200725 matches found
PT-2026-22942
Name of the Vulnerable Software and Affected Versions affected versions not specified Description A flaw exists in a standardized wireless roaming protocol that may allow an attacker to install a manipulated Group Temporal Key GTK on a client device. Exploitation of this issue could lead to...
PT-2026-21877
Name of the Vulnerable Software and Affected Versions itsourcecode News Portal Project version 1.0 Description A SQL injection issue exists due to the improper handling of the pagetitle argument in the processing of the /admin/contactus.php file. This allows for remote attacks. The exploit has be...
PT-2026-20773
Reflected Cross-site Scripting XSS in Alkacon's OpenCms v18.0, which allows an attacker to execute JavaScript code in the victim's browser by sending the victim a malicious URL containing the ‘q’ parameter in ‘/search/index.html’. This vulnerability can be exploited to steal sensitive user...
PT-2026-20823
Comodo Dome Firewall 2.7.0 contains a reflected cross-site scripting vulnerability that allows attackers to inject malicious scripts by submitting crafted input to the snat endpoint. Attackers can send POST requests with JavaScript payloads in the port or snat to ip parameters to execute arbitrar...
PT-2026-20238
Name of the Vulnerable Software and Affected Versions IBM Concert versions 1.0.0 through 2.1.0 Description The software contains a flaw where a local user with knowledge of the system’s architecture may be able to escalate their privileges. This is due to incorrect file permissions assigned to...
PT-2026-8247
OPNsense 19.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts by submitting crafted input to the mailserver parameter. Attackers can send POST requests to the monit interface with JavaScript payloads in the mailserver...
PT-2026-8050
The personal-authors-category plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the URL path in all versions up to, and including, 0.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...
PT-2026-8047
The WP Last Modified Info plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.9.5. This is due to the plugin not validating a user's access to a post before modifying its metadata in the 'bulk save' AJAX action. This makes it possible for...
PT-2026-7658
Name of the Vulnerable Software and Affected Versions XWEB Pro versions prior to 1.12.1 MSHTML affected versions not specified Description An OS command injection issue exists in XWEB Pro, allowing a user with network access to execute code remotely by injecting malicious input into the request...
PT-2026-7383
InDesign Desktop versions 21.1, 20.5.1 and earlier are affected by an out-of-bounds read vulnerability that could lead to memory exposure. An attacker could leverage this vulnerability to disclose sensitive information stored in memory. Exploitation of this issue requires user interaction in that...
PT-2026-6578
Name of the Vulnerable Software and Affected Versions UltraVNC Viewer version 1.2.4.0 Description The software contains a denial of service issue that allows attackers to crash the application. Attackers can create a 256-byte malformed payload and paste it into the VNC Server connection dialog,...
PT-2026-5876
Name of the Vulnerable Software and Affected Versions ProfileGrid – User Profiles, Groups and Communities plugin for WordPress versions through 5.9.7.2 Description The ProfileGrid plugin for WordPress is susceptible to unauthorized user suspension. This occurs because of a missing capability chec...
PT-2026-7186
Name of the Vulnerable Software and Affected Versions FUXA versions prior to 1.2.10 Description FUXA, a web-based Process Visualization SCADA/HMI/Dashboard software, contains a path traversal issue that allows an unauthenticated remote attacker to write arbitrary files to any location on the serv...
PT-2026-5366
Name of the Vulnerable Software and Affected Versions D-Link DWR-M961 version 1.1.47 Description A flaw exists in the SMS Message component of D-Link DWR-M961 version 1.1.47. Specifically, the sub 4250E0 function within the /boafrm/formSmsManage file is susceptible to command injection. This occu...
PT-2026-5061
The Easy Replace Image plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 3.5.2. This is due to missing capability checks on the image replacement from url function that is hooked to the eri from url AJAX action. This makes it possible for...
PT-2026-5157
docPrint Pro 8.0 contains a local buffer overflow vulnerability in the 'Add URL' input field that allows attackers to execute arbitrary code by overwriting memory. Attackers can craft a malicious payload that triggers a structured exception handler SEH overwrite to execute shellcode and gain remo...
PT-2026-5055
Name of the Vulnerable Software and Affected Versions D-Link DIR-615 version 4.10 Description A flaw exists in the MAC Filter Configuration component of the D-Link DIR-615. Specifically, manipulation of the mac argument in the /adv mac filter.php file can lead to os command injection. This allows...
