PT-2025-27581

Name of the Vulnerable Software and Affected Versions: Apache Guacamole versions 1.5.5 and older Description: The issue is related to improper validation of console codes received from servers via text-based protocols like SSH. A malicious user with access to a text-based connection could execute...

PT-2025-15250 · Ruoyi · Ruoyi

Name of the Vulnerable Software and Affected Versions: RUoYi version 4.8.0 Description: An issue in RUoYi allows a remote attacker to escalate privileges via the cancelAuthUserAll method, which does not properly validate whether the requesting user has administrative privileges. Recommendations:...

PT-2025-2937 · Suse +1 · Suse Linux Enterprise Server +1

Name of the Vulnerable Software and Affected Versions: Teradata versions prior to 2024-11-04 Description: The issue concerns the mismanagement of groups by certain Teradata account-handling code when used with SUSE Enterprise Linux Server. Specifically, during an operating system change from SUSE...

PT-2024-17176 · Unknown · Cph2 Echarge Firmware

Name of the Vulnerable Software and Affected Versions: cph2 echarge firmware versions through 2.0.4 Description: The issue affects devices that communicate with the eCharge cloud infrastructure over an insecure channel, as peer verification is disabled. This allows remote unauthenticated users,...

PT-2024-43: Remote code execution (RCE) in MediaCMS

The vulnerability was identified in MediaCMS, versions 4.1.0. Discovered vulnerability allows an attacker to execute OS commands on a vulnerable host, gain control over resources, and penetrate the internal network. Vulnerability status: Confirmed by vendor Date of vulnerability remediation:...

PT-2024-38907 · WordPress · Woocommerce Photo Reviews Premium

Name of the Vulnerable Software and Affected Versions: WooCommerce Photo Reviews Premium plugin for WordPress versions up to, and including, 1.3.13.2 Description: The issue is due to the plugin not properly validating what user transient is being used in the login function and not properly...

PT-2024-22939 · WordPress · Svs Pricing Tables

Name of the Vulnerable Software and Affected Versions: SVS Pricing Tables plugin for WordPress versions up to, and including, 1.0.4 Description: The issue is related to Stored Cross-Site Scripting via pricing table settings due to insufficient input sanitization and output escaping. This allows...

PT-2024-25281 · Sourcecodester · Aplaya Beach Resort Online Reservation System

Name of the Vulnerable Software and Affected Versions: SourceCodester Aplaya Beach Resort Online Reservation System version 1.0 Description: A critical issue has been found in the system, affecting some unknown functionality of the file admin/mod room/index.php. The manipulation of the id argumen...

PT-2024-18358 · Dassault Systèmes · Dassault Systèmes Edrawings

Name of the Vulnerable Software and Affected Versions: Dassault Systèmes eDrawings affected versions not specified Description: The issue allows remote code execution via various file parsing vulnerabilities, including heap-based buffer overflow, memory corruption, out-of-bounds read, out-of-boun...

PT-2024-13729 · Couchbase · Couchbase Server

Name of the Vulnerable Software and Affected Versions: Couchbase Server versions 7.1.x through 7.2.3 Description: The issue concerns the lack of authentication requirement for certain API endpoints. Specifically, the /admin/stats and /admin/vitals endpoints on TCP port 8093 of localhost do not...

PT-2023-6205 · Oracle · Oracle Enterprise Session Border Controller

Name of the Vulnerable Software and Affected Versions: Oracle Enterprise Session Border Controller versions 9.0 through 9.2 Description: The issue is related to insufficient input validation in the Web UI component. It allows an unauthenticated attacker with network access via HTTPS to compromise...

PT-2023-30080 · Icms2 · Icms2

Name of the Vulnerable Software and Affected Versions: instantsoft/icms2 versions prior to 2.16.1 Description: The issue is related to Cross-site Scripting XSS - Reflected. This is a type of attack where an attacker injects malicious code into a website, and the website reflects the code back to...

PT-2023-8303 · D Link · D-Link Dir-X3260

Name of the Vulnerable Software and Affected Versions: D-Link DIR-X3260 affected versions not specified Description: This issue allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-X3260 routers. The flaw exists within the prog.cgi binary, which...

PT-2023-17767 · Sourcecodester · Sourcecodester Vehicle Service Management System

Name of the Vulnerable Software and Affected Versions: SourceCodester Vehicle Service Management System version 1.0 Description: A vulnerability was found in the SourceCodester Vehicle Service Management System, affecting some unknown functionality of the file /inc/topBarNav.php. The manipulation...

PT-2023-20477 · Arm · Arm Aarch64Cryptolib

Name of the Vulnerable Software and Affected Versions: Arm AArch64cryptolib versions before 86065c6 Description: The issue concerns the armv8 dec aes gcm full API, which fails to verify the authentication tag of AES-GCM protected data. This failure is due to an improperly initialized variable,...

