PT-2025-24964 · Adobe · Experience Manager

Name of the Vulnerable Software and Affected Versions: Adobe Experience Manager versions 6.5.22 and earlier Description: A stored Cross-Site Scripting XSS issue affects the software, allowing a low-privileged attacker to inject malicious scripts into vulnerable form fields. When a victim browses ...

PT-2025-23559 · Unknown +1 · Kreatv Sdk +1

Name of the Vulnerable Software and Affected Versions: Arris VIP1113 devices with KreaTV SDK through 2025-05-30 Description: The issue allows file overwrite via TFTP because a remote filename with a space character enables an attacker to control the local filename. Recommendations: For Arris...

PT-2025-21447

Name of the Vulnerable Software and Affected Versions: The Custom Field Manager WordPress plugin version 1.0 Description: The issue is related to a Reflected Cross-Site Scripting problem. It occurs because a parameter is not properly sanitised and escaped before being outputted back in the page...

PT-2025-18826

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A issue in the Linux kernel has been identified where the packet length retrieved from a descriptor may be larger than the actual socket buffer length. This can cause the cloned socket...

PT-2024-41

Name of the Vulnerable Software and Affected Versions PT MaxPatrol SIEM affected versions not specified PT MaxPatrol VM affected versions not specified PT MaxPatrol EDR affected versions not specified PT MaxPatrol Carbon affected versions not specified PT MaxPatrol O2 affected versions not...

PT-2024-17133 · WordPress · Gtpayment Donations

Name of the Vulnerable Software and Affected Versions: GTPayment Donations WordPress plugin versions 1.0.0 and earlier Description: The issue concerns a lack of CSRF check in some areas of the plugin, along with missing sanitization and escaping. This could allow attackers to make logged-in...

PT-2024-9213 · Schneider Electric · Modicon Mc80 Bmkc80 +2

Name of the Vulnerable Software and Affected Versions: Schneider Electric Modicon M340 CPU BMXP34, Modicon MC80 BMKC80, and Modicon Momentum Unity M1E Processor 171CBU affected versions not specified Description: A vulnerability exists that could cause a potential arbitrary code execution after a...

PT-2024-43: Remote code execution (RCE) in MediaCMS

The vulnerability was identified in MediaCMS, versions 4.1.0. Discovered vulnerability allows an attacker to execute OS commands on a vulnerable host, gain control over resources, and penetrate the internal network. Vulnerability status: Confirmed by vendor Date of vulnerability remediation:...

PT-2024-32465

Name of the Vulnerable Software and Affected Versions Parse Server versions prior to 6.5.9 Parse Server versions prior to 7.3.0 Description The issue arises when the Parse Server option allowCustomObjectId: true is set, allowing an attacker to create a new user with a custom object ID that exploi...

PT-2024-19072 · Intel · Intel(R) Pcm

Name of the Vulnerable Software and Affected Versions: IntelR PCM software versions prior to 202311 Description: The issue is related to an uncontrolled search path in some IntelR PCM software, which may allow an authenticated user to potentially enable escalation of privilege via local access...

PT-2024-1368 · Tenda · Tenda Ac10

Name of the Vulnerable Software and Affected Versions: Tenda AC10U version 15.03.06.49 multi TDE01 Description: A critical issue has been found in the function formSetDeviceName, which is related to a stack-based buffer overflow due to the manipulation of the argument devName. This can be exploit...

PT-2023-27376 · Opennms · Opennms Meridian +1

Name of the Vulnerable Software and Affected Versions: OpenNMS Horizon versions prior to 32.0.2 OpenNMS Meridian versions prior to 2023.1.6 OpenNMS Meridian versions prior to 2022.1.19 OpenNMS Meridian versions prior to 2021.1.30 OpenNMS Meridian versions prior to 2020.1.38 Description: A BeanShe...

PT-2023-27109 · Omeka · Omeka-S

Name of the Vulnerable Software and Affected Versions: omeka/omeka-s versions prior to 4.0.2 Description: The issue is related to Cross-site Scripting XSS - Stored, which occurs when an application stores user input and later displays it without proper validation or escaping, allowing an attacker...

PT-2022-24428 · Lief · Lief

Name of the Vulnerable Software and Affected Versions: LIEF version 365a16a Description: A reachable assertion abort was discovered in the BinaryStream.hpp component. Recommendations: For LIEF version 365a16a, consider disabling the use of the BinaryStream.hpp component until a patch is available...

