417320 matches found
PT-2026-5887
Name of the Vulnerable Software and Affected Versions Chapa Payment Gateway Plugin for WooCommerce versions up to and including 1.0.3 Description The Chapa Payment Gateway Plugin for WooCommerce plugin for WordPress is susceptible to sensitive information disclosure. An unauthenticated attacker c...
PT-2026-4582
The Cookie consent for developers plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple settings fields in all versions up to, and including, 1.7.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...
PT-2026-3365
A security vulnerability has been detected in LigeroSmart up to 6.1.26. The affected element is an unknown function of the file /otrs/index.pl. Such manipulation of the argument TicketID leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed...
PT-2026-2631
Name of the Vulnerable Software and Affected Versions NETGEAR WiFi range extenders affected versions not specified Description A path traversal issue exists in NETGEAR WiFi range extenders. An attacker with LAN authentication can access the router's IP address and review the contents of the...
PT-2026-1732
Name of the Vulnerable Software and Affected Versions WP Page Permalink Extension versions prior to 1.5.5 Description The WP Page Permalink Extension plugin for WordPress is susceptible to a missing authorization issue. This occurs because of a lack of authorization checks within the cwpp trigger...
PT-2026-1848
Name of the Vulnerable Software and Affected Versions Plesk Obsidian versions 8.0.1 through 18.0.73 Description Plesk Obsidian versions 8.0.1 through 18.0.73 are susceptible to a Denial of Service DoS condition. The issue resides in the get password.php API endpoint, where a specifically crafted...
PT-2026-1623
Name of the Vulnerable Software and Affected Versions 1180px Shortcodes plugin for WordPress versions up to and including 1.1.1 Description The 1180px Shortcodes plugin for WordPress has a Stored Cross-Site Scripting issue because of inadequate input sanitization and output escaping. This affects...
PT-2026-45472
Name of the Vulnerable Software and Affected Versions Nextcloud versions 0.3.0 through 3.0.x Nextcloud versions 5.0.0 through 5.0.x Nextcloud versions 6.0.0 through 6.3.x Description A missing signature verification in User OIDC allows a malicious ID4me authority to identify as any user. This...
PT-2025-53291
Name of the Vulnerable Software and Affected Versions Marketing Fire Editorial Calendar versions 3.8.8 and earlier Description An authorization issue exists in the Editorial Calendar component of Marketing Fire Editorial Calendar. This allows exploitation of incorrectly configured access control...
PT-2025-50774
Name of the Vulnerable Software and Affected Versions SpaceX Starlink Dish versions 2024.12.04.mr46620 Description SpaceX Starlink Dish devices allow administrative actions via unauthenticated LAN gRPC requests, referred to as MARMALADE 2. The cross-origin policy can be bypassed by omitting a...
PT-2025-46876
Name of the Vulnerable Software and Affected Versions Wolfram Cloud affected versions not specified Description The default Java Virtual Machine JVM can access files and directories within /tmp/, including the $TemporaryDirectory of other users on the same cloud instance located at...
PT-2025-41408
Name of the Vulnerable Software and Affected Versions Juniper Security Director versions prior to 24.1R4 Description An Improper Neutralization of Input During Web Page Generation issue exists in Juniper Security Director, allowing an attacker to inject malicious scripts into the application. The...
PT-2025-46608
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The Linux kernel contains a flaw within the mptcp active enable function. This function is called from subflow finish connect, which is part of icsk-icsk af ops-sk rx dst set. The use of...
PT-2025-36941
Name of the Vulnerable Software and Affected Versions: pfSense CE affected versions not specified Description: The start-day parameter in /usr/local/www/status traffic totals.php does not undergo proper validation to ensure it is a numeric value or sanitized of HTML-related characters before bein...
PT-2025-34457 · Reolink · Reolink Smart 2K+ Plug-In Wi-Fi Video Doorbell
Name of the Vulnerable Software and Affected Versions: Reolink Smart 2K+ Plug-in Wi-Fi Video Doorbell with Chime version 3.0.0.4662 2503122283 Description: The device suffers from an Insecure Direct Object Reference IDOR vulnerability. This allows unauthorized attackers to access Admin-only...
PT-2025-35996
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The Linux kernel contains a flaw in the BPF subsystem related to jump offset calculation in tailcall functionality. An extra pass during BPF compilation can skip JIT context...
PT-2025-29613 · Cyberark · Secrets Manager +1
Name of the Vulnerable Software and Affected Versions: Conjur OSS versions 1.19.5 through 1.21.1 Secrets Manager, Self-Hosted versions 13.1 through 13.4.1 Description: Conjur provides secrets management and application identity for infrastructure. An authenticated attacker who can inject secrets ...
