PT-2023-29931 · Mybb +1 · Mybb +1

Name of the Vulnerable Software and Affected Versions: MyBB versions prior to 1.8.37 Description: The issue arises from custom MyCode BBCode for the visual editor SCEditor not escaping input properly when rendering HTML, resulting in a DOM-based XSS vulnerability. This weakness can be exploited b...

PT-2023-11494 · Binaryen · Binaryen

Name of the Vulnerable Software and Affected Versions: Binaryen version 1.38.26 Description: A heap-buffer-overflow issue exists in the wasm::WasmBinaryBuilder::visitBlockwasm::Block function in src/wasm/wasm-binary.cpp. This can be triggered by a crafted wasm input, leading to a segmentation fau...

PT-2023-25413 · WordPress · Simple Author Box

Name of the Vulnerable Software and Affected Versions: The Simple Author Box WordPress plugin versions prior to 2.52 Description: The issue is related to the disclosure of arbitrary user information due to a lack of verification of the user ID before outputting information about that user. This c...

PT-2023-19831 · WordPress · Stop Spammers Security

Name of the Vulnerable Software and Affected Versions: The Stop Spammers Security | Block Spam Users, Comments, Forms WordPress plugin versions prior to 2023 Description: The issue is related to a Reflected Cross-Site Scripting problem. It occurs because various parameters are not properly...

PT-2022-19289 · F Secure +1 · F-Secure +1

Name of the Vulnerable Software and Affected Versions: F-Secure and WithSecure products affected versions not specified Description: A Denial-of-Service issue was found where the aerdl.dll may enter an infinite loop when unpacking PE files, potentially causing the scanning engine to crash...

PT-2026-34859

Name of the Vulnerable Software and Affected Versions Delta Electronics AS320T affected versions not specified Description The device fails to verify the length of the buffer used for the directory name, which may lead to a buffer overflow a condition where a program writes more data to a storage...

PT-2022-12288 · Plesk · Plesk Cms

Name of the Vulnerable Software and Affected Versions: Plesk CMS version 18.0.37 Description: The issue is related to an insecure permissions vulnerability that allows privilege escalation from user to admin rights. According to the vendor, this is a site-specific problem affecting websites of on...

PT-2020-14874 · Razer · Razer Chroma Sdk Rest Server

Name of the Vulnerable Software and Affected Versions: Razer Chroma SDK Rest Server versions 3.12.17 and earlier Description: The issue allows remote attackers to execute arbitrary programs due to a race condition. This condition occurs when a file created under "%PROGRAMDATA%Razer ChromaSDKApps"...

PT-2019-15858 · Alfresco · Alfresco Enterprise

Name of the Vulnerable Software and Affected Versions: Alfresco Enterprise versions prior to 5.2.5 Description: The issue allows for stored XSS via an uploaded HTML document. This means an attacker can upload a malicious HTML file to the system, which can then execute scripts on the user's browse...

PT-2019-4415 · Linux +2 · Linux Kernel +2

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 5.3.6 Description: A memory leak in the nfp abm u32 knode replace function in drivers/net/ethernet/netronome/nfp/abm/cls.c allows attackers to cause a denial of service memory consumption. The issue has been...

PT-2018-4220 · F5 · F5 Big-Ip

Name of the Vulnerable Software and Affected Versions: F5 BIG-IP systems versions 10.x through 10.2.4 before HF9 F5 BIG-IP systems versions 11.x through 11.2.1 before HF12 F5 BIG-IP systems version 11.3.0 before HF10 F5 BIG-IP systems version 11.4.0 before HF8 F5 BIG-IP systems version 11.4.1...

PT-2012-5947

Name of the Vulnerable Software and Affected Versions Java Open Single Sign-On Project Home JOSSO affected versions not specified Description The issue allows remote attackers to forge messages and bypass authentication via a SAML assertion that lacks a Signature element, also known as a "Signatu...

PT-2012-5811

Name of the Vulnerable Software and Affected Versions OSClass versions prior to 2.3.5 Description The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via the id parameter in a 1 edit category post or 2 enable category action to "index.php". Recommendations Fo...

PT-2012-5570

Name of the Vulnerable Software and Affected Versions Siche search module version 0.5 for Zeroboard Description The issue is related to a cross-site scripting XSS vulnerability. This vulnerability allows remote attackers to inject arbitrary web script or HTML via the search parameter in the...

