PT-2026-67201

CVE-2026-51257 - Rejected reason: DO NOT USE THIS CVE RECORD. Consu CVE ID :CVE-2026-51257 Published : July 31, 2026, 3:16 p.m. | 39 minutes ago Description :Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed...

PT-2026-66476

Name of the Vulnerable Software and Affected Versions Serendipity versions prior to 2.6.1 Description An authentication context confusion exists where password validation and session loading operate independently without ensuring both use the same user record. This allows an authenticated Editor ...

PT-2026-65738

The Facturación Electrónica Costa Rica plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.2. This is due to missing or incorrect nonce validation on the global scope, included by fvcr admin page html function. This makes it possible for...

PT-2026-65419

The Taskbuilder – Project Management & Task Management Tool With Kanban Board plugin for WordPress is vulnerable to SQL Injection via the 'wppm proj filter' parameter in versions up to, and including, 5.0.9. This is due to insufficient escaping on the user-supplied parameter and the lack of...

PT-2026-65107

Name of the Vulnerable Software and Affected Versions JFrog Artifactory affected versions not specified Description A deserialization weakness exists in the way JFrog Artifactory handles packages. This flaw could allow a low-privileged user to compromise confidentiality, integrity, and availabili...

PT-2026-64421

Name of the Vulnerable Software and Affected Versions GPU DDK affected versions not specified Description An integer overflow occurs during the calculation of physical offsets for sparse PMRs Partial Memory Regions within the PMRLogicalOffsetToPhysicalOffset function. For PMRs larger than 4 GB,...

PT-2026-63867

Unauthenticated Privilege Escalation in TrueBooker = 1.2.3 versions...

PT-2026-63385

Name of the Vulnerable Software and Affected Versions NLnet Labs Unbound versions 1.25.0 through 1.25.1 Description A memory corruption issue exists when the software is under pressure and configured with an access-control-view and either the respip or rpz modules, alongside a module capable of...

PT-2026-63077

Name of the Vulnerable Software and Affected Versions Oracle Agile Engineering Data Management version 6.2.1 Description A flaw in the Core component of the Oracle Agile Engineering Data Management product allows a low privileged attacker with network access via TCP to compromise the system...

PT-2026-63048

Name of the Vulnerable Software and Affected Versions Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0 Description A flaw in the Forge component allows an unauthenticated attacker with network access via HTTP to compromise the system. Successful exploitation can...

PT-2026-60575

SALTO ProAccess Space software using the tenancy feature / logical partition is vulnerable to a privilege escalation attack that could allow an authorized attacker to access any space managed by the affected product...

PT-2026-58890

The Joomla extension EDocman is vulnerable to an unauthenticated SQL injection...

PT-2026-60173

Running SharePoint? There are at least 4 vulns you want to pay attention to: CVE-2026-55040, CVE-2026-52522, CVE-2026-58644, CVE-2026-56164 unauthenticated RCE, exploits available etc. https://t.co/9moTd0gNju...

PT-2026-58856

Name of the Vulnerable Software and Affected Versions VMware Avi Load Balancer versions 31.1.1 through 31.2.2 VMware Avi Load Balancer versions 30.1.1 through 30.2.6 VMware Avi Load Balancer versions 22.1.1 through 22.1.7 Description An authentication bypass exists in the Avi Controller control...

PT-2026-58150

Name of the Vulnerable Software and Affected Versions Windows DNS affected versions not specified Description A heap-based buffer overflow exists in the Windows DNS Client. This flaw allows an authorized attacker with local access to elevate their privileges to administrative levels. A heap-based...

PT-2026-58051

Name of the Vulnerable Software and Affected Versions 1756-EN2 affected versions not specified 1756-EN3 affected versions not specified 1756-ENBT affected versions not specified Description An issue exists due to improper validation of CIP Implicit Connection packets. An attacker on the network c...

PT-2026-58009

Name of the Vulnerable Software and Affected Versions 1715-AENTR EtherNet/IP Adapter versions prior to 3.011 Description The 1715-AENTR EtherNet/IP Adapter exposes a network-accessible debug port that lacks proper privilege controls. This allows unauthenticated remote access to intrusive...

