PT-2024-33385 · WordPress · Buddypress Better Registration

Name of the Vulnerable Software and Affected Versions: BuddyPress Better Registration versions 1.6 and earlier BuddyPress Better Registration version 1.7 is not affected, as it contains the fix for the issue. Description: The issue is an Authentication Bypass Using an Alternate Path or Channel...

PT-2024-31991 · Mecha Cms · Mecha Cms

Name of the Vulnerable Software and Affected Versions: Mecha CMS version 3.0.0 Description: The issue allows an attacker to construct cookies and URIs that bypass user identity checks. Parameters can then be passed through the POST method, resulting in the deletion of arbitrary files or website...

PT-2024-21077 · Infinera · Infinera Tnms

Name of the Vulnerable Software and Affected Versions: Infinera TNMS version 19.10.3 Description: The WebDAV service in Infinera TNMS allows a low-privileged remote attacker to conduct unauthorized file operations because it executes with unnecessary privileges. Recommendations: For version...

PT-2024-12501 · Unknown · Openbmc Firmware

Name of the Vulnerable Software and Affected Versions: OpenBMC Firmware versions prior to egs-1.14-0 OpenBMC Firmware versions prior to bhs-0.27 Description: The issue is related to an uncaught exception in OpenBMC Firmware for some IntelR Server Platforms, which may allow an authenticated user t...

PT-2024-5074

Name of the Vulnerable Software and Affected Versions: Arm Ltd Bifrost GPU Kernel Driver versions r45p0 through r48p0 Arm Ltd Valhall GPU Kernel Driver versions r45p0 through r48p0 Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver versions r45p0 through r48p0 Description: The issue is related to...

PT-2024-3456 · Php +1 · Php +1

Name of the Vulnerable Software and Affected Versions: Cacti versions 1.3.x Description: A command injection vulnerability allows any unauthenticated user to execute arbitrary commands on the server when the register argc argv option of PHP is On. The vulnerability is located in cmd realtime.php...

PT-2024-23105

Name of the Vulnerable Software and Affected Versions TinyMCE versions prior to 6.8.1 TinyMCE versions prior to 7.0.0 Description A cross-site scripting XSS vulnerability was discovered in TinyMCE’s content loading and content inserting code. A SVG image could be loaded though an object or embed...

PT-2024-13997 · Janitza · Gridvis

Name of the Vulnerable Software and Affected Versions: Janitza GridVis versions 9.0.66 and earlier Description: The issue allows remote authenticated administrative users to execute arbitrary Groovy code due to exposed dangerous methods in the de.janitza.pasw.project.server.ServerDatabaseProject...

PT-2024-14104 · Snakeyaml +1 · Snakeyaml +1

Name of the Vulnerable Software and Affected Versions: Hertzbeat versions prior to 1.4.1 Description: Hertzbeat is a real-time monitoring system. At the interface of "/define/yml", SnakeYAML is used as a parser to parse yml content, but no security configuration is used, resulting in a YAML...

PT-2024-1368 · Tenda · Tenda Ac10

Name of the Vulnerable Software and Affected Versions: Tenda AC10U version 15.03.06.49 multi TDE01 Description: A critical issue has been found in the function formSetDeviceName, which is related to a stack-based buffer overflow due to the manipulation of the argument devName. This can be exploit...

PT-2023-31942 · Kantega +1 · Kantega Saml Sso Oidc Kerberos Single Sign-On +4

Name of the Vulnerable Software and Affected Versions: Kantega SAML SSO OIDC Kerberos Single Sign-on for Jira Data Center & Server versions 4.4.2 through 4.14.8 Kantega SAML SSO OIDC Kerberos Single Sign-on for Jira Data Center & Server versions 5.0.0 through 5.11.4 Kantega SAML SSO OIDC Kerberos...

PT-2023-7781 · Siemens · Scalance M826-2 Shdsl-Router +11

Name of the Vulnerable Software and Affected Versions: RUGGEDCOM RM1224 LTE4G EU versions prior to V8.0 RUGGEDCOM RM1224 LTE4G NAM versions prior to V8.0 SCALANCE M804PB versions prior to V8.0 SCALANCE M812-1 ADSL-Router versions prior to V8.0 SCALANCE M816-1 ADSL-Router versions prior to V8.0...

PT-2023-25218 · Unknown · Chamilo Lms

Name of the Vulnerable Software and Affected Versions: Chamilo LMS versions prior to 1.11.20 Description: The issue is related to improper sanitisation in the main/inc/lib/fileUpload.lib.php file, which allows unauthenticated attackers to bypass file upload security protections. This can lead to...

