PT-2025-50248

Name of the Vulnerable Software and Affected Versions Selea Targa IP OCR-ANPR Camera affected versions not specified Description The Selea Targa IP OCR-ANPR Camera contains a stored cross-site scripting issue in the files list parameter. This allows attackers to inject malicious HTML and script...

PT-2025-40801

Name of the Vulnerable Software and Affected Versions CRMEB versions prior to 5.7 Description A security flaw exists in CRMEB that allows for SQL injection. The issue is related to the processing of the cate id argument within the GET Parameter Handler component, specifically in the file...

PT-2025-40514

Name of the Vulnerable Software and Affected Versions Zabbix Agent versions 6.0.0 through 6.0.40 Zabbix Agent versions 7.0.0 through 7.0.17 Zabbix Agent versions 7.2.0 through 7.2.11 Zabbix Agent versions 7.4.0 through 7.4.1 Zabbix Agent 2 versions 6.0.0 through 7.4.1 Description The Zabbix Agent...

PT-2025-19790

Name of the Vulnerable Software and Affected Versions BuddyBoss Platform Pro plugin for WordPress versions up to, and including, 2.7.01 Description The issue is due to insufficient verification on the user being supplied during the Apple OAuth authenticate request through the plugin. This makes i...

PT-2025-6215 · Coinbase · Coinbase Wallet Sdk

Name of the Vulnerable Software and Affected Versions: Coinbase Wallet SDK versions prior to 4.3.0 Description: There is a security issue in outdated versions of the software. This issue does not directly affect users' keys, smart contracts, or funds. Recommendations: Update to version 4.3.0 or...

PT-2024-40947 · Softwarex · Softwarex

Name of the Vulnerable Software and Affected Versions: SoftwareX versions prior to 0.15.1 Description: The issue concerns the borsh serialization of the HashMap, which did not adhere to the borsh specification. This led to potential non-canonical encodings that depended on the insertion order, an...

PT-2024-19030 · WordPress · Houzez Login Register

Name of the Vulnerable Software and Affected Versions: Houzez Login Register versions 3.2.5 and earlier Description: A Privilege Escalation issue has been identified in the Houzez Login Register plugin. Recommendations: For Houzez Login Register versions 3.2.5 and earlier, update to a version tha...

PT-2024-25366 · Unknown · Profaceoff Ssu

Name of the Vulnerable Software and Affected Versions: ProFaceOff SSU versions 1.5.0 and earlier Description: The issue is related to a Missing Authorization vulnerability in ProFaceOff SSU. Recommendations: For ProFaceOff SSU versions 1.5.0 and earlier, at the moment, there is no information abo...

PT-2024-40

Name of the Vulnerable Software and Affected Versions GigaDevice GD32E23x versions GigaDevice GD32F20x versions GigaDevice GD32F1x0 versions GigaDevice GD32F4xx versions GigaDevice GD32F30x versions GigaDevice GD32C10x versions GigaDevice GD32E10x versions GigaDevice GD32E50x versions Description...

PT-2024-22300 · Jenkins · Jenkins Mq Notifier Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins MQ Notifier Plugin versions 1.4.0 and earlier Description: The issue concerns the logging of potentially sensitive build parameters as part of debug information in build logs by default. Recommendations: For Jenkins MQ Notifier Plugin...

PT-2023-23939 · Cyberpower · Cyberpower Powerpanel Enterprise

Name of the Vulnerable Software and Affected Versions: CyberPower PowerPanel Enterprise affected versions not specified Description: A non-feature complete authentication mechanism exists in the production application, allowing an attacker to bypass all authentication checks if LDAP authenticatio...

PT-2022-24064 · Maarch Rm · Maarch Rm

Name of the Vulnerable Software and Affected Versions: Maarch RM version 2.8.3 Description: The issue concerns a broken access control vulnerability. When accessing specific documents, such as PDFs or emails, from an archive, the application proposes a preview. This preview generates a URL that...

PT-2019-12140 · Thinkadmin · Thinkadmin

Name of the Vulnerable Software and Affected Versions: ThinkAdmin version 4.0 Description: The issue concerns the applicationadmincontrollerUser.php file in ThinkAdmin V4.0, where it fails to prevent the continued use of an administrator's cookie-based credentials after a password change. This...

PT-2013-3438 · Linux +4 · Linux Kernel +4

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 3.8.4 Description: The issue is related to a heap-based buffer overflow in the wdm in callback function. This can be exploited by physically proximate attackers using a crafted cdc-wdm USB device, potentially...

