PT-2026-41585

Name of the Vulnerable Software and Affected Versions Kilo-Org kilocode versions prior to 7.0.48 Description A path traversal issue exists in the File Diff API Endpoint within the Bun.file function of the packages/opencode/src/kilocode/review/worktree-diff.ts file. A remote attacker can trigger...

PT-2026-37659

Name of the Vulnerable Software and Affected Versions JohnsonControls AC2000 versions 10.6 through 10 JohnsonControls AC2000 versions 11.0 through 9 JohnsonControls AC2000 versions 12 through 3 Description An uncontrolled search path element issue allows for the manipulation of configuration file...

PT-2026-34090

Vulnerability in the PeopleSoft Enterprise HCM Absence Management product of Oracle PeopleSoft component: Absence Management. The supported version that is affected is 9.2. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise PeopleSoft...

PT-2026-7135

Name of the Vulnerable Software and Affected Versions Litestar versions prior to 2.20.0 Description Litestar is an Asynchronous Server Gateway Interface ASGI framework. Prior to version 2.20.0, the CORS origin validation process can be bypassed. This occurs because the allowed-origins allowlist i...

PT-2024-2606 · Dji · Dji Mavic Mini 3 Pro

Name of the Vulnerable Software and Affected Versions: DJI Mavic Mini 3 Pro affected versions not specified Description: A Missing Authentication for Critical Function issue affects the HTTP service running on the standard port 80, allowing an attacker to enumerate and download videos and picture...

PT-2026-64243

Name of the Vulnerable Software and Affected Versions Rapid7 InsightVM affected versions not specified Nexpose affected versions not specified Rapid7 Insight Agent versions prior to 0.0.245.0 Rapid7 Scan Engine versions prior to 1.1.3935 Description Rapid7 InsightVM, Nexpose, and the Insight Agen...

PT-2026-53359

NASA AIT-Core v2.5.2 was discovered to contain multiple SQL injection vulnerabilities via the query packets and insert functions...

PT-2026-50518

Name of the Vulnerable Software and Affected Versions Hermes Agent versions prior to 0.16.0 Description A DNS rebinding issue in WebSocket endpoints allows remote attackers to bypass Host and Origin validation. This occurs because FastAPI HTTP middleware does not execute for WebSocket upgrade...

PT-2026-24446

In mfc dec dqbuf of mfc dec v4l2.c, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

PT-2026-60699

🧑‍🚒 released sbt 1.12.14 and 2.0.3, featuring - backport of CVE-2026-26032 fix for Ivy while sbt might not be affected - update to Jawn 1.7.0 for CVE-2026-59990 and CVE-2026-61814 fixes...

PT-2026-53626

Improper Control of Generation of Code 'Code Injection' vulnerability in Salesforce Uni2TS on MacOS, Windows, Linux allows Leverage Executable Code in Non-Executable Files.This issue affects Uni2TS: through 1.2.0...

PT-2026-50029

🚨 CVE-2026-46925 Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM component: Siebel Cloud Manager. Supported versions that are affected are 17.0-26.5. Difficult to exploit vulnerability allows unauthenticated attacker with access to the physical communication segmen...

PT-2026-50758

An issue was discovered in yasm version 1.3.0. There is a NULL pointer dereference in if condition in modules/preprocs/nasm/nasm-pp.c...

PT-2026-44330

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the vsock/virtio component where non-linear skbs socket buffers result in an empty payload in the tap skb. The virtio transport build skb function utilizes virtio...

PT-2023-28865 · Lenovo · Reflash

Name of the Vulnerable Software and Affected Versions: Lenovo Desktop products affected versions not specified Description: A buffer overflow was reported in the ReFlash module that may allow a local attacker with elevated privileges to execute arbitrary code. Recommendations: At the moment, ther...

PT-2026-58085

A security issue exists within CompactLogix® 5380, ControlLogix® 5580, and EN4 communication modules related to CIP Security certificate revocation handling. The security issue stems from the controller failing to properly reject certificates signed by an intermediate certificate that has been...

PT-2026-56988

Name of the Vulnerable Software and Affected Versions Hermes WebUI versions prior to 0.51.307 Description An authentication bypass exists that allows unauthenticated remote attackers to circumvent local-origin IP restrictions on onboarding endpoints. This is achieved by supplying a spoofed...

PT-2026-56187

Name of the Vulnerable Software and Affected Versions Dell PowerProtect Data Domain versions 7.7.1.0 through 8.7 Dell PowerProtect Data Domain versions 8.6.1.0 through 8.6.1.10 Dell PowerProtect Data Domain versions 8.3.1.0 through 8.3.1.30 Dell PowerProtect Data Domain versions 7.13.1.0 through...