PT-2025-22871 · H3C · H3C Seccenter Smp-E1114P02
Name of the Vulnerable Software and Affected Versions: H3C SecCenter SMP-E1114P02 up to 20250513 Description: A vulnerability was found in the function Download of the file /cfgFile/1/download. The manipulation of the argument Name leads to path traversal. The attack may be initiated remotely...
PT-2025-15839 · National Instruments · Ni Labview
Name of the Vulnerable Software and Affected Versions: NI LabVIEW versions prior to 2025 Q1 Description: The issue is related to a DLL hijacking vulnerability due to an uncontrolled search path when loading NI Error Reporting, which may result in arbitrary code execution. Successful exploitation...
PT-2025-15635 · Dnn · Dnn
Name of the Vulnerable Software and Affected Versions: DNN formerly DotNetNuke versions prior to 9.13.2 Description: The issue allows uploading files with malicious content by renaming them to have an allowed file extension, such as renaming an executable file to have a .jpg extension. This could...
PT-2025-14742 · Unknown · Local Magic
Name of the Vulnerable Software and Affected Versions: matthewrubin Local Magic versions n/a through 2.6.0 Description: The issue is related to a Missing Authorization vulnerability, which allows exploiting incorrectly configured access control security levels. Recommendations: For versions n/a...
PT-2024-33200 · Unknown · Alist-Tvbox
Name of the Vulnerable Software and Affected Versions: alist-tvbox version 1.7.1 Description: The issue allows a remote attacker to execute arbitrary code via the "/atv-cli" file. This enables the attacker to potentially gain control over the system, allowing for unauthorized actions...
PT-2024-34148 · Suitecrm · Suitecrm
Name of the Vulnerable Software and Affected Versions: SuiteCRM versions prior to 7.14.6 SuiteCRM versions prior to 8.7.1 Description: The issue arises due to insufficient input validation and sanitization of the Publish Key field within the SuiteCRM application, allowing an attacker to inject...
PT-2024-33573 · Unknown · Mytweetlinks
Name of the Vulnerable Software and Affected Versions: MyTweetLinks versions n/a through 1.1.1 Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements in SQL commands, allowing Blind SQL Injection. This can lead to data compromise...
PT-2024-27218 · Linux +3 · Linux Kernel +3
Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: The issue is related to the loss of young/dirty bits during pagemap scan in the Linux kernel. Specifically, the make uffd wp pte function was previously doing pte = ptep getptep; ptep...
PT-2024-13997 · Janitza · Gridvis
Name of the Vulnerable Software and Affected Versions: Janitza GridVis versions 9.0.66 and earlier Description: The issue allows remote authenticated administrative users to execute arbitrary Groovy code due to exposed dangerous methods in the de.janitza.pasw.project.server.ServerDatabaseProject...
PT-2023-30654 · Unknown · Perfmatters
Name of the Vulnerable Software and Affected Versions: Perfmatters versions prior to 2.2.0 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an attacker can inject maliciou...
PT-2023-5316 · Acronis · Acronis Agent +2
Name of the Vulnerable Software and Affected Versions: Acronis Agent versions prior to build 32047 Acronis Cyber Protect 15 versions prior to build 35979 Description: The issue is related to the excessive collection of system information, which may lead to the disclosure of sensitive information...
PT-2025-40769
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The Linux kernel has a flaw related to the handling of nfsd file reference counts within the Network File System NFS copy codepath. Specifically, there is a potential for reference count...
PT-2023-19134 · Sourcecodester · Sourcecodester Faculty Evaluation System
Name of the Vulnerable Software and Affected Versions: SourceCodester Faculty Evaluation System version 1.0 Description: A critical issue affects the processing of the file admin/manage restriction.php, where the manipulation of the id argument leads to sql injection. The attack can be initiated...
PT-2022-28020 · Tenda · Tenda Ac15
Name of the Vulnerable Software and Affected Versions: Tenda A15 version 15.13.07.13 Description: A stack overflow issue was discovered, which can be triggered via the wepkey1 parameter at the "/goform/WifiBasicSet" API endpoint. Recommendations: For Tenda A15 version 15.13.07.13, avoid using the...
PT-2024-7887 · Linux +3 · Linux Kernel +3
Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: The issue is related to a NULL pointer dereference in the Linux kernel's gpio component. This occurs when removing debugfs entries while unbinding the driver, causing a NULL-pointer...