PT-2026-4596
The CM CSS Columns plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tag' shortcode attribute in all versions up to, and including, 1.2.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...
PT-2026-4534
Name of the Vulnerable Software and Affected Versions Sourcecodester Domain Availability Checker version 1.0 Description A DOM-based Cross-Site Scripting XSS issue exists in the DomainCheckerApp class within the domain/script.js file. The application does not properly handle user-supplied data in...
PT-2026-3002
The Kalium 3 | Creative WordPress & WooCommerce Theme theme for WordPress is vulnerable to unauthorized email sending due to a missing capability check on the kalium vc contact form request function in all versions up to, and including, 3.29. This makes it possible for unauthenticated attackers t...
PT-2026-2631
A path traversal vulnerability in NETGEAR WiFi range extenders allows an attacker with LAN authentication to access the router's IP and review the contents of the dynamically generated webproc file, which records the username and password submitted to the router GUI...
PT-2026-2397
Name of the Vulnerable Software and Affected Versions WOW21 version 5.0.1.9 Description The software contains an unquoted service path issue. This allows local attackers to potentially execute arbitrary code with elevated system privileges. Exploitation involves leveraging the unquoted binary pat...
PT-2026-1505
Name of the Vulnerable Software and Affected Versions iccDEV versions prior to 2.3.1.2 Description iccDEV is a set of libraries and tools for interacting with International Color Consortium ICC color management profiles. A flaw exists in versions prior to 2.3.1.2 that can lead to a heap buffer...
PT-2026-1538
Name of the Vulnerable Software and Affected Versions versions prior to 2.3 Description A memory corruption issue exists when handling identity credential operations within the trusted application. The issue can be triggered by specific operations related to identity credentials. Recommendations ...
PT-2025-53020
Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.0.0-09039-ga6afa4199d3d-dirty 18 Description The Linux kernel contained a use-after-free flaw within the ar5523 Wi-Fi driver. Specifically, the issue occurred in the ar5523 cmd function when a timeout occurred...
PT-2025-49620
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A flaw exists in the Linux kernel's mmc core component related to handling non-standard SDIO cards. Specifically, the issue arises from an incorrect reference counter management when a...
PT-2025-49626
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A memory leak exists in the hpsa init one function within the SCSI subsystem of the Linux kernel. The hpda alloc ctlr info function allocates memory for a controller information structur...
PT-2025-42339
Name of the Vulnerable Software and Affected Versions Versions affected versions not specified Description Hardware systems with a High-Speed Bridge HSB may experience a lockup of the HSB under undisclosed traffic conditions and conditions beyond the attacker's control. Software versions that hav...
PT-2025-40699
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The Linux kernel contains an issue related to the handling of fprobes and rethooks during unregistration. Specifically, the rethook may not be released correctly after the ftrace ops is...
PT-2026-55675
Name of the Vulnerable Software and Affected Versions picklescan versions prior to 0.0.30 Description The software fails to detect the asyncio.unix events. UnixSubprocessTransport. start function within pickle reduce methods. This allows remote code execution as attackers can create malicious...
PT-2025-33845 · Flaskblog · Flaskblog
Name of the Vulnerable Software and Affected Versions: flaskBlog versions 2.8.0 and earlier Description: The application checks the userRole for "admin" privileges only when accessing the /admin page, but not its subroutes. Specifically, the check is performed in routes/adminPanel.py, but not in...
PT-2025-26023 · Linux · Linux Kernel
Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: A bug in the Linux kernel has been identified, specifically in the s3fb driver, where the screen size value calculated from user input in the s3fb set par function can be larger than...
PT-2025-25938 · Linux · Linux Kernel
Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: A vulnerability in the Linux kernel has been resolved. The issue is related to the initialization of jump labels on 64-bit systems. Specifically, calling jump label init in setup featu...
PT-2025-18826 · Linux +1 · Linux Kernel +1
Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: A issue in the Linux kernel has been identified where the packet length retrieved from a descriptor may be larger than the actual socket buffer length. This can cause the cloned socket...
