PT-2026-45786

Name of the Vulnerable Software and Affected Versions mint versions 0.1.0 through 1.8.x Description An inconsistent interpretation of HTTP requests, known as HTTP Request/Response Smuggling, allows attacker-controlled HTTP/1 servers to desynchronize response framing on shared connections. The iss...

PT-2026-45726

Name of the Vulnerable Software and Affected Versions Tiled Gallery Carousel Without JetPack versions prior to 3.2 Description The plugin is subject to stored cross-site scripting due to insufficient input sanitization and output escaping. Authenticated attackers with contributor level access or...

PT-2026-45708

Name of the Vulnerable Software and Affected Versions ZeM STL plugin for WordPress versions prior to 1.1 Description Stored Cross-Site Scripting is possible via the zemstl shortcode due to insufficient input sanitization and output escaping of user-supplied attributes. Specifically, the url, colo...

PT-2026-45355

Privilege chaining issue exists in ServerView Agents for Windows V11.60.04 and earlier. If this vulnerability is exploited, a local authenticated attacker who can log in to the server where the affected product is installed may obtain SYSTEM privilege...

PT-2026-45406

A security flaw has been discovered in itsourcecode Content Management System 1.0. This issue affects some unknown processing of the file /admin/update ss img.php. The manipulation of the argument topic id results in sql injection. The attack can be executed remotely. The exploit has been release...

PT-2026-45589

Name of the Vulnerable Software and Affected Versions ubsan throwing runtime.cpp affected versions not specified Description An integer overflow in multiple functions of ubsan throwing runtime.cpp can lead to a persistent local denial of service. This issue can be exploited without requiring...

PT-2026-45364

Name of the Vulnerable Software and Affected Versions Apache Airflow versions prior to 3.2.2 Description A bug in the login redirect route allows authenticated users to craft URLs that bypass the is safe url check. This enables the redirection of users from a trusted Airflow domain to an origin...

PT-2026-45517

microtar through 0.1.0 contains a stack-based buffer overflow vulnerability in the raw to header function in src/microtar.c that allows attackers to corrupt adjacent stack memory by supplying a crafted TAR archive with non-null-terminated name or linkname fields. The function uses strcpy to copy...

PT-2026-45557

Name of the Vulnerable Software and Affected Versions CodexBar versions prior to 0.32.0 Description A privilege escalation issue exists in the CLI installer. Local attackers can execute arbitrary commands as root by exploiting a race condition—a situation where the system's behavior depends on th...

PT-2026-45446

A security vulnerability has been detected in decolua 9router up to 0.4.0. This issue affects the function isAuthenticated of the file src/dashboardGuard.js of the component HTTP Header Handler. The manipulation of the argument Host leads to improper authorization. The attack is possible to be...

PT-2026-45630

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description Memory corruption occurs when processing device identifier strings that exceed the expected maximum length. Recommendations At the moment, there is no informatio...

PT-2026-44844

Name of the Vulnerable Software and Affected Versions FreePBX versions prior to 16.0.22 FreePBX versions prior to 17.0.5 Description The Dashboard module's getcontent AJAX handler includes PHP files based on user-supplied input without proper path sanitization. By using path traversal sequences...

PT-2026-44742

Name of the Vulnerable Software and Affected Versions ASUS System Control Interface affected versions not specified Description An incorrect permission assignment for critical resources in the ASUS System Control Interface allows a local user to elevate privileges to SYSTEM and execute arbitrary...

PT-2026-44194

Name of the Vulnerable Software and Affected Versions Keycloak affected versions not specified Description A flaw allows a remote attacker with high privileges, such as a realm administrator configuring a malicious Lightweight Directory Access Protocol LDAP server or an attacker who has compromis...

PT-2026-44172

The Login No Captcha reCAPTCHA plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the $ SERVER'PHP SELF' superglobal in all versions up to, and including, 1.8.0. This is due to the authenticate function storing the unsanitized output of basename$ SERVER'PHP SELF' in the login...

PT-2026-44202

The SMTP2GO for WordPress – Email Made Easy plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 1.16.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers,...

PT-2026-45159

Name of the Vulnerable Software and Affected Versions libsolv-demo versions prior to 0.7.38-1.1 Description Security issues were identified in the libsolv-demo package. Recommendations Update to version 0.7.38-1.1...

