PT-2025-46876

Name of the Vulnerable Software and Affected Versions Wolfram Cloud affected versions not specified Description The default Java Virtual Machine JVM can access files and directories within /tmp/, including the $TemporaryDirectory of other users on the same cloud instance located at...

PT-2025-39439

Name of the Vulnerable Software and Affected Versions petstore version 1.0.7 Description A Cross Site Scripting issue exists in petstore version 1.0.7. This allows a remote attacker to execute arbitrary code by providing a crafted script to the /api/v3/pet API endpoint. The attack vector involves...

PT-2025-46608

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The Linux kernel contains a flaw within the mptcp active enable function. This function is called from subflow finish connect, which is part of icsk-icsk af ops-sk rx dst set. The use of...

PT-2025-36941

Name of the Vulnerable Software and Affected Versions: pfSense CE affected versions not specified Description: The start-day parameter in /usr/local/www/status traffic totals.php does not undergo proper validation to ensure it is a numeric value or sanitized of HTML-related characters before bein...

PT-2025-34457 · Reolink · Reolink Smart 2K+ Plug-In Wi-Fi Video Doorbell

Name of the Vulnerable Software and Affected Versions: Reolink Smart 2K+ Plug-in Wi-Fi Video Doorbell with Chime version 3.0.0.4662 2503122283 Description: The device suffers from an Insecure Direct Object Reference IDOR vulnerability. This allows unauthorized attackers to access Admin-only...

PT-2025-35996

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The Linux kernel contains a flaw in the BPF subsystem related to jump offset calculation in tailcall functionality. An extra pass during BPF compilation can skip JIT context...

PT-2025-29613 · Cyberark · Secrets Manager +1

Name of the Vulnerable Software and Affected Versions: Conjur OSS versions 1.19.5 through 1.21.1 Secrets Manager, Self-Hosted versions 13.1 through 13.4.1 Description: Conjur provides secrets management and application identity for infrastructure. An authenticated attacker who can inject secrets ...

PT-2025-22871 · H3C · H3C Seccenter Smp-E1114P02

Name of the Vulnerable Software and Affected Versions: H3C SecCenter SMP-E1114P02 up to 20250513 Description: A vulnerability was found in the function Download of the file /cfgFile/1/download. The manipulation of the argument Name leads to path traversal. The attack may be initiated remotely...

PT-2025-15839 · National Instruments · Ni Labview

Name of the Vulnerable Software and Affected Versions: NI LabVIEW versions prior to 2025 Q1 Description: The issue is related to a DLL hijacking vulnerability due to an uncontrolled search path when loading NI Error Reporting, which may result in arbitrary code execution. Successful exploitation...

PT-2025-15635 · Dnn · Dnn

Name of the Vulnerable Software and Affected Versions: DNN formerly DotNetNuke versions prior to 9.13.2 Description: The issue allows uploading files with malicious content by renaming them to have an allowed file extension, such as renaming an executable file to have a .jpg extension. This could...

PT-2025-14742 · Unknown · Local Magic

Name of the Vulnerable Software and Affected Versions: matthewrubin Local Magic versions n/a through 2.6.0 Description: The issue is related to a Missing Authorization vulnerability, which allows exploiting incorrectly configured access control security levels. Recommendations: For versions n/a...

PT-2024-33200 · Unknown · Alist-Tvbox

Name of the Vulnerable Software and Affected Versions: alist-tvbox version 1.7.1 Description: The issue allows a remote attacker to execute arbitrary code via the "/atv-cli" file. This enables the attacker to potentially gain control over the system, allowing for unauthorized actions...

PT-2024-34148 · Suitecrm · Suitecrm

Name of the Vulnerable Software and Affected Versions: SuiteCRM versions prior to 7.14.6 SuiteCRM versions prior to 8.7.1 Description: The issue arises due to insufficient input validation and sanitization of the Publish Key field within the SuiteCRM application, allowing an attacker to inject...

PT-2024-33573 · Unknown · Mytweetlinks

Name of the Vulnerable Software and Affected Versions: MyTweetLinks versions n/a through 1.1.1 Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements in SQL commands, allowing Blind SQL Injection. This can lead to data compromise...

PT-2024-31991 · Mecha Cms · Mecha Cms

Name of the Vulnerable Software and Affected Versions: Mecha CMS version 3.0.0 Description: The issue allows an attacker to construct cookies and URIs that bypass user identity checks. Parameters can then be passed through the POST method, resulting in the deletion of arbitrary files or website...