PT-2026-52933

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the mailbox-test component where a double-free occurs during the process of freeing channels. This happens because the RX channel can be aliased to the TX channel if i...

PT-2026-51499

Inefficient algorithmic complexity in Plug's nested-parameter decoder allows an unauthenticated remote attacker to cause denial of service. Plug.Conn.Query.decode/4 and Plug.Conn.Query.decode each/2 parse query strings and application/x-www-form-urlencoded request bodies. When a key contains many...

PT-2026-48532

Name of the Vulnerable Software and Affected Versions UpdraftPlus: WP Backup & Migration Plugin versions prior to 1.26.5 Description An authentication bypass exists in the UpdraftPlus Remote Communications V2::wp loaded function due to insufficient validation of the remote communications message...

PT-2026-45476

Nextcloud is an open source content collaboration platform. Prior to versions 21.1.10, 22.0.11, and 23.0.3, a low-privileged user can force other user's microphones to be muted in calls when no High-performance Backend is installed. This issue has been patched in versions 21.1.10, 22.0.11, and...

PT-2024-22518 · Dedecms · Dedecms

Name of the Vulnerable Software and Affected Versions: DedeCMS version 5.7 Description: A Cross-Site Request Forgery CSRF issue was found in DedeCMS. The issue is related to the "/dede/article keywords main.php" API endpoint. Recommendations: For DedeCMS version 5.7, as a temporary workaround,...

PT-2023-20326 · Nextcloud +1 · Nextcloud Enterprise Server +2

Name of the Vulnerable Software and Affected Versions: Nextcloud Server versions 24.0.x through 24.0.9 Nextcloud Server versions 25.0.x through 25.0.4 Nextcloud Enterprise Server versions 21.x through 21.0.9.9 Nextcloud Enterprise Server versions 22.x through 22.2.0.9 Nextcloud Enterprise Server...

PT-2026-58007

The Academy LMS – WordPress LMS Plugin for Complete eLearning Solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.8.0 via the 'save lesson note', 'get lesson note', and 'complete lesson video' AJAX handlers due to missing...

PT-2026-56169

In MLflow versions prior to 3.14.0, when running with authentication enabled, the trace API endpoints lack proper authorization validators. This allows any authenticated user to bypass experiment-level authorization controls on all trace operations, including reading, deleting, and modifying trac...

PT-2026-55575

Name of the Vulnerable Software and Affected Versions webpack-dev-server versions prior to 5.2.6 Description Internal developer endpoints '/webpack-dev-server/open-editor' and '/webpack-dev-server/invalidate' perform state-changing actions on GET requests without verifying the request origin. Thi...

PT-2026-53289

Subscriber Cross Site Scripting XSS in Business Directory = 6.4.22 versions...

PT-2026-51430

Name of the Vulnerable Software and Affected Versions motionEye version 0.43.1 Description An absolute path traversal issue exists in the picture and movie API endpoints, such as '/picture/id/preview/filename'. The vulnerability occurs because the API handlers and functions get media preview and...

PT-2026-51102

Name of the Vulnerable Software and Affected Versions Langflow versions prior to 1.9.2 Description An issue exists in components based on BaseFileComponent, including Docling DoclingInlineComponent, Docling Serve DoclingRemoteComponent, Read File FileComponent, NVIDIA Retriever Extraction...

PT-2026-47061

Name of the Vulnerable Software and Affected Versions Microsoft Azure Kubernetes Service affected versions not specified Description Improper limitation of a pathname to a restricted directory, known as path traversal, allows an authorized attacker to execute code locally. This issue can be part ...

PT-2026-46985

Name of the Vulnerable Software and Affected Versions vantage6 versions prior to 5.0.0 Description Users can reset their Multi-Factor Authentication MFA token through API routes that trigger email notifications. Because there is no limit on the number of emails that can be sent, an attacker could...

PT-2025-52605

An issue was discovered in Lantronix EDS3000PS 3.1.0.0R2. The host parameter of the TFTP client in the Filesystem Browser page is not properly sanitized. This can be exploited to escape from the original command and execute an arbitrary one with root privileges...

PT-2025-45031

Name of the Vulnerable Software and Affected Versions Salesforce Mulesoft Anypoint Code Builder versions prior to 1.11.6 Description An issue exists in Salesforce Mulesoft Anypoint Code Builder related to improper neutralization of input used for LLM prompting, which allows manipulation of writab...

PT-2025-28380 · Unknown · Audio Service

Name of the Vulnerable Software and Affected Versions: LeAudioService versions prior to SMR Jul-2025 Release 1 Description: The issue is related to improper access control in LeAudioService, allowing local attackers to stop broadcasting Auracast. Recommendations: For versions prior to SMR Jul-202...