PT-2026-44213

Cross Site Scripting vulnerability in Follet School Solutions Destiny before v22.0.1 AU1 allows a remote attacker to run arbitrary client-side code via the site parameter of handleloginform.do...

PT-2026-44776

Name of the Vulnerable Software and Affected Versions Suricata versions prior to 8.0.5 Description An issue was identified in Suricata that requires a security update. Recommendations Update to version 8.0.5...

PT-2026-44331

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description In the batman-adv module, TP meter sessions remain linked on bat priv-tp list after a netlink request finishes. When the mesh interface is removed, the batadv mesh free function tears do...

PT-2026-44210

Name of the Vulnerable Software and Affected Versions PeachPay — Payments & Express Checkout for WooCommerce versions prior to 1.120.47 Description Cross-Site Request Forgery occurs due to missing or incorrect nonce validation in the peachpay stripe handle admin actions function. A nonce is a...

PT-2026-43571

The Github Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'repo' shortcode attribute in the 'github' shortcode in all versions up to, and including, 0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

PT-2026-43706

Netis AC1200 Router NC21 V4.0.1.4296 exposes a CGI endpoint /cgi-bin/skk get.cgi that returns the entire router configuration as a JSON response with no authentication required. Any attacker on the LAN can send a single HTTP GET request and instantly retrieve administrator credentials, WiFi...

PT-2026-43685

Name of the Vulnerable Software and Affected Versions IBM QRadar versions 7.5.0 through 7.5.0 UP15 Interim Fix 002 Description A privileged user can upload a malicious backup archive. When this archive is restored, it can be used to gain unauthorized access to the underlying operating system...

PT-2026-43842

In the Linux kernel, the following vulnerability has been resolved: ublk: use READ ONCE to read struct ublksrv ctrl cmd struct ublksrv ctrl cmd is part of the io uring sqe, which may lie in userspace-mapped memory. It's racy to access its fields with normal loads, as userspace may write to them...

PT-2026-47510

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 149.0.7827.103 Description Insufficient policy enforcement in the Network component allows a remote attacker who has compromised the utility process to leak cross-origin data through the use of a crafted HTML...

PT-2026-43852

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the ext4 file system when allocating blocks during within-EOF Direct I/O DIO and writeback with dioread nolock enabled. When splitting a large unwritten extent, the ex...

PT-2026-43794

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A Time-of-Check to Time-of-Use TOCTOU issue exists where the bpf map get info by fd function calculates and caches the hash of a map regardless of whether the map is frozen. This allows...

PT-2026-44062

Name of the Vulnerable Software and Affected Versions Budibase versions prior to 3.39.0 Description An issue exists in the open-source low-code platform where the webhook schema-building endpoint is registered under builderRoutes, but the generic authorization middleware fails to enforce...

PT-2026-43428

Name of the Vulnerable Software and Affected Versions JeecgBoot versions prior to 3.9.2 Description Improper access controls exist within the AiragModelController component. A remote attacker can exploit this by manipulating the list/queryById argument, leading to unauthorized access...

PT-2026-43442

Name of the Vulnerable Software and Affected Versions Yeoman Environment versions 2.9.0 through 6.0.0 Description Yeoman Environment provides an API to discover, create, and run generators, and to configure where and how a generator is resolved. The installLocalGenerators function calls...

PT-2026-43449

Name of the Vulnerable Software and Affected Versions Kirby versions prior to 4.9.1 Kirby versions prior to 5.4.1 Description Kirby failed to validate model attributes used in collection queries, enabling authenticated Panel users to execute arbitrary model methods. This arbitrary method call, a...

PT-2026-43290

Name of the Vulnerable Software and Affected Versions com content affected versions not specified Description Lack of output escaping in the readmore links for com content allows for a Cross-Site Scripting XSS vector. XSS is a flaw where an attacker can inject malicious scripts into web pages...

PT-2026-43318

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description An improper access check allows low privileged users to edit the task types of existing scheduler tasks. Recommendations At the moment, there is no information...

PT-2026-43285

Name of the Vulnerable Software and Affected Versions NVIDIA Transformers4Rec for Linux affected versions not specified Description Improper deserialization of untrusted data may occur, which is the process of converting data from a format like JSON or XML back into an object in a way that allows...

