendations: For versions prior to 3.1.14, update...

PT-2024-6814 · Google +4 · Google Chrome +4

Name of the Vulnerable Software and Affected Versions: Google Chrome versions prior to 129.0.6668.58 Microsoft Edge affected versions not specified Description: The issue is related to an inappropriate implementation in the Autofill feature, allowing a remote attacker to perform UI spoofing via a...

PT-2024-21732 · WordPress · Postmash

Name of the Vulnerable Software and Affected Versions: postMash – custom post order versions 1.2.0 and earlier Description: The issue is a Cross Site Scripting XSS vulnerability, specifically a Reflected XSS, in the postMash – custom post order plugin. This type of vulnerability allows an attacke...

PT-2023-23939 · Cyberpower · Cyberpower Powerpanel Enterprise

Name of the Vulnerable Software and Affected Versions: CyberPower PowerPanel Enterprise affected versions not specified Description: A non-feature complete authentication mechanism exists in the production application, allowing an attacker to bypass all authentication checks if LDAP authenticatio...

PT-2022-28146 · Unknown · Kbase Metrics

Name of the Vulnerable Software and Affected Versions: KBase Metrics affected versions not specified Description: A critical issue was found in KBase Metrics, affecting the upload user data function of the file source/daily cron jobs/methods upload user stats.py. This issue leads to sql injection...

PT-2022-11698 · Freepbx · Freepbx

Name of the Vulnerable Software and Affected Versions: FreePBX versions prior to 14.0.6.25 Description: A vulnerability was found in FreePBX voicemail, affecting an unknown functionality of the file page.voicemail.php. The manipulation leads to cross site scripting. The attack can be launched...

PT-2022-24428 · Lief · Lief

Name of the Vulnerable Software and Affected Versions: LIEF version 365a16a Description: A reachable assertion abort was discovered in the BinaryStream.hpp component. Recommendations: For LIEF version 365a16a, consider disabling the use of the BinaryStream.hpp component until a patch is available...

PT-2026-88771

Tanium addressed a path traversal vulnerability in Comply...

PT-2026-86393

Name of the Vulnerable Software and Affected Versions Rowboat versions prior to 0.9.2 Description Authenticated users can configure arbitrary destinations because the software fails to validate custom MCP server and webhook URLs. This allows attackers to point these URLs at internal services and...

PT-2026-85102

A critical security vulnerability was found in the LiteSpeed Cache plugin for WordPress, and you really need to patch it right now. This flaw, tracked as CVE-2026-84761 with a high severity rating of 7.2, lets unauthenticated hackers pull off Server-Side Request Forgery attacks. Basically, anyone...

PT-2026-84295

Use of Hard-coded Credentials vulnerability in TMT Machine Industry and Trade Ltd. Co. Talassoft Industrial Management Software allows Retrieve Embedded Sensitive Data. This issue affects Talassoft Industrial Management Software: from V.4 before V.16...

PT-2026-81578

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 152.0.7977.65 Description Missing authorization in the BFCache Back-Forward Cache, a browser feature that stores a complete page in memory to allow instant loading when navigating back or forward allows a remote...

PT-2026-77895

Name of the Vulnerable Software and Affected Versions Oracle Hyperion Data Relationship Management version 11.2.25.0.000 Description An issue exists in the Access and security component that allows a low privileged attacker with access to the infrastructure where the software executes to compromi...

PT-2026-73006

In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix out-of-bounds clear bit in ath12k mac dp peer cleanup ath12k mac dp peer cleanup clears the ML peer ID slot on the free ml peer id map bitmap by indexing it with dp peer-peer id. That is wrong: dp peer-peer id f...

PT-2026-72713

In the Linux kernel, the following vulnerability has been resolved: iommu/dma-iommu: Fix wrong scatterlist length assignment in P2PDMA path In iommu dma map sg, when handling PCI P2PDMA cases, the DMA length of the current scatterlist segment s is incorrectly assigned from the head entry sg-lengt...

PT-2026-72718

In the Linux kernel, the following vulnerability has been resolved: tipc: prevent snt unacked underflow on CONN ACK tipc sk conn proto rcv subtracts the peer-supplied connection ack count from the unsigned 16-bit send counter snt unacked without checking that it does not exceed the number of...

PT-2026-72796

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject exclusive maps for bpf map elem iterators Exclusive maps aka excl prog hash are meant to be reachable only from the single program whose hash matches. This is enforced by check map prog compatibility when the map is...

PT-2026-72683

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the RDMA/bnxt re component where applications can request multiple Work Completion WC pages for the same ucontext, although only one WC page per ucontext is supported...

PT-2026-67003

Name of the Vulnerable Software and Affected Versions affected versions not specified Description The DHCPv4 client helper function net dhcpv4 msg type name in subsys/net/lib/dhcpv4/dhcpv4.c contains a faulty bounds check when indexing a static 8-element name table. The check incorrectly uses...