PT-2011-2175

Name of the Vulnerable Software and Affected Versions Apple iOS versions 4.3.0 through 4.3.1 Description The issue allows remote attackers to obtain potentially sensitive information about heap memory addresses via a crafted web site, leveraging the generate-id XPath function in libxslt...

PT-2026-112037

Finsys Dockhand before 1.0.43 contains a response-disclosing server-side request forgery vulnerability that allows authenticated users to make the server fetch arbitrary URLs by supplying repository URL and stackfile values. Attackers can send stack templates pointing to internal services or clou...

PT-2026-92943

Name of the Vulnerable Software and Affected Versions Oracle Fusion Middleware Helidon versions 4.0.0 through 4.5.4 Description A flaw in the helidon-microprofile-security component allows a low privileged attacker with network access via HTTP to compromise the system. This can lead to unauthoriz...

PT-2026-91775

The Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘profile fields user email value prefix’ parameter in all versions up to, and including, 4.15.0 due to insufficient input...

PT-2026-92794

Name of the Vulnerable Software and Affected Versions Oracle Database Server versions 19.3 through 19.32 Oracle Database Server versions 21.3 through 21.23 Oracle Database Server versions 23.4.0 through 23.26.3 Description A flaw in the RDBMS component allows a low privileged attacker with networ...

PT-2026-92166

Concrete CMS 9.2.0 to 9.5.2 did not enforce per-field edit user properties permissions on the REST API user write endpoints PUT /ccm/api/1.0/users/uID and POST /ccm/api/1.0/users/uID/change password. A user with an update-scoped OAuth token and permission to edit only one non-sensitive field coul...

PT-2026-91244

Name of the Vulnerable Software and Affected Versions novel-plus versions prior to 5.3.4 Description An insecure default cache-management password exists in the 'CacheController.refreshCache' endpoint. Anonymous attackers can invalidate portal caches by providing the hardcoded default value in th...

PT-2026-89907

Name of the Vulnerable Software and Affected Versions Dolibarr versions 23.0.4 through 24.0.0 Description An authorization bypass allows unauthenticated attackers to read arbitrary files through document storage endpoints. By providing a crafted value for the hashp parameter, specifically...

PT-2026-84977

A vulnerability was detected in 2FastLabs agent-squad up to 1.1.4. Affected by this vulnerability is the function AgentSquad.routeRequest of the file agent-squad/typescript/src/orchestrator.ts of the component Streaming Agent Response Workflow. The manipulation results in resource consumption. It...

PT-2026-83954

Name of the Vulnerable Software and Affected Versions Pangolin versions prior to 1.22.0 Description An authentication bypass exists that allows unauthenticated attackers to access protected resources. By providing an attacker-controlled URL parameter to the share-link authentication endpoint, the...

PT-2026-83588

A weakness has been identified in Linux Foundation Magma 1.9.0. Affected is an unknown function of the file ngap amf handlers.c of the component NGSetup Handler. Executing a manipulation can lead to state issue. The attack can be executed remotely. The exploit has been made available to the publi...

PT-2026-82858

The Smart Slider 3 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'slider' Block Attribute in all versions up to, and including, 3.5.1.38 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level...

PT-2026-82701

Name of the Vulnerable Software and Affected Versions Spring Cloud Function versions 5.0.0 through 5.0.3 Spring Cloud Function versions 4.3.0 through 4.3.4 Spring Cloud Function versions 4.2.0 through 4.2.7 Description An issue exists that may allow arbitrary file read and Server-Side Request...

PT-2026-82449

Name of the Vulnerable Software and Affected Versions Apache APISIX version 3.17.0 Description An inefficient algorithmic complexity issue exists where a single small request can cause a gateway worker to reach 100% CPU usage for an extended period when using graphql-limit-count routes...

PT-2026-82347

Name of the Vulnerable Software and Affected Versions Reactor Netty versions 1.0.0 through 1.0.52 Reactor Netty versions 1.1.0 through 1.2.18 Reactor Netty versions 1.3.0 through 1.3.6 Description When the HAProxy Protocol is enabled, the HTTP Server may incorrectly evaluate the remote IP address...

PT-2026-80887

Name of the Vulnerable Software and Affected Versions Zscaler Client Connector affected versions not specified Description Remote code execution flaws allow an unauthenticated and unprivileged user to execute arbitrary code within the ZCC context. This issue affects Windows, macOS, and mobile...

PT-2026-79692

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the at91sam9 wdt watchdog driver where the at91 ping function rearms the watchdog timer from its callback. Because timer delete does not wait for a running callback or...

PT-2026-73116

Name of the Vulnerable Software and Affected Versions The School Management – Education & Learning ERP plugin for WordPress versions prior to 5.5 Description Authenticated attackers with custom-level access and above can perform SQL Injection by appending additional queries to existing ones to...

