PT-2022-12427 · Terramaster · Terramaster F2-210 +2

Name of the Vulnerable Software and Affected Versions: Terramaster F4-210, F2-210 TOS version 4.2.X 4.2.15-2107141517 Description: The issue allows for the execution of arbitrary commands as root by sending a specifically crafted input to the "/tos/index.php?app/del" API endpoint. Recommendations...

PT-2022-5142 · Linux +4 · Linux Kernel +4

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: A use-after-free flaw was found in the Linux kernel’s Amateur Radio AX.25 protocol functionality. This issue arises in the way a user connects with the protocol, allowing a local user ...

PT-2022-13726 · Phpipam +1 · Phpipam +1

Name of the Vulnerable Software and Affected Versions: phpipam/phpipam versions prior to 1.4.6 Description: The issue is related to improper access control, which can lead to incorrect authorization. Recommendations: For versions prior to 1.4.6, update to version 1.4.6 or later to resolve the iss...

PT-2026-114335

Dell Terraform Provider for OME, versions 1.0.0 through 1.2.3, contains an Insertion of Sensitive Information into Log File vulnerability in the provider configuration component. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to information...

PT-2026-87686

Name of the Vulnerable Software and Affected Versions Microsoft Windows DNS Server versions Windows Server 2012 through 2025 Microsoft Windows 10 versions 1607 through 1809 Description A use-after-free issue exists in the Windows DNS Server service DNS.exe. A use-after-free is a memory corruption...

PT-2026-87713

Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network...

PT-2026-81302

Crater Invoice through 6.0.6 contains a path traversal vulnerability in the self-update API that allows authenticated company owners to write arbitrary files outside the intended extraction directory by supplying crafted ZIP archives with ../ sequences to the unzip endpoint. Attackers can exploit...

PT-2026-79770

justhtml versions before 1.13.0 contain a cross-site scripting vulnerability in the to markdown function when serializing attacker-controlled pre content. Attackers can place backticks inside sanitized pre elements to break out of fixed-length code fences, allowing raw HTML to execute when the...

PT-2026-78364

Name of the Vulnerable Software and Affected Versions nnn version 5.2 Description The software fails to sanitize the filename variable. An attacker can place a file with a crafted name on a shared filesystem, removable media, or within an extracted archive. If the filename contains a single quote...

PT-2026-77554

Name of the Vulnerable Software and Affected Versions Oracle E-Business Suite Oracle Shipping Execution versions 12.2.3 through 12.2.15 Description An issue exists within the Internal Operations component of the Oracle Shipping Execution product. A high privileged attacker with network access via...

PT-2026-76674

Just a quick note that I saw a new SABB Active Backup spk posted this morning. Version is 3.2.1-25059 dated 12-Aug-2026. This is one of my most important packages so I'll be checking it out. Changelog Fixed a security vulnerability CVE-2026-15716 Fixed an issue where backing up or restoring Hyper...

PT-2026-73112

Name of the Vulnerable Software and Affected Versions Slider Hero versions prior to 9.1.8 Description An issue exists where authenticated attackers with administrator-level access can perform a second-order SQL Injection. While slide data such as description, title, btn, btn2, image link, and...

PT-2026-72400

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the create altmaps and memory blocks function where arch remove memory is called with a NULL altmap instead of params.altmap when create memory block devices fails whi...

PT-2026-72721

In the Linux kernel, the following vulnerability has been resolved: net: Stop leased rxq before uninstalling its memory provider netif rxq cleanup unlease tears down the memory provider that was installed on a physical RX queue through a netkit queue lease. It currently revokes the provider's DMA...

PT-2026-72903

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the drm/panthor component where the iface fw to cpu addr function only verifies that the MCU virtual address provided by the firmware points within the shared section...

PT-2026-73017

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the netfilter nf tables component. The nft object rhltable is global, which allows other network namespaces to access objects that are being removed from...

PT-2026-72744

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the ext4 file system when the data=journal mount option is used. The ext4 journalled write end function incorrectly calls ext4 write inline data end without verifying ...

PT-2026-72900

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A resource leak occurs in the pqm create queue function when MES is enabled. If the amdgpu amdkfd alloc kernel mem function fails during the initial queue creation for a process, the...