PT-2024-12501 · Unknown · Openbmc Firmware

Name of the Vulnerable Software and Affected Versions: OpenBMC Firmware versions prior to egs-1.14-0 OpenBMC Firmware versions prior to bhs-0.27 Description: The issue is related to an uncaught exception in OpenBMC Firmware for some IntelR Server Platforms, which may allow an authenticated user t...

PT-2024-27218 · Linux +3 · Linux Kernel +3

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: The issue is related to the loss of young/dirty bits during pagemap scan in the Linux kernel. Specifically, the make uffd wp pte function was previously doing pte = ptep getptep; ptep...

PT-2024-13997 · Janitza · Gridvis

Name of the Vulnerable Software and Affected Versions: Janitza GridVis versions 9.0.66 and earlier Description: The issue allows remote authenticated administrative users to execute arbitrary Groovy code due to exposed dangerous methods in the de.janitza.pasw.project.server.ServerDatabaseProject...

PT-2024-18358 · Dassault Systèmes · Dassault Systèmes Edrawings

Name of the Vulnerable Software and Affected Versions: Dassault Systèmes eDrawings affected versions not specified Description: The issue allows remote code execution via various file parsing vulnerabilities, including heap-based buffer overflow, memory corruption, out-of-bounds read, out-of-boun...

PT-2023-30654 · Unknown · Perfmatters

Name of the Vulnerable Software and Affected Versions: Perfmatters versions prior to 2.2.0 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an attacker can inject maliciou...

PT-2025-40769

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The Linux kernel has a flaw related to the handling of nfsd file reference counts within the Network File System NFS copy codepath. Specifically, there is a potential for reference count...

PT-2023-19134 · Sourcecodester · Sourcecodester Faculty Evaluation System

Name of the Vulnerable Software and Affected Versions: SourceCodester Faculty Evaluation System version 1.0 Description: A critical issue affects the processing of the file admin/manage restriction.php, where the manipulation of the id argument leads to sql injection. The attack can be initiated...

PT-2022-28020 · Tenda · Tenda Ac15

Name of the Vulnerable Software and Affected Versions: Tenda A15 version 15.13.07.13 Description: A stack overflow issue was discovered, which can be triggered via the wepkey1 parameter at the "/goform/WifiBasicSet" API endpoint. Recommendations: For Tenda A15 version 15.13.07.13, avoid using the...

PT-2024-7887 · Linux +3 · Linux Kernel +3

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: The issue is related to a NULL pointer dereference in the Linux kernel's gpio component. This occurs when removing debugfs entries while unbinding the driver, causing a NULL-pointer...

PT-2022-14263 · Unknown · Ion Driver

Name of the Vulnerable Software and Affected Versions: ion driver affected versions not specified Description: The issue is related to an incorrect bounds check in the ion driver, which could lead to local information disclosure without requiring additional execution privileges. User interaction ...

PT-2021-4809

Name of the Vulnerable Software and Affected Versions Linux Kernel version 5.14-rc3 Description This issue allows local attackers to escalate privileges on affected installations. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit thi...

PT-2021-4234

Name of the Vulnerable Software and Affected Versions Linux kernel versions up to 5.13.7 Description The issue allows an unprivileged BPF program to obtain sensitive information from kernel memory via a Speculative Store Bypass side-channel attack. This is possible because the protection mechanis...

PT-2020-6861 · Linux +5 · Linux Kernel +5

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 5.8 Description: The issue is related to uncontrolled recursion in the lib/nlattr.c component of the Linux kernel. This can be exploited by attackers to cause a denial of service via a nested Netlink policy with...

PT-2019-8724 · Jenkins · Jenkins Config File Provider Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Config File Provider Plugin versions 3.1 and earlier Description: A cross-site scripting issue exists in the configfiles.jelly and providerlist.jelly files, allowing users who can configure configuration files to insert arbitrary HTML...

PT-2012-3996

Name of the Vulnerable Software and Affected Versions Apache Roller versions prior to 5.0.1 Description The issue concerns multiple cross-site request forgery CSRF vulnerabilities in the admin/editor console. These vulnerabilities allow remote attackers to hijack the authentication of admins or...

PT-2026-107974

Name of the Vulnerable Software and Affected Versions ImageMagick versions prior to 7.1.2-31 Description A heap buffer overflow occurs when a crafted call is made to the 'GetVirtualPixels' API. This allows attackers to overwrite heap memory through crafted input, which can lead to a server crash...

