PT-2024-17691 · Unknown · Codeastro University Management System

Name of the Vulnerable Software and Affected Versions: CodeAstro University Management System version 1.0 Description: A problematic vulnerability has been found in the Attendance Management component, specifically in the file /att add.php. The manipulation of the Student Name argument leads to...

PT-2023-30291 · Radare2 +1 · Radare2 +1

Name of the Vulnerable Software and Affected Versions: radare2 version 5.8.9 Description: The issue is an out-of-bounds read in the r bin object set items function located in libr/bin/bobj.c, which causes a crash in the r read le32 function in libr/include/r endian.h. Recommendations: For radare2...

PT-2023-7288 · Unknown · Weston Embedded Uc-Http

Name of the Vulnerable Software and Affected Versions: Weston Embedded uC-HTTP version 3.01.01 Description: A memory corruption issue exists in the HTTP Server header parsing functionality. This can be exploited by sending specially crafted network packets, potentially leading to code execution. ...

PT-2023-25829 · WordPress · Upload Media By Url

Name of the Vulnerable Software and Affected Versions: Upload Media By URL WordPress plugin versions prior to 1.0.8 Description: The issue is related to the lack of a CSRF check when uploading files, which could allow attackers to make logged-in admins upload files on their behalf, including HTML...

PT-2025-18858

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A race condition in the Linux kernel's serial driver, specifically in the fsl lpuart component, can lead to a NULL pointer dereference when the DMA completion interrupt occurs during DMA...

PT-2020-7489 · Red Hat · Red Hat Openshift

Name of the Vulnerable Software and Affected Versions: Red Hat Openshift 1 affected versions not specified Description: The deployment script in the unsupported "OpenShift Extras" set of add-on scripts installs a default public key in the root user's authorized keys file. Recommendations: At the...

PT-2019-15210 · Dolibarr · Dolibarr

Name of the Vulnerable Software and Affected Versions: Dolibarr version 10.0.2 Description: The issue is related to a security problem where an attacker can inject malicious code. This is possible through the 'outgoing email setup' feature, specifically in the admin/mails.php?action=edit URI, by...

PT-2004-1773 · Kde · Kde

Name of the Vulnerable Software and Affected Versions: KDE versions prior to 3.3.0 Description: The issue arises from improper handling of certain symbolic links that point to 'stale' locations. This could allow local users to create or truncate arbitrary files. Recommendations: For versions prio...

PT-2026-92854

Name of the Vulnerable Software and Affected Versions Oracle E-Business Suite Oracle Applications Framework versions 12.2.9 through 12.2.15 Description A flaw in the Personalization component of the Oracle Applications Framework allows a low privileged attacker with network access via HTTP to...

PT-2026-88523

Name of the Vulnerable Software and Affected Versions OpenIDC/cjose versions prior to 0.6.2.5 Description The JWE decryption path for AES Key Wrap key-management algorithms alg = A128KW, A192KW, A256KW fails to validate the length of the encrypted key before unwrapping it into a fixed-size,...

PT-2026-84920

Dell PowerProtect Data Manager, versions 20.2.0.0 and below, contain a Reliance on Data/Memory Layout vulnerability. An unauthenticated remote attacker could potentially exploit this vulnerability, leading to Launch of phishing attacks...

PT-2026-84388

Name of the Vulnerable Software and Affected Versions Elasticsearch affected versions not specified Description Deserialization of untrusted data in the machine learning component allows remote code execution through object injection. An attacker can use a specially crafted trained model artifact...

PT-2026-84182

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 155 Firefox ESR versions prior to 153.2 Thunderbird versions prior to 155 Thunderbird versions prior to 153.2 Description A site isolation issue exists within the DOM Navigation component. Site isolation is a security...

PT-2026-83941

MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate endpoints with flexible routing strategies. Prior to version 0.12.13, MCPB File Upload Handler extracts a ZIP file and reads manifest.json from it. The name field in the manifest i...

PT-2026-82548

Name of the Vulnerable Software and Affected Versions wicked versions prior to 0.6.81 Description An out-of-bounds read exists in the DHCPv4 packet capture code. The function ni capture inspect udp header in src/capture.c incorrectly reports the IP total length as the payload length instead of th...