PT-2012-5163

Name of the Vulnerable Software and Affected Versions Palo Alto Networks Global Protect Portal, Global Protect Gateway, and SSL VPN portals versions 3.1.x through 3.1.11 Palo Alto Networks Global Protect Portal, Global Protect Gateway, and SSL VPN portals versions 4.0.x through 4.0.5 Description ...

PT-2012-3996

Name of the Vulnerable Software and Affected Versions Apache Roller versions prior to 5.0.1 Description The issue concerns multiple cross-site request forgery CSRF vulnerabilities in the admin/editor console. These vulnerabilities allow remote attackers to hijack the authentication of admins or...

PT-2011-4299

Name of the Vulnerable Software and Affected Versions Ruby on Rails version 3.0.5 Description The issue concerns the to s method in actionpack/lib/action dispatch/middleware/remote ip.rb, which fails to validate the X-Forwarded-For header in requests from IP addresses on a Class C network. This...

PT-2026-107506

Name of the Vulnerable Software and Affected Versions Telegram Desktop versions prior to 7.2.9 Description An IPC record-separator injection flaw exists in Core::Sandbox due to the failure to escape semicolons used as command separators when passing tg:// links to a running instance over a local...

PT-2026-93337

Name of the Vulnerable Software and Affected Versions Octopus Server affected versions not specified Description A path traversal flaw exists where a user with permissions to modify non built-in external feeds can overwrite arbitrary files on the server. In certain configurations, this action cou...

PT-2026-92737

Name of the Vulnerable Software and Affected Versions Oracle Siebel CRM versions 17.0 through 26.7 Description A flaw in the Server Infrastructure component of the Siebel CRM Deployment product allows a low privileged attacker with access to the execution infrastructure to compromise the system...

PT-2026-91938

Name of the Vulnerable Software and Affected Versions Casdoor versions prior to 4.4.1 Description An authorization bypass exists in the '/api/mcp' endpoint. Attackers possessing a valid clientId and clientSecret from any single application can gain unrestricted access to user administration acros...

PT-2026-93000

Name of the Vulnerable Software and Affected Versions Oracle Hyperion Financial Management version 11.2.26.0.000 Description A security flaw in the Security component allows a low privileged attacker with network access via HTTP to compromise the system. Successful exploitation can lead to...

PT-2026-92860

Name of the Vulnerable Software and Affected Versions Oracle E-Business Suite Oracle Applications Manager versions 12.2.3 through 12.2.15 Description A flaw in the Oracle Diagnostics Interfaces component allows a low privileged attacker with network access via HTTP to compromise the Oracle...

PT-2026-90997

An issue was discovered in DPU in Samsung Mobile Processor Exynos 1280, 2200, and 1380. A heap overflow in the Exynos DRM HDR driver due to improper buffer size validation leads to kernel memory corruption and a system crash...

PT-2026-89864

Name of the Vulnerable Software and Affected Versions SGLang affected versions not specified Description SGLang allows unauthenticated pickle deserialization through the '/update weights from tensor' endpoint when no authentication keys are configured. The SafeUnpickler policy can be bypassed...

PT-2026-88163

In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, user objects can appear as nested field values in other deserialized XML objects, allowing attackers with Overall/Read permission to create user objects by submitting crafted XML...

PT-2026-87706

Name of the Vulnerable Software and Affected Versions Windows HTTP Print Provider affected versions not specified Description A heap-based buffer overflow exists in the Windows HTTP Print Provider. This issue allows an unauthorized remote attacker to execute arbitrary code over a network,...

PT-2026-86344

🚨 CVE-2026-84021 The Bold Page Builder WordPress plugin before 5.9.8 does not properly validate a link URL before outputting it in an HTML attribute, relying on a filter that can be evaded, allowing users with the Contributor role and above to inject arbitrary web scripts that execute when a user...

PT-2026-84792

A path traversal vulnerability in Jenkins Allure Plugin 2.35.2 and earlier allows attackers with Item/Read permission on jobs that publish Allure report results to read arbitrary files on the Jenkins controller's file system...

PT-2026-82998

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A double free issue exists in the dmaengine idxd component. The release callbacks idxd conf wq release, idxd conf engine release, and idxd conf group release call kfree on the enclosing...

PT-2026-82514

ccoap 77f55c4b466e99327c24ace8a2913d3ba7e2ccd5 contains a null pointer dereference vulnerability in the coap dump msg function when processing COAP messages containing options with zero length...

PT-2026-81297

A security flaw has been discovered in liketrek TREK up to 3.0.22. This affects an unknown function of the file server/src/nest/journey/journey-public.controller.ts of the component Public Journey Photo Proxy. Performing a manipulation results in path traversal. The attack can be initiated...