PT-2026-58154

Integer underflow wrap or wraparound in Windows DHCP Client allows an unauthorized attacker to elevate privileges over a network...

PT-2026-58868

Name of the Vulnerable Software and Affected Versions Grav API Plugin versions prior to 1.0.6 Description UsersController functions createApiKey, generate2fa, and disable2fa fail to perform the accessGrantsSuper target check. An account with api.users.write permissions can use...

PT-2026-57768

Missing Authorization vulnerability in AcyMailing Newsletter Team AcyMailing SMTP Newsletter acymailing allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AcyMailing SMTP Newsletter: from n/a through = 10.11.1...

PT-2026-60023

Summary A CSS injection issue exists in WeasyPrint when HTML presentational hints are enabled. Unescaped attribute values are embedded into CSS, allowing injection of arbitrary CSS declarations. This affects applications processing untrusted HTML input. Details File: weasyprint/css/ init .py The...

PT-2026-57439

PraisonAI before 4.6.78 contains arbitrary file write and command execution vulnerabilities in the AICoder component due to missing path validation and command sanitization in LLM tool calls. Attackers can inject malicious prompts through the chat interface to write files to arbitrary filesystem...

PT-2026-57216

Simple Machines Forum 2.1 prior to 2.1.8 and 3.0 prior to 3.0 Alpha 5 contains an authorization bypass vulnerability in Sources/Actions/AttachmentApprove.php where a single-character operator error causes the permission check to always pass regardless of user permissions. An authenticated...

PT-2026-57162

FlaskBB through 2.2.0, fixed in commit acc88cf, contains an authorization bypass vulnerability that allows authenticated moderators to perform unauthorized actions on topics in forums they do not control by submitting crafted topic ID lists. Attackers can include a low-ID topic from a permitted...

PT-2026-57201

A flaw was found in the file type content detector of guardrails-detectors. This vulnerability allows a remote attacker to supply an arbitrary XML Schema Definition XSD string, which is processed without proper restrictions. This can lead to server-side requests to arbitrary URLs or local file...

PT-2026-56807

A vulnerability has been identified in CPCI85 Central Processing/Communication All versions V26.20, SICORE Base system All versions V26.20.0. The affected application contains insufficient validation of authentication credentials when processing administrative account modifications through the we...

PT-2026-57011

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.7.1 Description An authenticated administrator or API-token user can exfiltrate sensitive files from the host system. The 'POST /api/file/globalCopyFiles' endpoint accepts absolute source paths and uses the...

PT-2026-56777

Name of the Vulnerable Software and Affected Versions Balbooa Forms versions prior to 2.4.1 Description The Joomla extension Balbooa Forms, installed as the com baforms component, contains a flaw in its frontend attachment upload functionality. This issue allows an unauthenticated anonymous visit...

PT-2026-56831

Name of the Vulnerable Software and Affected Versions Open WebUI versions 0.8.11 through 0.9.x Description An issue exists where the 'POST /api/v1/images/edit' endpoint only requires a verified account and fails to enforce the global image-edit switch or per-user image-generation permissions. Thi...

PT-2026-56604

Name of the Vulnerable Software and Affected Versions OpenJDK packages provided in Ubuntu affected versions not specified Description A sandbox escape issue exists where .jar MIME handlers execute files marked as executable if the mailcap package is installed. A malicious sandboxed application wi...

PT-2026-56159

Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. Prior to 2.11.0, Excelize parses shared-string cell values with strconv.Atoi and checks only the upper bound before indexing the shared string slice, allowing an XLSX file containing a shared-string cell with ...

PT-2026-55940

Name of the Vulnerable Software and Affected Versions ownCloud versions prior to 10.15.3 Description An attacker with administrative privileges can exploit a path traversal issue to execute arbitrary code. Path traversal is a flaw that allows an attacker to access files and directories that are...

PT-2026-55888

Name of the Vulnerable Software and Affected Versions Apache Camel versions 4.3.0 through 4.14.7 Apache Camel versions 4.15.0 through 4.18.2 Apache Camel versions 4.19.0 through 4.20.9 Description Improper input validation in the camel-elasticsearch-rest-client component allows for authorization...