PT-2026-82442

Name of the Vulnerable Software and Affected Versions Visitor Traffic Real Time Statistics Pro versions prior to 11.18 Description An unauthenticated SQL Injection exists in the software. SQL Injection is a type of vulnerability that allows an attacker to interfere with the queries that an...

PT-2026-79656

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An out-of-bounds read exists in the rtw get wpa ie function within the rtl8723bs staging driver. The function processes vendor-specific information elements EID 221 by reading bytes at...

PT-2026-79606

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A race condition exists in the ring buffer swap cpu function. The function relies on a per-CPU committing counter to verify if a buffer is being written to before performing a swap...

PT-2026-72173

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the device property component where the fwnode init function fails to initialize all fields of the fwnode handle structure. When a firmware node is allocated on the...

PT-2026-67003

Name of the Vulnerable Software and Affected Versions affected versions not specified Description The DHCPv4 client helper function net dhcpv4 msg type name in subsys/net/lib/dhcpv4/dhcpv4.c contains a faulty bounds check when indexing a static 8-element name table. The check incorrectly uses...

PT-2026-63485

Name of the Vulnerable Software and Affected Versions Question2Answer versions prior to 1.8.9 Description A session invalidation issue exists where the forgot-password reset flow fails to clear the sessioncode field in the file qa-include/app/users-edit.php. While the standard password-change...

PT-2026-60781

A denial of service vulnerability was identified in GitHub Enterprise Server that allowed an authenticated user to cause service disruption by supplying a repository release notes configuration file containing deeply nested YAML. When release notes were generated, the configuration file was parse...

PT-2026-58105

Name of the Vulnerable Software and Affected Versions Pillow versions prior to 12.3.0 Description The public rank-filter API in the Pillow Python imaging library allows a native heap out-of-bounds write when a very large odd filter size is provided. This occurs because the...

PT-2026-58761

Name of the Vulnerable Software and Affected Versions NVIDIA Triton Inference Server for Linux affected versions not specified Description An issue exists that allows an attacker to cause uncontrolled resource consumption. This flaw is network exploitable and requires no authentication, which may...

PT-2026-58061

Summary Cloudflare quiche was discovered to be vulnerable to memory resource exhaustion due to unbounded queuing of post-handshake client migration events. Impact quiche supports the connection migration features described in Section 9 of RFC 9000, which allows a single QUIC connection to survive...

PT-2026-57709

Name of the Vulnerable Software and Affected Versions Real Estate Manager Pro versions prior to 12.8.4 Description Improper neutralization of input during web page generation allows for Reflected Cross-site Scripting XSS, a flaw where an application includes untrusted data in a web page without...

PT-2026-57154

Dell Unisphere for PowerMax, versions 10.3.0.5 and prior, contains a path traversal vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability to read arbitrary files...

PT-2026-56833

Name of the Vulnerable Software and Affected Versions PayRange version 7.0.7 Description JavaScript can be injected into a WebView when combined with an SSL bypass. This allows an attacker to execute specific JavaScript function calls to escape the WebView sandbox, which is a restricted environme...

PT-2026-55899

Name of the Vulnerable Software and Affected Versions Apache Camel versions 4.0.0 through 4.14.7 Apache Camel versions 4.15.0 through 4.18.2 Apache Camel versions 4.19.0 through 4.20.9 Description An injection and Server-Side Request Forgery SSRF issue exists in the Apache Camel Solr component. T...

PT-2026-55410

The TIFF decoder does not place a limit on the size of PackBits-compressed data. A maliciously-crafted image can exploit this to cause a small image both in terms of pixel width/height and encoded size to make the decoder decode large amounts of compressed data...

PT-2026-54759

Name of the Vulnerable Software and Affected Versions gazebo plugins version 3.9.0 Description Improper input validation in the gazebo ros diff drive.cpp component allows attackers to cause a Denial of Service DoS by supplying a crafted geometry msgs::Twist message. Recommendations At the moment,...

PT-2026-54825

Name of the Vulnerable Software and Affected Versions ImageMagick versions prior to 6.9.13-51 ImageMagick versions prior to 7.1.2-26 Description An integer overflow in the XCF decoder can lead to an out-of-bounds read when processing a specially crafted image, which may cause the application to...

PT-2026-54638

Name of the Vulnerable Software and Affected Versions @fastify/middie versions 9.1.0 through 9.3.2 Description An issue exists in the standalone engine's URL normalization and decoding process where malformed percent-encoded sequences in incoming request paths are not properly guarded...