PT-2023-12362 · Unem +1 · Unem +1

Name of the Vulnerable Software and Affected Versions: FOXMAN-UN versions R9C through R16A UNEM versions R9C through R16A Description: The issue affects the DES implementation in the affected product versions, which use a default key for encryption. Successful exploitation allows an attacker to...

PT-2022-28020 · Tenda · Tenda Ac15

Name of the Vulnerable Software and Affected Versions: Tenda A15 version 15.13.07.13 Description: A stack overflow issue was discovered, which can be triggered via the wepkey1 parameter at the "/goform/WifiBasicSet" API endpoint. Recommendations: For Tenda A15 version 15.13.07.13, avoid using the...

PT-2022-7635 · Linux +2 · Linux Kernel +2

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: The issue is related to the sof-nau8825 component in the Linux kernel, where the maximum name length for a platform device id entry is exceeded, causing an error. This can lead to a...

PT-2022-26953 · Siemens · Simcenter Star-Ccm+

Name of the Vulnerable Software and Affected Versions: Simcenter STAR-CCM+ versions prior to V2306 Description: A vulnerability has been identified in the affected application, where it improperly assigns file permissions to installation folders. This could allow a local attacker with an...

PT-2022-25860 · Bento4 · Bento4

Name of the Vulnerable Software and Affected Versions: Bento4 version 1.6.0-639 Description: A memory leak was discovered in the AP4 AtomFactory::CreateAtomFromStream function in mp4split. Recommendations: For version 1.6.0-639, consider restricting the use of the AP4...

PT-2022-18870 · Mediawiki +1 · Mediawiki +1

Name of the Vulnerable Software and Affected Versions: MediaWiki versions prior to 1.35.6 MediaWiki versions 1.36.x prior to 1.36.4 MediaWiki versions 1.37.x prior to 1.37.2 Description: An issue was discovered in MediaWiki where users with the editinterface permission can trigger infinite...

PT-2022-6506 · Linux +6 · Linux Kernel +6

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: A flaw in the Linux kernel's X86 CPU Power management options functionality was found, related to the speculative execution behavior kind of attacks. This issue arises when a user...

PT-2022-16153 · Unknown · Xlsx-Streamer

Name of the Vulnerable Software and Affected Versions: xlsx-streamer versions prior to 2.1.0 Description: The issue concerns the XML parser used in the Excel-Streaming-Reader, which did not apply all necessary settings to prevent XML Entity Expansion issues. This problem is resolved by upgrading ...

PT-2022-2366 · Linux +5 · Linux Kernel +5

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 5.16.12 Description: The issue is related to the Linux kernel's USB gadget driver, specifically in the udc-xilinx.c file. It involves an array index that is not properly validated, potentially allowing a remote...

PT-2022-1628 · Linux +10 · Linux Kernel +10

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 5.17-rc4 Description: A flaw in the kvm s390 guest sida op function in KVM for s390 in the Linux kernel allows a local attacker with normal user privileges to obtain unauthorized memory write access. This issue ...

PT-2021-8139 · Linux +3 · Linux Kernel +3

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: The issue is related to a global-out-of-bounds problem in the mediatek component of the Linux kernel. When the eint virtual eint number is greater than the gpio number, it may produce ...

PT-2020-6996 · Xwiki · Xwiki Platform

Name of the Vulnerable Software and Affected Versions: XWiki Platform versions 6.3-milestone-2 through 13.10.4 XWiki Platform versions 11.10.6 through 14.3-rc-1 are not needed as they are included in the range above, so the final version is: XWiki Platform versions 6.3-milestone-2 through 13.10.4...

PT-2021-7643 · Samba +6 · Samba +6

Name of the Vulnerable Software and Affected Versions: samba affected versions not specified Description: A flaw was found in samba, related to a race condition in the password lockout code. This issue may lead to the risk of brute force attacks being successful if special conditions are met,...

PT-2020-6690 · Linux +4 · Linux Kernel +4

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 5.6.2 Description: A race condition between the VT DISALLOCATE ioctl and closing/opening of ttys could lead to a use-after-free. This issue is related to the implementation of the VT DISALLOCATE call in the Linu...

PT-2019-15858 · Alfresco · Alfresco Enterprise

Name of the Vulnerable Software and Affected Versions: Alfresco Enterprise versions prior to 5.2.5 Description: The issue allows for stored XSS via an uploaded HTML document. This means an attacker can upload a malicious HTML file to the system, which can then execute scripts on the user's browse...