PT-2025-26000

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A memory leak issue has been identified in the Linux kernel, specifically in the apparmor module. The issue occurs when the copy from user function fails, causing a memory leak due to th...

PT-2022-13726 · Phpipam +1 · Phpipam +1

Name of the Vulnerable Software and Affected Versions: phpipam/phpipam versions prior to 1.4.6 Description: The issue is related to improper access control, which can lead to incorrect authorization. Recommendations: For versions prior to 1.4.6, update to version 1.4.6 or later to resolve the iss...

PT-2026-111543

FreeRDP from 3.0.0 before 3.32.0 contains an uninitialized memory disclosure vulnerability in smartcard Transmit Call that allows malicious RDP servers to read client memory. Servers can send SCardTransmit requests with an invalid card handle and nonzero receive length, causing smartcard pack...

PT-2026-87686

Name of the Vulnerable Software and Affected Versions Microsoft Windows DNS Server versions Windows Server 2012 through 2025 Microsoft Windows 10 versions 1607 through 1809 Description A use-after-free issue exists in the Windows DNS Server service DNS.exe. A use-after-free is a memory corruption...

PT-2026-87713

Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network...

PT-2026-82279

Vulnerability in Oracle Java SE component: 2D. Supported versions that are affected are Oracle Java SE: 7u511. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE. Successful attacks of this vulnerability can...

PT-2026-80852

The Mercado Pago Node.js SDK interpolates caller-supplied identifiers into API request paths without percent-encoding them, so characters that are structural in a URL survive into the outgoing request. The payment get, capture, cancel, paymentRefund create, total, list, get, advancedPayment get,...

PT-2026-79770

justhtml versions before 1.13.0 contain a cross-site scripting vulnerability in the to markdown function when serializing attacker-controlled pre content. Attackers can place backticks inside sanitized pre elements to break out of fixed-length code fences, allowing raw HTML to execute when the...

PT-2026-78364

Name of the Vulnerable Software and Affected Versions nnn version 5.2 Description The software fails to sanitize the filename variable. An attacker can place a file with a crafted name on a shared filesystem, removable media, or within an extracted archive. If the filename contains a single quote...

PT-2026-76674

Just a quick note that I saw a new SABB Active Backup spk posted this morning. Version is 3.2.1-25059 dated 12-Aug-2026. This is one of my most important packages so I'll be checking it out. Changelog Fixed a security vulnerability CVE-2026-15716 Fixed an issue where backing up or restoring Hyper...

PT-2026-73112

Name of the Vulnerable Software and Affected Versions Slider Hero versions prior to 9.1.8 Description An issue exists where authenticated attackers with administrator-level access can perform a second-order SQL Injection. While slide data such as description, title, btn, btn2, image link, and...

PT-2026-72721

In the Linux kernel, the following vulnerability has been resolved: net: Stop leased rxq before uninstalling its memory provider netif rxq cleanup unlease tears down the memory provider that was installed on a physical RX queue through a netkit queue lease. It currently revokes the provider's DMA...

PT-2026-72903

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the drm/panthor component where the iface fw to cpu addr function only verifies that the MCU virtual address provided by the firmware points within the shared section...

PT-2026-73017

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the netfilter nf tables component. The nft object rhltable is global, which allows other network namespaces to access objects that are being removed from...

PT-2026-72744

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the ext4 file system when the data=journal mount option is used. The ext4 journalled write end function incorrectly calls ext4 write inline data end without verifying ...

PT-2026-72900

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A resource leak occurs in the pqm create queue function when MES is enabled. If the amdgpu amdkfd alloc kernel mem function fails during the initial queue creation for a process, the...

PT-2026-72400

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the create altmaps and memory blocks function where arch remove memory is called with a NULL altmap instead of params.altmap when create memory block devices fails whi...

PT-2026-67416

Admidio before 5.0.11 contains an insecure direct object reference vulnerability in the save temporary mode of mylist function.php that allows authenticated users to hijack list configurations. Attackers can enumerate global list UUIDs and overwrite admin-curated global lists or other users'...

PT-2026-66436

Due to a flaw in the execution order of scripts during shutdown, the firewall is terminated prematurely during system shutdown. This creates a temporary window in which internal services may become externally accessible, potentially allowing an unauthenticated remote attacker to connect to these...