PT-2026-43188

A weakness has been identified in Totolink CA750-PoE 6.2c.510. Impacted is the function setUpgradeUboot of the file /cgi-bin/cstecgi.cgi of the component Setting Handler. This manipulation of the argument FileName causes os command injection. The attack is possible to be carried out remotely. The...

PT-2026-42989

A security flaw has been discovered in SourceCodester Indian Invoicing System up to 0.x/1.0. The impacted element is an unknown function of the file /Invoicing/add order.php of the component Invoice Template Render Database-Backed. The manipulation of the argument customer name results in cross...

PT-2026-43031

A vulnerability has been found in SourceCodester Simple POS and Inventory System 1.0. The affected element is an unknown function of the file /admin/edit customer.php. Such manipulation of the argument ID leads to sql injection. The attack can be executed remotely. The exploit has been disclosed ...

PT-2026-43067

Name of the Vulnerable Software and Affected Versions benoitc hackney versions 3.1.1 through 4.0.0 Description A sensitive data exposure issue exists where the HTTP/3 redirect handler in src/hackney h3.erl passes original request headers to a redirect target without performing cross-origin checks...

PT-2026-43096

Name of the Vulnerable Software and Affected Versions Dolibarr ERP CRM version 7.0.3 Description Unauthenticated attackers can achieve remote code execution by injecting PHP code through the db name parameter. This is performed by sending a POST request to the 'install/step1.php' endpoint...

PT-2026-42474

Name of the Vulnerable Software and Affected Versions Turkiye Electricity Transmission Corporation TEİAŞ Mobile Application versions 1.6.2 through 1.12 Description Insufficient session expiration in the application allows for session hijacking, a process where an attacker takes over a user's acti...

PT-2026-42532

IINA before 1.4.3 contains a user-assisted command execution vulnerability that allows remote attackers to execute arbitrary commands by supplying malicious mpv -prefixed query parameters through the iina://open custom URL scheme handler. Attackers can deliver a crafted URL via a browser that...

PT-2026-42850

Name of the Vulnerable Software and Affected Versions SharePoint Enterprise Server 2016 SharePoint Server 2019 SharePoint Server Subscription Edition Description An issue exists in the deserialization mechanism of Microsoft Office SharePoint, where the deserialization of untrusted data allows an...

PT-2026-42663

Name of the Vulnerable Software and Affected Versions OpenMetadata versions prior to 1.12.4 Description A non-admin SSO user can trigger a TEST CONNECTION workflow for a Database Service and receive sensitive information in the HTTP 201 response of the 'POST /api/v1/automations/workflows' endpoin...

PT-2026-42477

Name of the Vulnerable Software and Affected Versions WP Directory Kit versions prior to 1.5.1 Description WP Directory Kit contains a Blind SQL Injection flaw, which occurs when special elements used in an SQL command are not properly neutralized. This allows an unauthenticated attacker to execu...

PT-2026-42689

Name of the Vulnerable Software and Affected Versions js-cookie versions prior to 3.0.7 Description The internal assign function copies properties using a for...in loop and plain assignment. When a source object is created via JSON.parse, the proto member is treated as an own enumerable property...

PT-2026-42459

Name of the Vulnerable Software and Affected Versions Apache Camel K versions 2.0.0 through 2.8.0 Apache Camel K versions 2.9.0 through 2.9.1 Apache Camel K versions 2.10.0 Description Authorized users in a Kubernetes namespace can create a Build resource to control Pod generation in a namespace ...

PT-2026-42735

Name of the Vulnerable Software and Affected Versions FluentCRM – Email Newsletter, Automation, Email Marketing, Email Campaigns, Optins, Leads, and CRM Solution versions prior to 2.9.88 Description The plugin is susceptible to Blind Server-Side Request Forgery SSRF, a flaw where an attacker can...

PT-2026-44146

Name of the Vulnerable Software and Affected Versions Symfony versions prior to 5.4.21 Description The SymfonyComponentYamlParser entry point for parsing YAML strings into PHP values via Yaml::parse lacks a depth limit for recursion. When processing attacker-controlled input, deeply nested mappin...

PT-2026-42145

Name of the Vulnerable Software and Affected Versions HCL BigFix Service Management SM affected versions not specified Description A security misconfiguration exists due to a missing or insecure X-Content-Type-Options header. This allows browsers to perform MIME-type sniffing, which is a process...