PT-2026-55617

Name of the Vulnerable Software and Affected Versions Microsoft Edge Chromium-based affected versions not specified Description An improper authorization flaw allows an unauthorized attacker to bypass a security feature over a network. This issue enables exploitation without prior authentication,...

PT-2026-55513

Name of the Vulnerable Software and Affected Versions The CURCY – Multi Currency for WooCommerce – Smoothly on WooCommerce 9.x versions prior to 2.2.15 Description Unauthenticated attackers can execute arbitrary shortcodes because the software fails to properly validate a value before running the...

PT-2026-55595

Name of the Vulnerable Software and Affected Versions Gitea versions prior to 1.25.5 Description The software fails to scope the lookup of tracked-time entries to the specific issue provided in the request URL when searching by time ID. This flaw allows an attacker to attempt the deletion of time...

PT-2026-55630

Name of the Vulnerable Software and Affected Versions Microsoft Edge Chromium-based affected versions not specified Description Improper authorization allows an unauthorized attacker to execute code over a network. Recommendations At the moment, there is no information about a newer version that...

PT-2026-55478

Name of the Vulnerable Software and Affected Versions monitoring-plugins affected versions not specified Description An issue exists in the Debian.sudoers file where the apt-get command is permitted for the nagios user without enforcing specific arguments. This allows a user who has compromised t...

PT-2026-60833

Name of the Vulnerable Software and Affected Versions IBM Langflow OSS versions 1.0.0 through 1.10.0 Description Unauthenticated attackers can achieve remote code execution RCE on default deployments by chaining two endpoints. First, the '/api/v1/auto login' endpoint allows the minting of SUPERUS...

PT-2026-54978

Unauthenticated Cross Site Scripting XSS in Automotive Listings = 18.6 versions...

PT-2026-55410

The TIFF decoder does not place a limit on the size of PackBits-compressed data. A maliciously-crafted image can exploit this to cause a small image both in terms of pixel width/height and encoded size to make the decoder decode large amounts of compressed data...

PT-2026-54734

Guardian language-system fails to sanitize the id GET parameter before inserting it into HTML source and form action attributes in media.php lines 119, 129. An authenticated attacker can craft a URL that injects script tags executing in the victim's browser session...

PT-2026-54484

Name of the Vulnerable Software and Affected Versions UltraVNC repeater versions prior to 1.8.2.3 Description An integer overflow exists in the HTTP request logging path. The win log function allocates list nodes using a calculation based on the length of the HTTP request URI. If the URI length i...

PT-2026-54495

The Product Configurator for WooCommerce WordPress plugin before 1.7.3 does not perform any authorisation or post-status check before returning WooCommerce product data through a public AJAX action, allowing unauthenticated users to retrieve the data title, price, weight, stock status, and...

PT-2026-54927

Name of the Vulnerable Software and Affected Versions FatFs versions R0.16 and earlier Description An integer underflow occurs during interleaved read and write operations on fragmented filesystems. This issue is caused by an unsigned-subtraction wrap in the f read and f write functions when...

PT-2026-55158

Summary A memory-safety vulnerability in Open Babel's ORCA parser allowed an out-of-bounds write when reading a crafted input file. Details The flaw was in the nAtoms handling of the ORCA reader. A malformed input caused the parser to write past the end of its destination buffer. Impact Open Babe...

PT-2026-55276

CVE ID :CVE-2026-47105 Published : June 30, 2026, 12:50 p.m. | 36 minutes ago Description :None Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...

PT-2026-55922

Name of the Vulnerable Software and Affected Versions FreeBSD affected versions not specified Description A use-after-free issue exists in the tcp rack.ko module of the FreeBSD kernel. The RACK setsockopt2 handler releases the connection lock to copy option data from userspace and subsequently...

PT-2026-54353

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 150.0.7871.47 Description Insufficient validation of untrusted input in WebRTC allows a remote attacker to perform privilege escalation through the use of a crafted HTML page. Recommendations Update Google Chrom...

PT-2026-53283

Name of the Vulnerable Software and Affected Versions Home Assistant versions prior to 2025.5.0 Description The iOS companion app fails to respect the SSID allowlist for internal networks. While the app typically uses the Service Set Identifier SSID—the public name of a wireless network—to...