PT-2026-92061

crawl4ai before 0.9.3 contains a DOM-based cross-site scripting vulnerability in the Docker Playground UI that assigns untrusted crawl results to element.innerHTML. Attackers can craft malicious PDFs with event-handler markup to execute JavaScript in the Playground origin and steal API tokens fro...

PT-2026-92860

Name of the Vulnerable Software and Affected Versions Oracle E-Business Suite Oracle Applications Manager versions 12.2.3 through 12.2.15 Description A flaw in the Oracle Diagnostics Interfaces component allows a low privileged attacker with network access via HTTP to compromise the Oracle...

PT-2026-91934

Semaphore UI through 2.19.12 exempts GET and HEAD requests from project resource permission checks in GetMustCanMiddleware. Attackers with guest or task runner roles can read all project environments including plaintext secrets, credentials, and passwords via GET requests to the environment...

PT-2026-89805

Name of the Vulnerable Software and Affected Versions Sogou Input Method versions prior to 16.3.0.3498 Description A critical issue in the Windows version of Sogou Input Method allows a remote attacker to execute arbitrary code via a one-click attack. The flaw is exploited by the UNC3569 threat...

PT-2026-87543

Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network...

PT-2026-83177

Incorrect access control in the startSlaveReboot function of TOTOLINK T6 4.1.5cu.748 B20211015 allows unauthenticated attackers to arbitrarily force a reboot via sending a crafted MQTT message...

PT-2026-82990

In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: core: Initialize hba-rpmbs list in ufshcd Initialize the hba-rpmbs list in ufshcd alloc host to prevent NULL pointer dereference in the device teardown path if ufs rpmb probe fails...

PT-2026-81297

A security flaw has been discovered in liketrek TREK up to 3.0.22. This affects an unknown function of the file server/src/nest/journey/journey-public.controller.ts of the component Public Journey Photo Proxy. Performing a manipulation results in path traversal. The attack can be initiated...

PT-2026-79322

Name of the Vulnerable Software and Affected Versions Apache CloudStack versions 4.18.0.0 through 4.20.3.0 Apache CloudStack versions 4.21.0.0 through 4.22.1.0 Description Improper Privilege Management in the Two-factor authentication plugin allows for the bypass of the two-factor authentication...

PT-2026-79464

Name of the Vulnerable Software and Affected Versions Esri Portal for ArcGIS versions prior to 12.1 Description A missing authentication flaw allows a remote, unauthenticated attacker to access a specific resource that is intended to be restricted to authenticated users. This resource does not...

PT-2026-80741

Summary A process-global nonce cache with no eviction policy allows an unauthenticated remote attacker to exhaust server heap memory by repeatedly opening sessions, causing the node-opcua server process to crash. Affected versions: = 2.165.0 Tested version: 2.165.0 CVSS Score: 7.5 High CVSS Vecto...

PT-2026-78521

Name of the Vulnerable Software and Affected Versions Cisco BroadWorks affected versions not specified Description An issue in the Open Client Interface OCI XML Parser allows an unauthenticated remote attacker to read sensitive configuration information. This occurs because the parser improperly...

PT-2026-77158

Name of the Vulnerable Software and Affected Versions CodeWhale versions 0.8.41 through 0.8.63 Description The exec shell interact alias exec interact tool incorrectly returns ApprovalRequirement::Auto for its approval requirement. This behavior overrides the default required approval for tools...

PT-2026-77084

Unauthenticated Cross Site Scripting XSS in Autopay = 5.0.0 versions...

PT-2026-76717

Name of the Vulnerable Software and Affected Versions deepmerge-ts versions prior to 8.0.0 Description The library fails to track visited objects or object pairs during the recursive merging of records. When two input values contain self-references at the same property path, the merge logic...

PT-2026-73097

Name of the Vulnerable Software and Affected Versions Kubio AI Page Builder versions prior to 2.8.6 Description An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. Authenticated attackers with contributor-level access or...

PT-2026-73132

The WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.8.4. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...

PT-2026-72502

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the regulator core where the regulator lock two function incorrectly tests for EDEADLOCK instead of EDEADLK when handling return values from ww mutex lock. While these...

PT-2026-72657

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the xprtrdma component where the rpcrdma cm event handler function incorrectly handles the RDMA CM EVENT ADDR CHANGE event. When this event occurs before RDMA CM EVENT...