PT-2026-72875

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the iommu/vt-d component where the device pasid table teardown function zeroes a 128-bit scalable-mode context entry using context clear entry while the Present bit...

PT-2026-72683

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the RDMA/bnxt re component where applications can request multiple Work Completion WC pages for the same ucontext, although only one WC page per ucontext is supported...

PT-2026-72499

In the Linux kernel, the following vulnerability has been resolved: drm/xe: free madvise VMA array on L2 flush failure xe vm madvise ioctl allocates madvise range.vmas in get vmas. After get vmas succeeds with at least one VMA, error paths must go through free vmas so the array is released before...

PT-2026-72314

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free race condition exists in the ISO Transport IsoTP protocol implementation. The isotp release function attempts to look up a bound network device using dev get by index an...

PT-2026-73006

In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix out-of-bounds clear bit in ath12k mac dp peer cleanup ath12k mac dp peer cleanup clears the ML peer ID slot on the free ml peer id map bitmap by indexing it with dp peer-peer id. That is wrong: dp peer-peer id f...

PT-2026-72424

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the hw perf event init function where the ev variable, which is controlled by userspace via event-attr.config, is used as an array index. Although bounds checking is...

PT-2026-70769

Name of the Vulnerable Software and Affected Versions Visual Studio Code affected versions not specified Description Improper control of code generation leads to a code injection flaw, which allows an unauthorized attacker to execute arbitrary code over a network. Recommendations At the moment,...

PT-2026-70527

Name of the Vulnerable Software and Affected Versions Windows Container Isolation FS Filter Driver unionfs.sys affected versions not specified Description Incorrect authorization in the unionfs.sys driver allows an authorized attacker to disclose sensitive information locally and affect the syste...

PT-2026-66835

Name of the Vulnerable Software and Affected Versions Ghost CLI versions prior to 1.30.1 Description An IP spoofing issue exists that allows unauthenticated remote attackers to bypass rate-limiting controls on self-hosted instances. By manipulating the X-Forwarded-For header through a misconfigur...

PT-2026-64921

Mattermost versions 11.6.x = 11.6.5, 10.11.x = 10.11.20, 11.8.x = 11.8.1, 11.7.x = 11.7.4 fail to limit the number of frames and enforce the file size cap on animated GIF uploads, which allows an authenticated attacker to cause a denial of service via a crafted animated GIF uploaded as a custom...

PT-2026-65102

Name of the Vulnerable Software and Affected Versions JFrog Artifactory Self Hosted versions prior to 7.133.11 Description An incorrect authorization validation of the user token allows for privilege escalation. The issue occurs because the system performs a validation check on the token signatur...

PT-2026-60548

Frogman provides headless PBX control through MCP and HTTP API. Prior to 1.6.3, PERM READ access was sufficient to call fm list managers, fm list pinsets, fm show context, fm get mcp config, fm backup status, fm whos calling, fm run saved query, and fm diagnose trunk, exposing AMI manager secrets...

PT-2026-60183

Name of the Vulnerable Software and Affected Versions NGINX Ingress Controller affected versions not specified Description An injection flaw exists in the configuration generator when the software is configured with Custom Resource Definitions CRDs or Ingress annotations. Multiple user-controllab...

PT-2026-58885

The HCM developed by MetaGuru has a SQL Injection vulnerability. Authenticated remote attackers can inject SQL commands via specific parameters, thereby compromising the confidentiality, integrity, and availability of database data...

PT-2026-60357

MantisBT 2.28.3 and earlier contains a remote code execution vulnerability in the admin "Manage Configuration" feature adm config set.php. When setting a configuration value with a non-string type integer, float, complex, the value is passed through ConfigParser - Tokenizer, which calls eval with...

PT-2026-59171

Summary The ha-mcp OAuth consent form renders user-controlled parameters via Python f-strings with no HTML escaping. An attacker who can reach the OAuth endpoint and convince the server operator to follow a crafted authorization URL could execute JavaScript in the operator's browser. This affects...

PT-2026-56705

During bosh create-env and bosh delete-env, the CLI uploads compiled CPI packages and rendered job templates to the new VM's DAV blobstore over HTTPS without verifying the server certificate, even though a CA certificate for that endpoint is available in the installation manifest. A network...

PT-2026-56662

Name of the Vulnerable Software and Affected Versions Drupal Siteimprove Analytics versions 0.0.0 through 2.0.1 Description Improper neutralization of input during web page generation allows Cross-Site Scripting XSS. The module fails to sufficiently sanitize the Siteimprove Analytics identificati...