PT-2026-27633

Name of the Vulnerable Software and Affected Versions Ech0 versions prior to 4.2.0 Description The GET /api/allusers API endpoint is publicly accessible, allowing remote unauthenticated user enumeration and exposure of user profile metadata. The route is registered under public routes in...

PT-2026-43886

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.0.11-1.1 Description A memory leak occurs in the atmel-aes crypto component. The atmel aes buff init function allocates 4 pages of memory using get free pages with ATMEL AES BUFFER ORDER, but the atmel aes buff...

PT-2026-26945

D-Link DIR-513 boa formEasySetTimezone memory corruption CVE: CVE-2026-4555 PT-Identifier: PT-2026-26945 Vendor: D-link Product: DIR-513 CVSS: 8.7 Credits: LtzHust2 VulDB User Description: A weakness has been identified in D-Link DIR-513 1.10. The impacted element is the function...

PT-2026-28167

Name of the Vulnerable Software and Affected Versions yaml versions prior to 1.10.3 yaml versions prior to 2.8.3 Description The yaml library is susceptible to a stack overflow when parsing YAML documents. The issue occurs during the node resolution/composition phase, which uses recursive functio...

PT-2026-26712

Service information is not encrypted when transmitted as BACnet packets over the wire, and can be sniffed, intercepted, and modified by an attacker. Valuable information such as the File Start Position and File Data can be sniffed from network traffic using Wireshark's BACnet dissector filter. Th...

PT-2026-26444

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. Prior to versions 7.15.1 and 8.9.3, the value of the return id request parameter is copied into the value of an HTML tag attribute which is an event handler and is encapsulated in double...

PT-2026-51219

Name of the Vulnerable Software and Affected Versions Capgo CLI versions prior to 12.128.2 Description Arbitrary file overwrite and credential exposure issues exist in login and build credentials operations. The software follows symbolic links symlinks—which are files that point to another file o...

PT-2026-25939

Name of the Vulnerable Software and Affected Versions Spring AI versions prior to 1.0.4 and 1.1.3 Description A JSONPath injection issue exists in Spring AI’s AbstractFilterExpressionConverter. Authenticated users can bypass metadata-based access controls by using crafted filter expressions...

PT-2026-24159

SAP GUI for Windows allows DLL files to be loaded from arbitrary directories within the application. An unauthenticated attacker could exploit this vulnerability by persuading a victim to place a malicious DLL within one of these directories. The malicious command is executed in the victim user's...

PT-2026-23892

A vulnerability was detected in bufanyun HotGo up to 2.0. This issue affects the function ImageTransferStorage of the file /server/internal/logic/common/upload.go of the component Endpoint. The manipulation results in server-side request forgery. The attack may be launched remotely. The exploit i...

PT-2026-23721

Name of the Vulnerable Software and Affected Versions CoreDNS versions prior to 1.14.2 Description A logical flaw exists due to the default execution order of plugins, where security plugins such as acl are evaluated before the rewrite plugin. This creates a Time-of-Check Time-of-Use TOCTOU flaw—...

PT-2026-22815

IBM MQ 9.1.0.0 through 9.1.0.33 LTS, 9.2.0.0 through 9.2.0.40 LTS, 9.3.0.0 through 9.3.0.36 LTS, 9.30.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.17 LTS, and 9.4.0.0 through 9.4.4.1 CD...

PT-2026-22561

Name of the Vulnerable Software and Affected Versions Qualcomm WLAN STA Driver affected versions not specified Description The WLAN STA driver contains a flaw due to a missing bounds check. This could allow a malicious actor who already has System privileges to escalate their privileges locally...

PT-2026-22467

Name of the Vulnerable Software and Affected Versions Microchip TimePictra versions 11.0 through 11.3 SP2 Description The software contains an Improper Neutralization of Input During Web Page Generation issue, also known as Cross-site Scripting XSS. This allows for a Query System for Information...

PT-2026-22389

Name of the Vulnerable Software and Affected Versions phpMyFAQ versions prior to 4.0.18 Description The WebAuthn prepare endpoint, /api/webauthn/prepare, in versions prior to 4.0.18 lacks authentication, CSRF protection, captcha, or configuration checks. This allows unauthenticated attackers to...

PT-2026-22122

The installer of FinalCode Client provided by Digital Arts Inc. contains an incorrect default permissions vulnerability. A non-administrative user may execute arbitrary code with SYSTEM privilege...

PT-2026-22113

The User Registration & Membership – Custom Registration Form, Login Form, and User Profile plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.1.2 via the 'register member' function, due to missing validation on the 'member id' user...