PT-2026-67416

Admidio before 5.0.11 contains an insecure direct object reference vulnerability in the save temporary mode of mylist function.php that allows authenticated users to hijack list configurations. Attackers can enumerate global list UUIDs and overwrite admin-curated global lists or other users'...

PT-2026-67483

A vulnerability was identified in jeequan jeepay up to 3.2.9. This vulnerability affects the function WebSecurityConfig of the file jeepay-manager/src/main/java/com/jeequan/jeepay/mgr/ctrl/sysuser/SysLogController.java of the component PreAuthorize Handler. The manipulation leads to authorization...

PT-2026-66277

Inappropriate implementation in Views in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofing via a crafted HTML page. Chromium security severity: Low...

PT-2026-66436

Due to a flaw in the execution order of scripts during shutdown, the firewall is terminated prematurely during system shutdown. This creates a temporary window in which internal services may become externally accessible, potentially allowing an unauthenticated remote attacker to connect to these...

PT-2026-65892

Name of the Vulnerable Software and Affected Versions Flyto2 Core versions prior to 2.26.6 Description The llm.chat function reads provider keys, such as OPENAI API KEY and ANTHROPIC API KEY, from the environment and transmits them within the Authorization: Bearer header to a base url controlled ...

PT-2026-65738

The Facturación Electrónica Costa Rica plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.2. This is due to missing or incorrect nonce validation on the global scope, included by fvcr admin page html function. This makes it possible for...

PT-2026-64637

Name of the Vulnerable Software and Affected Versions Linux kernel version 6.12.58 Description A NULL pointer dereference occurs in the lookup swap cgroup id function on hosts without swap enabled. The function passes swap cgroup ctrltype.map to swap cgroup id lookup without verifying if the type...

PT-2026-64451

Name of the Vulnerable Software and Affected Versions Redis versions prior to 8.8.0 Description A double free error occurs when an authenticated attacker executes the RESTORE command. This happens when a RESTORE payload references the same NACK pending entry across multiple consumers, and both...

PT-2026-64184

Name of the Vulnerable Software and Affected Versions OWASP DefectDojo version 2.59.0 Description Improper privilege management occurs in the API/Web component within the UserSerializer function located in the dojo/api v2/serializers.py file. A remote attacker can manipulate the is staff argument...

PT-2026-63432

Name of the Vulnerable Software and Affected Versions Froiden TableTrack versions prior to 1.3.11 Description A stored cross-site scripting issue exists where unauthenticated attackers can inject arbitrary HTML and JavaScript. This occurs because the order notes field does not properly sanitize...

PT-2026-62197

Name of the Vulnerable Software and Affected Versions Oracle Siebel CRM versions 17.0 through 26.3 Description An issue exists in the Siebel Approval Manager component of the Siebel CRM Development product. An unauthenticated attacker with network access via HTTP can exploit this flaw to compromi...

PT-2026-62584

Name of the Vulnerable Software and Affected Versions Oracle Business Process Management Suite version 12.2.1.4.0 Oracle Business Process Management Suite version 14.1.2.0.0 Description A flaw in the Human Workflow component of the Oracle Business Process Management Suite allows a low privileged...

PT-2026-61683

The Joomla extension Gridbox is vulnerable an authenticated bypass, potentially leading to full admin access...

PT-2026-19

Name of the Vulnerable Software and Affected Versions ViPNet Client ViPNet MFTP component, versions prior to 4.5.5 build 24733 Description Vulnerability in ViPNet Client component ViPNet MFTP. Recommendations Disable ViPNet on each host APM/server or update ViPNet Client 4 to version 4.5.5 buiild...

PT-2026-60598

Name of the Vulnerable Software and Affected Versions Windows Terminal affected versions not specified Description An integer overflow or wraparound occurs in Windows Terminal, which could allow an unauthorized attacker to execute code over a network. There have been reports of increased actor...

PT-2026-60193

Name of the Vulnerable Software and Affected Versions LightRAG versions prior to 1.5.4 Description An authentication bypass occurs when the software is deployed with LIGHTRAG API KEY configured but AUTH ACCOUNTS is not set. This happens because the lightrag/api/auth.py file reverts to a hardcoded...