PT-2018-4220 · F5 · F5 Big-Ip

Name of the Vulnerable Software and Affected Versions: F5 BIG-IP systems versions 10.x through 10.2.4 before HF9 F5 BIG-IP systems versions 11.x through 11.2.1 before HF12 F5 BIG-IP systems version 11.3.0 before HF10 F5 BIG-IP systems version 11.4.0 before HF8 F5 BIG-IP systems version 11.4.1...

PT-2006-5742 · Ipswitch · Ws Ftp Server

Name of the Vulnerable Software and Affected Versions: WS FTP Server versions prior to 5.05 Hotfix 1 Description: The issue prevents certain sensitive information from being displayed in the Files and Summary tabs of the log analyzer. Recommendations: For versions prior to 5.05 Hotfix 1, apply...

PT-2026-92943

Vulnerability in the Helidon product of Oracle Fusion Middleware component: helidon-microprofile-security. Supported versions that are affected are 4.0.0-4.5.4. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Helidon. Successful attacks o...

PT-2026-92178

Dell Wyse Management Suite, versions prior to 2605.0.3.683, contain an Unrestricted Upload of File with Dangerous Type vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Remote execution...

PT-2026-88765

Tanium addressed an improper access controls vulnerability in Tanium Server...

PT-2026-89045

News: Schneider Electric, Siemens, and Aveva ship ICS Patch Tuesday. Worst new hit: Modicon M580 auth CVE-2026-3869 CVSS 9.2. Siemens flags critical Reyrolle 7SR5, OIS, Industrial Edge bugs. OT owners: patch controllers now. https://t.co/TT7I5NW8Ee...

PT-2026-82998

In the Linux kernel, the following vulnerability has been resolved: dmaengine: idxd: fix double free of wq, engine, and group structs The release callbacks for wq, engine, and group devices idxd conf wq release, idxd conf engine release, idxd conf group release each call kfree on the enclosing...

PT-2026-82744

A weakness in the client-side encryption configuration surface of the MongoDB C Driver causes sensitive key-management credential material supplied by the application to be reproduced verbatim in the driver's human-readable diagnostic representation of its client settings, instead of being masked...

PT-2026-82598

openssl encrypt pip package openssl-encrypt versions = 1.4.8 contain a CWD-relative configuration file resolution flaw in crypt settings.py, where CONFIG FILE originally the absolute per-user path /.crypt settings.json is reassigned at line 84 to the bare relative name 'crypt settings.json'. As a...

PT-2026-80870

RansomLook contains a path traversal vulnerability in the handling of the screen field associated with group posts. The GroupPost.get API handler concatenates the database-controlled screen value directly with the application's source/ directory and opens the resulting path without verifying that...

PT-2026-81015

RansomLook exposed complete API keys in the HTML source of the authenticated /admin/apikeys administration page. Although the interface displayed only a shortened representation of each key, the full token was embedded in hidden form fields used by the enable/disable, private-access, and delete...

PT-2026-79656

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB read in rtw get wpa ie rtw get wpa ie reads bytes at fixed offsets into a vendor-specific information element without checking that the element is long enough, causing an out-of-bounds read for a short...

PT-2026-79322

Name of the Vulnerable Software and Affected Versions Apache CloudStack versions 4.18.0.0 through 4.20.3.0 Apache CloudStack versions 4.21.0.0 through 4.22.1.0 Description Improper Privilege Management in the Two-factor authentication plugin allows for the bypass of the two-factor authentication...

PT-2026-79464

There is a missing authentication vulnerability in Esri Portal for ArcGIS versions 12.0 and prior that may allow a remote, unauthenticated attacker to access a specific resource not user content that should only be accessible by authenticated users. Users working with ArcGIS Enterprise 11.1, 11.3...

PT-2026-78776

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.2.6 Splunk Enterprise versions prior to 10.0.9 Splunk Enterprise versions prior to 9.4.14 Description An unauthenticated user can trick an authenticated user into executing arbitrary Search Processing...

PT-2026-73229

Permission control vulnerability in the clipboard module. Impact: Successful exploitation of this vulnerability may affect service confidentiality...

PT-2026-73132

The WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.8.4. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...

PT-2026-72706

In the Linux kernel, the following vulnerability has been resolved: handshake: Require admin permission for DONE command ACCEPT and DONE are the two downcalls of the handshake genl family, both intended for use by the trusted handshake agent tlshd. ACCEPT already requires GENL ADMIN PERM; DONE ha...

PT-2026-72952

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: fix stack info leak in RME Digiface status snd rme digiface read status reads a four-word status block from the device into an uninitialised on-stack le32 buf4 and, whenever the vendor control-IN transfer does no...

PT-2026-72417

In the Linux kernel, the following vulnerability has been resolved: batman-adv: clean untagged VLAN on netdev registration failure When an mesh interface is registered, it creates an untagged struct batadv meshif vlan on top of it via the NETDEV REGISTER notifier. But in this process, another...