PT-2026-21899

Name of the Vulnerable Software and Affected Versions Red Hat Developer Hub Backstage Orchestrator Plugin affected versions not specified Description A security flaw exists due to insufficient input validation in GraphQL query handling. An authenticated user can inject specially crafted input int...

PT-2026-21657

Name of the Vulnerable Software and Affected Versions Synology Presto Client versions prior to 2.1.3-0672 Description A flaw exists in Synology Presto Client that allows local users to read or write arbitrary files during installation. This occurs because of an uncontrolled search path element. A...

PT-2026-20799

Name of the Vulnerable Software and Affected Versions WorkTime affected versions not specified Description An authenticated attacker with minimal permissions can exploit a SQL injection in the WorkTime server ''widget'' API endpoint to inject SQL queries. If the Firebird backend is used, attacker...

PT-2026-20497

Name of the Vulnerable Software and Affected Versions Rongzhitong Visual Integrated Command and Dispatch Platform versions prior to 20260207 Description A flaw exists in Rongzhitong Visual Integrated Command and Dispatch Platform that allows for improper access controls. The issue is related to a...

PT-2026-20513

Name of the Vulnerable Software and Affected Versions MajorDoMo versions affected versions not specified Description MajorDoMo contains a stored cross-site scripting XSS issue through the /objects/?op=set API endpoint. This endpoint is intentionally unauthenticated for integration with IoT device...

PT-2026-20336

Name of the Vulnerable Software and Affected Versions Beetel 777VR1 versions prior to 01.00.10 Description A security issue exists in the SSH Service component of Beetel 777VR1. The issue involves the use of risky cryptographic algorithms and is potentially exploitable remotely. The exploitabilit...

PT-2026-23855

Name of the Vulnerable Software and Affected Versions Wavlink WL-NU516U1 version 240425 Description A flaw exists in the ota new upgrade function of the /cgi-bin/adm.cgi file. Manipulation of the model argument can lead to command injection. This allows for remote attacks. The exploit has been...

PT-2026-7291

Name of the Vulnerable Software and Affected Versions Intel Ethernet Controller E810 firmware versions prior to 1.7.8.x Description An out-of-bounds write issue exists in the firmware of some Intel Ethernet Controller E810 devices. A local attacker with privileged user access and low complexity...

PT-2026-7161

Name of the Vulnerable Software and Affected Versions PlaciPy version 1.0.0 Description PlaciPy is a placement management system for educational institutions. The admin authorization middleware in version 1.0.0 trusts client-controlled JWT claims, specifically the role and scope, without performi...

PT-2026-5912

Name of the Vulnerable Software and Affected Versions Samsung Mobile Processor and Wearable Processor Exynos 980 Samsung Mobile Processor and Wearable Processor Exynos 850 Samsung Mobile Processor and Wearable Processor Exynos 1080 Samsung Mobile Processor and Wearable Processor Exynos 1280 Samsu...

PT-2026-5766

Name of the Vulnerable Software and Affected Versions ADM versions 4.1.0 through 4.3.3.ROF1 ADM versions 5.0.0 through 5.1.1.RCI1 Description The DDNS function uses an insecure HTTP connection or fails to validate the SSL/TLS certificate when querying an external server for the device's WAN IP...

PT-2026-5726

Name of the Vulnerable Software and Affected Versions Odoo versions 21.11 through 25.10 Odoo versions 26.05 Description The NixOS Odoo package, an open source ERP and CRM system, exposes the database manager without authentication. This allows unauthorized actors to delete and download the entire...

PT-2026-5023

Name of the Vulnerable Software and Affected Versions ConvertX versions prior to 0.17.0 Description ConvertX is a self-hosted online file converter. The POST /delete endpoint uses a user-controlled filename value to construct a filesystem path and deletes it via the unlink function without...

PT-2026-4534

Name of the Vulnerable Software and Affected Versions Sourcecodester Domain Availability Checker version 1.0 Description A DOM-based Cross-Site Scripting XSS issue exists in the DomainCheckerApp class within the domain/script.js file. The application does not properly handle user-supplied data in...

PT-2026-43786

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the Real-Time RT load balancing mechanism where a CPU can enter an infinite self-Inter-Processor Interrupt IPI loop, leading to a CPU hardlockup. This occurs when a CP...

PT-2026-3269

Name of the Vulnerable Software and Affected Versions Kafka Connect BigQuery Connector versions prior to 2.11.0 Description The Kafka Connect BigQuery Connector, a sink connector from Apache Kafka to Google BigQuery, contains a flaw that could allow arbitrary file reads. This occurs because the...