PT-2026-79483

Name of the Vulnerable Software and Affected Versions CrossWatch versions prior to 0.9.21 Description CrossWatch is a synchronization engine. An unauthenticated network attacker can access the 'GET /api/app-auth/status' endpoint without credentials. This endpoint returns the other sessions array,...

PT-2026-79378

Joomla Extension - yootheme.com - Authenticated, privileged arbitrary file read in YOOtheme Pro 2.3.0-5.0.40 - The Filesystem source's path filter is vulnerable to glob-based pattern attacks, allowing authorized users to read arbitrary files...

PT-2026-79355

Name of the Vulnerable Software and Affected Versions io.micrometer:micrometer-registry-statsd affected versions not specified io.micrometer:micrometer-core affected versions not specified Description Failure to sanitize newline characters , r in metrics data allows for injection and spoofing...

PT-2026-72490

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An integer overflow exists in the sof ipc3 control update function when calculating expected size using the firmware-provided cdata-num elems variable. On 32-bit platforms, this arithmet...

PT-2026-72845

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the rtw89 wifi driver where the mac id field in RX descriptors, which is 8 bits wide 0-255, is used as an array index for assoc link on macid without validation. Since...

PT-2026-72805

In the Linux kernel, the following vulnerability has been resolved: liveupdate: fix u-a-f in luo file unpreserve files and luo file finish In luo file unpreserve files and luo file finish, reorder module put and xa erase to ensure the file handler module remains pinned while its operations are...

PT-2026-72657

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the xprtrdma component where the rpcrdma cm event handler function incorrectly handles the RDMA CM EVENT ADDR CHANGE event. When this event occurs before RDMA CM EVENT...

PT-2026-70110

A missing authentication vulnerability in Chaskiq through commit 46dfdd1 allows unauthenticated remote attackers to mint Stripe Billing Portal sessions for any tenant via the stripeCustomerPortal GraphQL mutation. The mutation performs no authentication or authorization checks before creating a...

PT-2026-69504

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the drm/amdgpu component where the system fails to reject the mapping of a reserved doorbell to a new queue. When creating a user-queue, the user space provides a...

PT-2026-68177

Name of the Vulnerable Software and Affected Versions Keycloak affected versions not specified Description A flaw exists in the user-event metrics recording process. When metrics are enabled, the system records raw error messages from failed account operations as Prometheus metric labels. Since...

PT-2026-66469

CentreStack before 17.4 contains a SQL injection vulnerability in GladDBFiles.SearchEx and SearchExUnder that allows authenticated attackers to execute arbitrary SQL statements by supplying a crafted x-glad-filter request header through the jsondir API endpoint. Attackers can exploit unsanitized...

PT-2026-65676

The Wholesale for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.0.5. This is due to the save requests meta function applying only sanitize text field to the user role set POST parameter before passing it directly to WP User::add rol...

PT-2026-65851

A vulnerability in the zipx.Unzip extraction routine of Develar's app-builder allows an attacker to overwrite arbitrary files on macOS APFS by exploiting a Unicode Normalization Collision combined with symlink following behavior. APFS treats certain Unicode equivalent filenames as identical e.g.,...

PT-2026-65784

The Extra Checkout Options addon for Extra Product Options & Add-Ons for WooCommerce plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.3.2. This is due to missing authorization and nonce validation in the eco save settings function, which allows...

PT-2026-65419

The Taskbuilder – Project Management & Task Management Tool With Kanban Board plugin for WordPress is vulnerable to SQL Injection via the 'wppm proj filter' parameter in versions up to, and including, 5.0.9. This is due to insufficient escaping on the user-supplied parameter and the lack of...

PT-2026-65110

An authorization weakness in JFrog Artifactory internal metadata handling could allow a user with limited repository access to write to restricted internal metadata areas under specific conditions. Successful abuse is limited to integrity and availability impact at a low level; confidentiality is...

PT-2026-63407

In Progress® Telerik® UI for AJAX prior to v2026.2.708, the obsolete RadChart component's ChartImage.axd handler is vulnerable to unauthenticated file read and deletion of image-extension files within the application directory...

PT-2026-62582

Name of the Vulnerable Software and Affected Versions Oracle SOA Suite versions 12.2.1.4.0 Oracle SOA Suite versions 14.1.2.0.0 Description A flaw in the Integration Business Insight component of Oracle Fusion Middleware allows a low privileged attacker with network access via HTTP to compromise...