PT-2020-6248 · Python Imaging Library +2 · Pillow +2

Name of the Vulnerable Software and Affected Versions: Pillow versions prior to 7.1.0 Pillow versions 7.x prior to 7.0.1 Pillow version 6.2.2 and earlier Description: The issue is related to multiple out-of-bounds reads in the libImaging/FliDecode.c library. This could allow a remote attacker to...

PT-2026-59901

Impact Out of bounds read in GRUBlockCellGrad python func = tf.raw ops.GRUBlockCellGrad para = 'x': 21.1, 156.2, 83.3, 115.4, 'h prev': array136.5, 136.6, 'w ru': array26.7, 0.8, 47.9, 26.1, 26.2, 26.3, 'w c': array 0.4, 31.5, 0.6, 'b ru': array0.1, 0.2 , dtype=float32, 'b c': 0x41414141, 'r':...

PT-2026-59939

Impact When mlir::tfg::ConvertGenericFunctionToFunctionDef is given empty function attributes, it gives a null dereference. cpp // Import the function attributes with a tf. prefix to match the current // infrastructure expectations. for const auto& namedAttr : func.attr const std::string& name =...

PT-2026-56423

Name of the Vulnerable Software and Affected Versions Dgraph versions prior to 25.3.5 Description Dgraph Alpha exposes privileged RPCs used for external snapshot import on the public gRPC port :9080 without authentication or authorization. An unauthenticated network client can access the...

PT-2026-56086

Name of the Vulnerable Software and Affected Versions Kiwi TCMS versions prior to 16.1 Description User input in the TestCase.extra link and TestPlan.extra link fields is not sanitized and is rendered verbatim, allowing for cross-site scripting XSS, a technique where malicious scripts are injecte...

PT-2026-54979

Name of the Vulnerable Software and Affected Versions Automotive Car Dealership Business versions prior to 13.3.4 Description An unauthenticated Cross Site Scripting XSS issue exists, allowing an attacker to execute malicious scripts in the browser of a user without requiring authentication...

PT-2026-54096

Name of the Vulnerable Software and Affected Versions Google Chrome on Mac versions prior to 150.0.7871.47 Description An out of bounds read exists in ANGLE, a compatibility layer that allows developers to use WebGL across different graphics APIs. A remote attacker who has already compromised the...

PT-2026-53218

A vulnerability was detected in Documenso up to 2.11.0. Affected by this vulnerability is an unknown functionality of the file packages/auth/server/lib/utils/handle-oauth-callback-url.ts of the component Google OAuth Login. The manipulation results in improper authentication. It is possible to...

PT-2026-51426

A malformed Bluetooth Classic SDP attribute can trigger a reachable assertion in Zephyr's SDP parser. In subsys/bluetooth/host/classic/sdp.c, bt sdp parse attribute accepts an input buffer once it contains the 1-byte attribute type and 2-byte attribute id, but then unconditionally pulls an...

PT-2026-49921

Name of the Vulnerable Software and Affected Versions Oracle WebCenter Content version 14.1.2.0.0 Description An issue exists in the Content Server component of Oracle WebCenter Content. A high privileged attacker with network access via HTTP can compromise the system, potentially leading to a fu...

PT-2026-49468

Name of the Vulnerable Software and Affected Versions Spring Cloud Gateway versions prior to 3.1.13 Spring Cloud Gateway versions prior to 4.1.13 Spring Cloud Gateway versions prior to 4.2.9 Spring Cloud Gateway versions prior to 4.3.5 Spring Cloud Gateway versions prior to 5.0.2 Description Spri...

PT-2026-48614

Name of the Vulnerable Software and Affected Versions Spring Web Flow version 4.0.0 Spring Web Flow versions 3.0.0 through 3.0.1 Spring Web Flow versions 2.5.0 through 2.5.1 Description The JavaScript RemotingHandler renders the body of an error response as HTML, regardless of whether the respons...

PT-2026-46196

All in One Video Downloader 1.2 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the id parameter. Attackers can send requests to the admin interface with UNION-based SQL injection payloads in the id...

PT-2026-43231

Name of the Vulnerable Software and Affected Versions Collectric CMU version 1.0 Description An issue exists where unauthenticated attackers can manipulate database queries during authentication. This is achieved by injecting SQL code through the lang parameter in login requests, allowing the...

PT-2026-42839

Name of the Vulnerable Software and Affected Versions Azure Entra ID affected versions not specified Description Improper privilege management allows an unauthorized attacker to elevate privileges over a network. Recommendations At the moment, there is no information about a newer version that...