PT-2025-30076 · Git +1 · Pcapplusplus
Name of the Vulnerable Software and Affected Versions: cppc affected versions not specified Description: The software contains a heap-buffer-overflow read issue. The crash occurs within the toString function of the TelnetLayer class, triggered through toStringList and toString functions of the...
PT-2025-3725 · WordPress · The Master Addons – Elementor Addons
Name of the Vulnerable Software and Affected Versions: Master Addons – Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, & Animations plugin for WordPress versions up to, and including, 2.0.6.7 Description: The issue concerns a stored cross-site scripting vulnerability v...
PT-2024-34298 · Elementor · Alley Elementor Widget
Name of the Vulnerable Software and Affected Versions: Alley Elementor Widget versions 1.0.0 through 1.0.7 Description: The issue is related to improper neutralization of input during web page generation, which allows for DOM-Based XSS. This means an attacker could potentially inject malicious...
PT-2023-25413 · WordPress · Simple Author Box
Name of the Vulnerable Software and Affected Versions: The Simple Author Box WordPress plugin versions prior to 2.52 Description: The issue is related to the disclosure of arbitrary user information due to a lack of verification of the user ID before outputting information about that user. This c...
PT-2023-2756 · Linux +9 · Linux Kernel +9
Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 6.2.13 Description: The issue is related to the qfq change class function in the Linux kernel, which allows an out-of-bounds write because lmax can exceed QFQ MIN LMAX. This can potentially impact the...
PT-2022-25272 · WordPress · Ali Khallad'S Contact Form By Mega Forms
Name of the Vulnerable Software and Affected Versions: Ali Khallad's Contact Form By Mega Forms plugin versions = 1.2.4 Description: The issue is an Authenticated Stored Cross-Site Scripting XSS vulnerability. This means that an attacker with subscriber or higher privileges can inject malicious...
PT-2021-7030 · Linux +1 · Linux Kernel +1
Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 5.17-rc1 Description: The issue is related to a NULL pointer dereference flaw in the Linux kernel's BPF subsystem, specifically in the way a user triggers the map get next key function of the BPF bloom filter...
PT-2021-8146 · Linux +4 · Linux Kernel +4
Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 5.16.0-rc5+ Description: The vulnerability is related to the veth component of the Linux kernel, which fails to properly check for shared or cloned skbs when GRO is enabled on a veth device and TSO is disabled o...
PT-2006-2939 · Unknown · Rechnungszentrale V2
Name of the Vulnerable Software and Affected Versions: RechnungsZentrale V2 versions 1.1.3 and earlier Description: A remote file inclusion issue in the authent.php4 file allows remote attackers to execute arbitrary PHP code via a URL in the rootpath parameter. Recommendations: For...
PT-2026-73215
A SQL Injection vulnerability in a legacy dashboard widget API in Google Cloud Google SecOps Chronicle SOAR versions prior to 6.3.85 on Google Cloud Platform allows an authenticated attacker to execute blind SQL queries using a crafted request parameter. This vulnerability was patched in version...
PT-2026-66489
When Calico's shared debug server is enabled disabled by default, the Calico kube-controllers and Goldmane components bind their Go pprof debug listener to 0.0.0.0 without authentication. Any pod with network reachability to the listener can retrieve the process heap, goroutine stacks including...
PT-2026-66545
Name of the Vulnerable Software and Affected Versions Leantime version 3.6.2 Description An issue exists where the Laravel VerifyCsrfToken middleware is excluded from the global middleware stack in app/Http/Kernel.php. This allows unauthenticated attackers to perform state-changing actions on...
PT-2026-64607
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A double-free issue exists in the SMB client. A response-bearing attempt can return a replayable error and free its response buffer. If the SMB2 query info init function fails before the...
PT-2026-64496
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The Elan I2C touchpad driver contains issues related to how it processes physical dimensions and trace counts. If the device firmware or device tree provides zero values for the x traces...
PT-2026-64410
Name of the Vulnerable Software and Affected Versions Milkdown versions prior to 7.21.3 Description A DOM cross-site scripting issue exists in the @milkdown/plugin-emoji package. Unauthenticated attackers can execute arbitrary JavaScript in the host application origin by tricking a victim into...
PT-2026-64192
Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 150.0.7871.186 Description A use-after-free issue exists in WebMCP, which occurs when an application continues to use a pointer after it has been freed, potentially leading to memory corruption. This flaw allows...