PT-2026-64872

Name of the Vulnerable Software and Affected Versions containerized-data-importer affected versions not specified Description The aggregated cdi.kubevirt.io:view ClusterRole, designed for read-only access to resources, incorrectly grants create permissions on the datavolumes/source subresource. T...

PT-2026-65095

Name of the Vulnerable Software and Affected Versions Ekushey Project Manager CRM versions prior to 5.1 Description A stored cross-site scripting issue exists where authenticated client users can inject arbitrary HTML and JavaScript. This occurs when malicious payloads are entered into the Reply...

PT-2026-64637

Name of the Vulnerable Software and Affected Versions Linux kernel version 6.12.58 Description A NULL pointer dereference occurs in the lookup swap cgroup id function on hosts without swap enabled. The function passes swap cgroup ctrltype.map to swap cgroup id lookup without verifying if the type...

PT-2026-63838

Unauthenticated Cross Site Scripting XSS in Grand Photography = 5.7.8 versions...

PT-2026-60627

OpenClaw 2026.5.14-beta.1 before 2026.5.27 contain an authorization flaw in the QQBot exec approvals feature. When the feature is enabled and reachable, a lower-trust caller or configured input path could execute or persist actions beyond the caller's intended authorization, allowing...

PT-2026-60720

The NEX-Forms WordPress plugin before 9.2.3 does not sanitise and escape some submitted form data before storing it and outputting it back in the admin dashboard, leading to a Stored Cross-Site Scripting vulnerability which could allow unauthenticated users to perform Stored Cross-Site Scripting...

PT-2026-58873

Name of the Vulnerable Software and Affected Versions ASUS System Control Interface driver versions 3.0.x ASUS Business Manager affected versions not specified Description The ASUS System Control Interface driver and ASUS Business Manager contain issues related to the allocation of resources...

PT-2026-60205

Metabase is an open-source business intelligence and embedded analytics tool. From 1.54.0 until 1.54.24, 1.55.24, 1.56.25, 1.57.19, 1.58.14, 1.59.10, and 1.60.4, a Metabase user with permission to add or edit a database connection can achieve remote code execution on the Metabase server by...

PT-2026-60361

Name of the Vulnerable Software and Affected Versions dd-trace versions prior to 5.100.0 Description An issue exists in the W3C baggage propagation within packages/dd-trace/src/baggage.js and packages/dd-trace/src/opentracing/propagation/text map.js where incoming baggage HTTP headers are parsed...

PT-2026-60187

When NGINX Plus is configured to use the Message Queuing Telemetry Transport MQTT filter module ngx stream mqtt filter module, unauthenticated attackers can send requests with conditions beyond the attacker's control to cause a heap buffer over-read in the NGINX worker process, leading to a...

PT-2026-60014

A vulnerability was identified in ByteDance verl up to 0.7.1. Affected is the function math equal of the file prime math/grader.py. The manipulation leads to a sandbox issue. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is told to ...

PT-2026-60021

Summary A Server Side Request Forgery SSRF vulnerability in download bytes from url allows any actor who can control batch input JSON to make the vLLM batch runner issue arbitrary HTTP/HTTPS requests from the server, without any URL validation or domain restrictions. This can be used to target...

PT-2026-60028

Applications using Werkzeug to parse multipart/form-data requests are vulnerable to resource exhaustion. A specially crafted form body can bypass the Request.max form memory size setting. The Request.max content length setting, as well as resource limits provided by deployment software and...

PT-2026-57547

Capgo before 12.128.2 contains an information disclosure vulnerability in the Supabase PostgREST global stats endpoint that allows unauthenticated attackers to read sensitive financial and operational metrics using only the public apikey. Remote attackers can query the /rest/v1/global stats...

PT-2026-57425

Name of the Vulnerable Software and Affected Versions RSFiles versions prior to 1.17.12 Description The RSFiles Joomla extension contains a flaw allowing unauthenticated arbitrary file upload. This issue occurs due to a split-controller upload bypass and a direct write task, enabling attackers to...

PT-2026-57154

Dell Unisphere for PowerMax, versions 10.3.0.5 and prior, contains a path traversal vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability to read arbitrary files...

PT-2026-56726

A Missing Authentication vulnerability was discovered in the SSH keys synchronization endpoint. An unauthenticated attacker can send a request to the SSH keys synchronization endpoint and obtain the list of users that have uploaded their public SSH keys, their groups, and the uploaded public SSH...

PT-2026-56184

Improper neutralization of special elements used in an LDAP query 'LDAP injection' vulnerability in HAVELSAN Inc. Liman MYS allows LDAP Injection. This issue affects Liman MYS: before release.Master.1107...

PT-2026-55626

Name of the Vulnerable Software and Affected Versions Microsoft Edge Chromium-based affected versions not specified Description A use after free issue exists that allows an unauthorized attacker to execute arbitrary code over a network. Use after free is a memory corruption flaw that occurs when ...

PT-2026-54872

GeoWebPlayer also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud is an addon that can be installed with various GeoVision software GV-VMS, GV-Cloud, .... It creates a websocket server that expands the capabilities of the various web-interfaces provided by the...