PT-2022-14263 · Unknown · Ion Driver
Name of the Vulnerable Software and Affected Versions: ion driver affected versions not specified Description: The issue is related to an incorrect bounds check in the ion driver, which could lead to local information disclosure without requiring additional execution privileges. User interaction ...
PT-2021-4809
Name of the Vulnerable Software and Affected Versions Linux Kernel version 5.14-rc3 Description This issue allows local attackers to escalate privileges on affected installations. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit thi...
PT-2021-4234
Name of the Vulnerable Software and Affected Versions Linux kernel versions up to 5.13.7 Description The issue allows an unprivileged BPF program to obtain sensitive information from kernel memory via a Speculative Store Bypass side-channel attack. This is possible because the protection mechanis...
PT-2020-6861 · Linux +5 · Linux Kernel +5
Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 5.8 Description: The issue is related to uncontrolled recursion in the lib/nlattr.c component of the Linux kernel. This can be exploited by attackers to cause a denial of service via a nested Netlink policy with...
PT-2019-8724 · Jenkins · Jenkins Config File Provider Plugin +1
Name of the Vulnerable Software and Affected Versions: Jenkins Config File Provider Plugin versions 3.1 and earlier Description: A cross-site scripting issue exists in the configfiles.jelly and providerlist.jelly files, allowing users who can configure configuration files to insert arbitrary HTML...
PT-2026-107974
Name of the Vulnerable Software and Affected Versions ImageMagick versions prior to 7.1.2-31 Description A heap buffer overflow occurs when a crafted call is made to the 'GetVirtualPixels' API. This allows attackers to overwrite heap memory through crafted input, which can lead to a server crash...
PT-2026-107506
Name of the Vulnerable Software and Affected Versions Telegram Desktop versions prior to 7.2.9 Description An IPC record-separator injection flaw exists in Core::Sandbox due to the failure to escape semicolons used as command separators when passing tg:// links to a running instance over a local...
PT-2026-92061
crawl4ai before 0.9.3 contains a DOM-based cross-site scripting vulnerability in the Docker Playground UI that assigns untrusted crawl results to element.innerHTML. Attackers can craft malicious PDFs with event-handler markup to execute JavaScript in the Playground origin and steal API tokens fro...
PT-2026-91934
Semaphore UI through 2.19.12 exempts GET and HEAD requests from project resource permission checks in GetMustCanMiddleware. Attackers with guest or task runner roles can read all project environments including plaintext secrets, credentials, and passwords via GET requests to the environment...
PT-2026-89805
Name of the Vulnerable Software and Affected Versions Sogou Input Method versions prior to 16.3.0.3498 Description A critical issue in the Windows version of Sogou Input Method allows a remote attacker to execute arbitrary code via a one-click attack. The flaw is exploited by the UNC3569 threat...
PT-2026-87543
Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network...
PT-2026-85626
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description In the fbdev component, the functions show mode, show modes, and store mode access fb info-modelist and fb info-mode without utilizing the lock fb info function. Because store modes...
PT-2026-83177
Incorrect access control in the startSlaveReboot function of TOTOLINK T6 4.1.5cu.748 B20211015 allows unauthenticated attackers to arbitrarily force a reboot via sending a crafted MQTT message...
PT-2026-82990
In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: core: Initialize hba-rpmbs list in ufshcd Initialize the hba-rpmbs list in ufshcd alloc host to prevent NULL pointer dereference in the device teardown path if ufs rpmb probe fails...
PT-2026-81297
A security flaw has been discovered in liketrek TREK up to 3.0.22. This affects an unknown function of the file server/src/nest/journey/journey-public.controller.ts of the component Public Journey Photo Proxy. Performing a manipulation results in path traversal. The attack can be initiated...
PT-2026-81206
Name of the Vulnerable Software and Affected Versions U-Boot versions prior to 2026.10-rc5 Description An out-of-bounds write exists in the RLE8 bitmap decoder within the video subsystem. The video display rle8 bitmap function in drivers/video/video bmp.c decodes run-length encoded streams direct...
PT-2026-79322
Name of the Vulnerable Software and Affected Versions Apache CloudStack versions 4.18.0.0 through 4.20.3.0 Apache CloudStack versions 4.21.0.0 through 4.22.1.0 Description Improper Privilege Management in the Two-factor authentication plugin allows for the bypass of the two-factor authentication...
PT-2026-79464
Name of the Vulnerable Software and Affected Versions Esri Portal for ArcGIS versions prior to 12.1 Description A missing authentication flaw allows a remote, unauthenticated attacker to access a specific resource that is intended to be restricted to authenticated users. This resource does not...