PT-2026-66277

Inappropriate implementation in Views in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofing via a crafted HTML page. Chromium security severity: Low...

PT-2026-65892

Name of the Vulnerable Software and Affected Versions Flyto2 Core versions prior to 2.26.6 Description The llm.chat function reads provider keys, such as OPENAI API KEY and ANTHROPIC API KEY, from the environment and transmits them within the Authorization: Bearer header to a base url controlled ...

PT-2026-65738

The Facturación Electrónica Costa Rica plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.2. This is due to missing or incorrect nonce validation on the global scope, included by fvcr admin page html function. This makes it possible for...

PT-2026-64637

Name of the Vulnerable Software and Affected Versions Linux kernel version 6.12.58 Description A NULL pointer dereference occurs in the lookup swap cgroup id function on hosts without swap enabled. The function passes swap cgroup ctrltype.map to swap cgroup id lookup without verifying if the type...

PT-2026-64184

Name of the Vulnerable Software and Affected Versions OWASP DefectDojo version 2.59.0 Description Improper privilege management occurs in the API/Web component within the UserSerializer function located in the dojo/api v2/serializers.py file. A remote attacker can manipulate the is staff argument...

PT-2026-63432

Name of the Vulnerable Software and Affected Versions Froiden TableTrack versions prior to 1.3.11 Description A stored cross-site scripting issue exists where unauthenticated attackers can inject arbitrary HTML and JavaScript. This occurs because the order notes field does not properly sanitize...

PT-2026-62584

Name of the Vulnerable Software and Affected Versions Oracle Business Process Management Suite version 12.2.1.4.0 Oracle Business Process Management Suite version 14.1.2.0.0 Description A flaw in the Human Workflow component of the Oracle Business Process Management Suite allows a low privileged...

PT-2026-61683

The Joomla extension Gridbox is vulnerable an authenticated bypass, potentially leading to full admin access...

PT-2026-19

Name of the Vulnerable Software and Affected Versions ViPNet Client ViPNet MFTP component, versions prior to 4.5.5 build 24733 Description Vulnerability in ViPNet Client component ViPNet MFTP. Recommendations Disable ViPNet on each host APM/server or update ViPNet Client 4 to version 4.5.5 buiild...

PT-2026-60420

The Header Footer Builder for Elementor WordPress plugin before 1.2.1 does not require an administrative capability for its dashboard template-import action it allows any edit posts user, so a Contributor can import a template containing an Elementor HTML widget configured to display site-wide,...

PT-2026-60193

Name of the Vulnerable Software and Affected Versions LightRAG versions prior to 1.5.4 Description An authentication bypass occurs when the software is deployed with LIGHTRAG API KEY configured but AUTH ACCOUNTS is not set. This happens because the lightrag/api/auth.py file reverts to a hardcoded...

PT-2026-58873

Name of the Vulnerable Software and Affected Versions ASUS System Control Interface versions 3.0.x ASUS Business Manager affected versions not specified Description The ASUS System Control Interface driver and ASUS Business Manager contain issues related to resource allocation without limits and...

PT-2026-60265

TDengine is an open source, time-series database optimized for Internet of Things devices. In 3.4.1.6 and earlier, source/libs/parser/src/parUtil.c trimString checks space for only one byte before processing SQL string escape sequences %, , or x, allowing a one-byte out-of-bounds write to the sta...

PT-2026-58876

Name of the Vulnerable Software and Affected Versions ASUS GameSDK affected versions not specified Description A permissive Cross-domain Security Policy with untrusted domains allows a remote user to obtain a local user’s NTLM hash. This occurs when a user is convinced to visit a crafted web page...

PT-2026-58154

Integer underflow wrap or wraparound in Windows DHCP Client allows an unauthorized attacker to elevate privileges over a network...

PT-2026-59614

A security flaw has been discovered in pygments before 2.20.0. The impacted element is the function AdlLexer of the file pygments/lexers/archetype.py. The manipulation results in inefficient regular expression complexity. The attack is only possible with local access. The exploit has been release...

PT-2026-57623

Name of the Vulnerable Software and Affected Versions Gigabyte Control Center affected versions not specified Description The MBStorage DRAM lighting control module within Gigabyte Control Center GCC contains an improper access control issue. Authenticated local attackers can send specific IOCTL...