PT-2026-2990

Name of the Vulnerable Software and Affected Versions versions prior to 2026 Description Certain system functions may be accessed without proper authorization. This could allow attackers to start, stop, or delete installed applications, potentially disrupting system operations. Recommendations At...

PT-2026-2492

Name of the Vulnerable Software and Affected Versions Open Source Point of Sale versions 3.4.0 through 3.4.1 Description Open Source Point of Sale is a web-based point of sale application written in PHP using the CodeIgniter framework. A stored cross-site scripting XSS issue exists in the...

PT-2026-51383

Name of the Vulnerable Software and Affected Versions Picklescan versions prior to 0.0.33 Description Picklescan fails to detect the numpy.f2py.crackfortran. eval length gadget within pickle reduce methods. This allows attackers to craft malicious pickle files that execute arbitrary Python code...

PT-2026-43815

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A memory leak occurs in the ext4 ext shift extents function. When the extent is NULL within the while loop, the function returns immediately without releasing the path acquired through t...

PT-2025-48428

Name of the Vulnerable Software and Affected Versions Mogu Blog v2 versions up to 5.2 Description A weakness exists in Mogu Blog v2 up to version 5.2. This issue involves the manipulation of the filedatas argument within an unknown function of the /file/pictures endpoint, leading to unrestricted...

PT-2025-46876

Name of the Vulnerable Software and Affected Versions Wolfram Cloud affected versions not specified Description The default Java Virtual Machine JVM can access files and directories within /tmp/, including the $TemporaryDirectory of other users on the same cloud instance located at...

PT-2025-44444

Name of the Vulnerable Software and Affected Versions Zucchetti Ad Hoc Revolution versions 4.1 and earlier Description A cross-site scripting XSS issue exists in Zucchetti Ad Hoc Revolution. This allows attackers to inject arbitrary JavaScript code. The issue is present in the /ahrw/jsp/gsfr...

PT-2026-42470

Name of the Vulnerable Software and Affected Versions Apex One/SEP agent affected versions not specified Description An origin validation error in the process protection communication mechanism allows a local attacker to escalate privileges. To exploit this issue, the attacker must first have the...

PT-2025-41712

Name of the Vulnerable Software and Affected Versions HCL Unica Platform affected versions not specified Description The HCL Unica Platform is susceptible to issues stemming from a misconfigured Content Security Policy CSP. This misconfiguration can allow malicious resources to load, potentially...

PT-2025-40400

Name of the Vulnerable Software and Affected Versions YOSHOP version 2.0 Description The software is susceptible to an unauthenticated SQL injection through the goodsIds parameter of the /api/goods/listByIds API endpoint. The getListByIds function improperly concatenates user-supplied input into ...

PT-2025-38357

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The Linux kernel contains a flaw within the DRM/i915/dpt subsystem. The i915 gem object is framebuffer function does not recognize the buffer object BO containing the framebuffer’s DPT a...

PT-2025-37458

Name of the Vulnerable Software and Affected Versions: 1Panel-dev MaxKB versions up to 2.0.2 and 2.1.0 Description: A vulnerability exists in 1Panel-dev MaxKB due to improper processing of files. Specifically, the file /admin/api/workspace/default/tool/debug is susceptible to manipulation of the...

PT-2025-35312

Name of the Vulnerable Software and Affected Versions: Voice Changer App versions up to 1.1.0 Description: A vulnerability exists in Voice Changer App due to improper export of Android application components resulting from unknown processing of the AndroidManifest.xml file within the...

PT-2025-37371

Name of the Vulnerable Software and Affected Versions: Wavlink WL-WN578W2 version 221110 Description: A vulnerability exists in Wavlink WL-WN578W2. The issue resides in the sub 404DBC function of the /cgi-bin/wireless.cgi file. Manipulation of the macAddr argument can lead to operating system...

PT-2026-55666

Name of the Vulnerable Software and Affected Versions picklescan versions prior to 0.0.30 Description The software fails to detect malicious pickle files that utilize the runcode function within the idlelib.run.Executive class inside reduce methods. This allows attackers to embed hidden code in...

PT-2025-34680 · Lostvip Com · Ruoyi-Go

Name of the Vulnerable Software and Affected Versions: lostvip-com ruoyi-go versions prior to 2.1 Description: A security flaw exists in the DownloadTmp/DownloadUpload function within the modules/system/controller/CommonController.go file. Manipulation of the fileName argument can lead to a path...

PT-2026-50455

Name of the Vulnerable Software and Affected Versions picklescan versions prior to 0.0.27 modelscan affected versions not specified Description A parsing logic error exists in the list globals function when processing STACK GLOBAL opcodes. The scanner fails to track arguments in the correct range...