PT-2026-53676

Mixpost through 2.6.0 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to execute arbitrary JavaScript in authenticated users' browsers by crafting malicious OAuth callback URLs with unsanitized error query parameters. Attackers can exploit the OAuth...

PT-2026-53417

In eosphoros-ai/db-gpt version v0.6.0, the web API POST /api/v1/editor/sql/run allows execution of arbitrary SQL queries without any access control. This vulnerability can be exploited by attackers to perform Arbitrary File Write using DuckDB SQL, enabling them to write arbitrary files to the...

PT-2026-53412

Impact An unauthenticated path traversal vulnerability exists in dash-uploader versions 0.1.0 through 0.7.0a2. The library's HTTP request handler at dash uploader/httprequesthandler.py reads three form parameters upload id, resumableFilename, resumableIdentifier from request.form.get and passes...

PT-2026-53581

qdrant/qdrant version 1.9.0-dev is vulnerable to arbitrary file read and write during the snapshot recovery process. Attackers can exploit this vulnerability by manipulating snapshot files to include symlinks, leading to arbitrary file read by adding a symlink that points to a desired file on the...

PT-2026-52431

Name of the Vulnerable Software and Affected Versions Post Snippets versions prior to 4.0.20 Description Remote attackers with contributor-level permissions can execute arbitrary code on the server. Recommendations Update Post Snippets to version 4.0.20 or later...

PT-2026-55840

Name of the Vulnerable Software and Affected Versions Protego versions prior to 0.6.2-1.1 Description Security issues were identified in the Protego package within the openSUSE Tumbleweed distribution. Recommendations Update to version 0.6.2-1.1...

PT-2026-51142

Name of the Vulnerable Software and Affected Versions Flowise versions prior to 2.1.4 Description Configuration can be injected into the Chainflow during execution through the overrideConfig option, which is available in the frontend web integration and the backend Prediction API. This feature is...

PT-2026-51032

Name of the Vulnerable Software and Affected Versions Microsoft 365 Copilot's Business Chat affected versions not specified Description An open redirect issue exists, which is a flaw that allows a user to be redirected to an untrusted external website. This can enable an unauthorized attacker to...

PT-2026-50949

Name of the Vulnerable Software and Affected Versions Zap Calendar Lite version 4.3.4 Description An SQL injection allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the eid parameter. Attackers can send GET requests to the RSVP plugin endpoint t...

PT-2026-50696

Name of the Vulnerable Software and Affected Versions Grav version 2.0.0-rc.9 with Admin2 version 2.0.0-rc.14 Description A stored cross-site scripting XSS issue exists in the Admin2 Pages API save flow due to a missing XSS safety check during partial validation. Stored XSS occurs when an...

PT-2026-60884

Name of the Vulnerable Software and Affected Versions JLine versions prior to 3.30.14 JLine versions prior to 4.0.16 JLine versions prior to 4.2.1 Description The JLine3 Telnet server remote-telnet module contains a flaw where it does not limit the number of environment variables a client can...

PT-2026-50560

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description The unarchive internal module's archive extraction commands lack code-level validation for extracted file paths. This causes the module to rely on the behavior o...

PT-2026-50134

Name of the Vulnerable Software and Affected Versions Gitea affected versions not specified Description A scope escalation issue exists in the web archive download endpoint. A personal access token with any non-repository scope, such as read:issue or read:misc, can be used to download full...

PT-2026-49419

Unauthenticated Broken Access Control in Royal MCP = 1.4.2 versions...

PT-2026-49085

Name of the Vulnerable Software and Affected Versions Page Builder: Pagelayer – Drag and Drop website builder plugin for WordPress versions prior to 2.1.0 Description Insufficient input sanitization and output escaping in the Anchor block allow authenticated attackers with contributor-level acces...

PT-2026-49055

Name of the Vulnerable Software and Affected Versions Fabric.js versions prior to 7.4.0 Description Improper escaping of user-controlled input during SVG serialization via the toSVG method can lead to Cross-Site Scripting XSS. Specifically, the color field within the colorStops array of a...

PT-2026-48938

Name of the Vulnerable Software and Affected Versions Mattermost versions prior to 11.6.2 Mattermost versions prior to 11.5.5 Mattermost versions prior to 10.11.17 Description Authenticated users with delegated user-management permissions can escalate privileges by altering built-in role...