PT-2023-32059 · WordPress · Five Star Restaurant Menu/Food Ordering

Name of the Vulnerable Software and Affected Versions: Five Star Restaurant Menu and Food Ordering WordPress plugin versions prior to 2.4.11 Description: The issue allows unauthenticated users to perform PHP Object Injection via an AJAX action by unserializing user input. This can be exploited wh...

PT-2025-38390

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A memory leak exists in the trace/blktrace module when using the debugfs lookup function. Failing to call dput on the result of debugfs lookup leads to a memory leak over time. The issue...

PT-2023-3559 · Linux +10 · Linux Kernel +10

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to 5.19.0-35 Description: The issue is related to the nft byteorder function in the Linux Kernel's netfilter subsystem, which poorly handles vm register contents when CAP NET ADMIN is in any user or network...

PT-2023-13602 · Ibm · Ibm Tivoli Workload Scheduler

Name of the Vulnerable Software and Affected Versions: IBM Tivoli Workload Scheduler versions 9.4 through 10.1 Description: The issue is related to an XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this to expose sensitive information or consume...

PT-2023-19385 · Signal · Signal Desktop +1

Name of the Vulnerable Software and Affected Versions: Signal Desktop versions prior to 6.2.0 Description: The issue allows an attacker to modify conversation attachments within the attachments.noindex directory. Client mechanisms fail to validate modifications of existing cached files, resulting...

PT-2023-1276 · Cisco · Cisco Small Business Rv340W +3

Name of the Vulnerable Software and Affected Versions: Cisco Small Business RV340, RV340W, RV345, and RV345P Dual WAN Gigabit VPN Routers affected versions not specified Description: A vulnerability in the web-based management interface could allow an authenticated, remote attacker to execute...

PT-2022-19651 · Unknown · Hyperscan Library

Name of the Vulnerable Software and Affected Versions: Hyperscan library versions prior to 04/29/2022 Description: The issue is related to improper buffer restrictions in the Hyperscan library, which may allow an unauthenticated user to potentially enable escalation of privilege via network acces...

PT-2022-20189 · Rsa · Archer Platform

Name of the Vulnerable Software and Affected Versions: Archer Platform versions 6.3 through 6.10 before 6.10.0.3 Archer Platform versions 6.9 through 6.9.3 before 6.9.3.4 Archer Platform versions prior to 6.11.0.0 Description: The issue is related to an Improper Access Control Vulnerability withi...

PT-2020-6721 · Linux +7 · Linux Kernel +7

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: A flaw was found in the Linux kernel, specifically in the ext4 filesystem, where a corrupted extent tree can cause a denial of service problem. This issue is related to an integer...

PT-2020-13088 · Gitlab · Gitlab

Name of the Vulnerable Software and Affected Versions: GitLab versions 12.6 through 12.9 Description: The issue allows an external user to create a personal snippet through the API, resulting in a privilege escalation. Recommendations: For GitLab versions 12.6 through 12.9, update to a version th...

PT-2019-4415 · Linux +2 · Linux Kernel +2

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 5.3.6 Description: A memory leak in the nfp abm u32 knode replace function in drivers/net/ethernet/netronome/nfp/abm/cls.c allows attackers to cause a denial of service memory consumption. The issue has been...

PT-2020-6552 · Linux +6 · Linux Kernel +6

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions after 4.5-rc1 Description: A flaw was found in the Linux Kernel in the way mremap handled DAX Huge Pages. This flaw allows a local attacker with access to a DAX enabled storage to escalate their privileges on the system...

PT-2019-2567 · Abb · Abb Idal Ftp Server

Name of the Vulnerable Software and Affected Versions: ABB IDAL HTTP server affected versions not specified Description: The issue is related to the mishandling of format strings in a username or cookie during the authentication process. Attempting to authenticate with the username %25s%25p%25x%2...

PT-2026-84792

A path traversal vulnerability in Jenkins Allure Plugin 2.35.2 and earlier allows attackers with Item/Read permission on jobs that publish Allure report results to read arbitrary files on the Jenkins controller's file system...

PT-2026-82990

In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: core: Initialize hba-rpmbs list in ufshcd Initialize the hba-rpmbs list in ufshcd alloc host to prevent NULL pointer dereference in the device teardown path if ufs rpmb probe fails...

PT-2026-82858

The Smart Slider 3 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'slider' Block Attribute in all versions up to, and including, 3.5.1.38 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level...

PT-2026-82789

Certain configuration endpoints may lack proper server-side authorization checks, allowing unauthorized users to access or modify sensitive device settings. This could result in full compromise of device functionality...

PT-2026-82514

ccoap 77f55c4b466e99327c24ace8a2913d3ba7e2ccd5 contains a null pointer dereference vulnerability in the coap dump msg function when processing COAP messages containing options with zero length...