PT-2026-58873

Name of the Vulnerable Software and Affected Versions ASUS System Control Interface versions 3.0.x ASUS Business Manager affected versions not specified Description The ASUS System Control Interface driver and ASUS Business Manager contain issues related to resource allocation without limits and...

PT-2026-57729

Missing Authorization vulnerability in BoldGrid Client Invoicing by Sprout Invoices sprout-invoices allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Client Invoicing by Sprout Invoices: from n/a through = 20.8.13...

PT-2026-57623

Name of the Vulnerable Software and Affected Versions Gigabyte Control Center affected versions not specified Description The MBStorage DRAM lighting control module within Gigabyte Control Center GCC contains an improper access control issue. Authenticated local attackers can send specific IOCTL...

PT-2026-57104

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Apache IoTDB. An attacker can write arbitrary files anywhere the IoTDB process has write permissions with unsafe API. This issue affects Apache IoTDB: from 1.0.0 before 2.0.10. Users are recommended to...

PT-2026-56603

Name of the Vulnerable Software and Affected Versions libp2p versions prior to 16.0.0 Description In the @libp2p/gossipsub module, the defaultDecodeRpcLimits configuration sets maxIhaveMessageIDs and maxIwantMessageIDs to Infinity. This allows oversized IHAVE and IWANT control message arrays in...

PT-2026-56604

Name of the Vulnerable Software and Affected Versions OpenJDK packages provided in Ubuntu affected versions not specified Description A sandbox escape issue exists where .jar MIME handlers execute files marked as executable if the mailcap package is installed. A malicious sandboxed application wi...

PT-2026-56278

Name of the Vulnerable Software and Affected Versions Trueview Security camera T18161- AF version 4.9.60.0 Description An authentication bypass exists due to improper password validation and the inclusion of hard-coded credentials within the firmware. Recommendations At the moment, there is no...

PT-2026-55807

Name of the Vulnerable Software and Affected Versions radareorg radare2 versions prior to 6.1.7 Description An integer overflow occurs in the hexpairs Parser component within the cmd anal opcode function located in the libr/core/cmd anal.inc.c file. This issue requires local access to be exploite...

PT-2026-55790

Name of the Vulnerable Software and Affected Versions code-projects Real State Services version 1.0 Description An issue exists in the /single-list rent.php file where manipulating the ID argument allows for remote SQL injection. SQL injection is a technique where malicious SQL statements are...

PT-2026-55723

A vulnerability was found in CodeAstro Apartment Visitor Management System 1.0. Affected is an unknown function of the file /index.php of the component Login. Performing a manipulation of the argument Username results in sql injection. Remote exploitation of the attack is possible. The exploit ha...

PT-2026-53527

remote code execution in paddlepaddle/paddle 2.6.0...

PT-2026-53195

A vulnerability was detected in CodeAstro Human Resource Management System 1.0. This issue affects the function emselectByCode of the file application/models/Employee model.php of the component Update Earn Leave Endpoint. The manipulation of the argument emid results in sql injection. The attack...

PT-2026-53115

Name of the Vulnerable Software and Affected Versions code-projects Project Management System version 1.0 Description Cross site scripting XSS occurs in the Mail Compose Page component within the /mail.php endpoint. This issue allows a remote attacker to execute malicious scripts through the...

PT-2026-52683

The User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder plugin for WordPress is vulnerable to unauthorized modification of data due to missing validation checks in the confirm payment function in all...

PT-2026-52547

Kanboard through 1.2.52, fixed in commit 928c68a, UserViewController::removeSession fails to validate the session id parameter before passing it to RememberMeSessionModel::remove, allowing authenticated users to delete other users' Remember Me sessions. Attackers can enumerate sequential session...

PT-2026-51625

Name of the Vulnerable Software and Affected Versions Gogs affected versions not specified Gitea affected versions not specified Description A stored DOM-based Cross-Site Scripting XSS issue exists where an attacker can store an HTML or JavaScript payload in a milestone name. When a user opens th...