PT-2026-82347

Name of the Vulnerable Software and Affected Versions Reactor Netty versions 1.0.0 through 1.0.52 Reactor Netty versions 1.1.0 through 1.2.18 Reactor Netty versions 1.3.0 through 1.3.6 Description When the HAProxy Protocol is enabled, the HTTP Server may incorrectly evaluate the remote IP address...

PT-2026-78995

Name of the Vulnerable Software and Affected Versions Checkmk versions prior to 2.5.0p2 Checkmk versions prior to 2.4.0p29 Checkmk versions prior to 2.3.0p47 Checkmk versions 2.2.0 through 2.2.x Description Incorrect authorization in frozen BI aggregations allows an authenticated user with...

PT-2026-78364

Name of the Vulnerable Software and Affected Versions nnn version 5.2 Description The software fails to sanitize the filename variable. An attacker can place a file with a crafted name on a shared filesystem, removable media, or within an extracted archive. If the filename contains a single quote...

PT-2026-73215

A SQL Injection vulnerability in a legacy dashboard widget API in Google Cloud Google SecOps Chronicle SOAR versions prior to 6.3.85 on Google Cloud Platform allows an authenticated attacker to execute blind SQL queries using a crafted request parameter. This vulnerability was patched in version...

PT-2026-73116

Name of the Vulnerable Software and Affected Versions The School Management – Education & Learning ERP plugin for WordPress versions prior to 5.5 Description Authenticated attackers with custom-level access and above can perform SQL Injection by appending additional queries to existing ones to...

PT-2026-72845

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the rtw89 wifi driver where the mac id field in RX descriptors, which is 8 bits wide 0-255, is used as an array index for assoc link on macid without validation. Since...

PT-2026-72872

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the rxrpc component where the rxrpc kernel charge accept function reads rx-backlog without proper socket or backlog synchronization. This raw pointer is then passed to...

PT-2026-72977

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A memory leak occurs in the net: sxgbe component. When the init dma desc rings function fails to allocate RX descriptor rings, it only frees the partially allocated RX rings. Consequentl...

PT-2026-72125

Name of the Vulnerable Software and Affected Versions Microsoft Defender affected versions not specified Description An elevation of privilege exists in the Microsoft Malware Protection Engine in Microsoft Defender, publicly referred to as "ShieldBreak". Recommendations At the moment, there is no...

PT-2026-70527

Name of the Vulnerable Software and Affected Versions Windows Container Isolation FS Filter Driver unionfs.sys affected versions not specified Description Incorrect authorization in the unionfs.sys driver allows an authorized attacker to disclose sensitive information locally and affect the syste...

PT-2026-67451

A certification validation weakness exists in communication between affected Omada devices and cloud controllers. Certificate identity verification does not adequately validate that a presented certificate corresponds to the expected cloud controller hostname, which may allow certificate validati...

PT-2026-67391

HCL iControl is affected by Missing Access Control vulnerability. The application failed to enforce proper granular access controls, allowing users to access or view administrator-level functionalities without appropriate authorization...

PT-2026-66853

Name of the Vulnerable Software and Affected Versions Coturn versions 4.5.2 through 4.14.0 Description When started with the --acme-redirect parameter and exposing a plaintext-TCP listener, an unauthenticated remote client can send an HTTP GET request to trigger a memory leak. The server responds...

PT-2026-66476

Name of the Vulnerable Software and Affected Versions Serendipity versions prior to 2.6.1 Description An authentication context confusion exists where password validation and session loading operate independently without ensuring both use the same user record. This allows an authenticated Editor ...

PT-2026-66606

Name of the Vulnerable Software and Affected Versions Sylius Mollie Plugin versions prior to 2.2.8 Sylius Mollie Plugin versions prior to 3.2.4 Sylius Mollie Plugin versions prior to 3.3.1 Description The payment webhook at the POST / locale/update-payment endpoint accepts the id and orderId...

PT-2026-65110

An authorization weakness in JFrog Artifactory internal metadata handling could allow a user with limited repository access to write to restricted internal metadata areas under specific conditions. Successful abuse is limited to integrity and availability impact at a low level; confidentiality is...

PT-2026-64584

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A Use-After-Free UAF issue exists in the appleir driver. The appleir remove function executes hid hw stop before timer delete sync, which can lead to the input dev being freed while a...

PT-2026-64558

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the usb mtu3 component where the mtu3 gadget queue function maps a request before verifying if the QMU GPD ring can accept another transfer. If the mtu3 prepare transf...

PT-2026-62084

Name of the Vulnerable Software and Affected Versions DayuanJiang next-ai-draw-io version 0.4.13 Description A Cross Site Scripting XSS issue allows a remote attacker to execute arbitrary code. This is achieved by manipulating the mcp parameter. Recommendations At the moment, there is no...