PT-2026-7383

Name of the Vulnerable Software and Affected Versions Adobe InDesign versions 21.1 and earlier Adobe InDesign version 20.5.1 and earlier Description The Adobe InDesign software contains a flaw related to reading beyond the boundaries of allocated memory. Successful exploitation of this issue coul...

PT-2026-7161

Name of the Vulnerable Software and Affected Versions PlaciPy version 1.0.0 Description PlaciPy is a placement management system for educational institutions. The admin authorization middleware in version 1.0.0 trusts client-controlled JWT claims, specifically the role and scope, without performi...

PT-2026-43772

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A race condition exists in the icmp route lookup function during the reverse path process for sending ICMP error messages with XFRM IPsec policies. When the system acts as a forwarding...

PT-2026-6672

Name of the Vulnerable Software and Affected Versions kalyan02 NanoCMS versions up to 0.4 Description A flaw exists in kalyan02 NanoCMS that allows for remote request manipulation. The issue is related to an unknown functionality within the /data/pagesdata.txt file of the User Information Handler...

PT-2026-6680

Name of the Vulnerable Software and Affected Versions Orange Confort+ accessibility toolbar for WordPress plugin versions prior to 0.7 Description The Orange Confort+ accessibility toolbar for WordPress plugin is susceptible to Stored Cross-Site Scripting. This is due to insufficient input...

PT-2026-6558

Name of the Vulnerable Software and Affected Versions Thales SafeNet Agent for Windows Logon versions 4.0.0 through 4.1.2 Description A flaw exists in the certificate validation process within SafeNet Agent for Windows Logon on Windows, potentially enabling signature spoofing. This issue stems fr...

PT-2026-6581

Name of the Vulnerable Software and Affected Versions 10-Strike Network Inventory Explorer version 9.03 Description The software contains a buffer overflow issue in the file import functionality that enables remote attackers to run code without authorization. An attacker can create a specially...

PT-2026-6578

Name of the Vulnerable Software and Affected Versions UltraVNC Viewer version 1.2.4.0 Description The software contains a denial of service issue that allows attackers to crash the application. Attackers can create a 256-byte malformed payload and paste it into the VNC Server connection dialog,...

PT-2026-5614

A vulnerability was identified in JeecgBoot 3.9.0. This vulnerability affects unknown code of the file /JeecgBoot/sys/api/loadDictItemByKeyword of the component Online Report API. Such manipulation of the argument keyword leads to sql injection. The attack can be executed remotely. The exploit is...

PT-2026-5157

docPrint Pro 8.0 contains a local buffer overflow vulnerability in the 'Add URL' input field that allows attackers to execute arbitrary code by overwriting memory. Attackers can craft a malicious payload that triggers a structured exception handler SEH overwrite to execute shellcode and gain remo...

PT-2026-5061

The Easy Replace Image plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 3.5.2. This is due to missing capability checks on the image replacement from url function that is hooked to the eri from url AJAX action. This makes it possible for...

PT-2026-4702

Look at the security patch preview section of https://t.co/ySklSke3uy. These are from the upcoming patch levels: Critical: CVE-2026-0039, CVE-2026-0040, CVE-2026-0041, CVE-2026-0042, CVE-2026-0043, CVE-2026-0044 High: CVE-2025-22424, CVE-2025-22426, CVE-2025-32348, CVE-2025-48561, CVE-2025-48615,...

PT-2026-4596

The CM CSS Columns plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tag' shortcode attribute in all versions up to, and including, 1.2.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

PT-2026-4563

Name of the Vulnerable Software and Affected Versions GPU shader compiler library affected versions not specified Description Loading a web page with unusual GPU shader code into the GPU compiler process can cause a write use-after-free crash within the GPU shader compiler library. This occurs...

PT-2026-3751

Name of the Vulnerable Software and Affected Versions Academy LMS – WordPress LMS Plugin for Complete eLearning Solution versions prior to 3.5.1 Description The Academy LMS – WordPress LMS Plugin for Complete eLearning Solution is susceptible to privilege escalation through account takeover. The...

PT-2026-3583

IBM Concert 1.0.0 through 2.1.0 could allow a remote attacker to obtain sensitive information from allocated memory due to improper clearing of heap memory...

PT-2026-3269

Name of the Vulnerable Software and Affected Versions Kafka Connect BigQuery Connector versions prior to 2.11.0 Description The Kafka Connect BigQuery Connector, a sink connector from Apache Kafka to Google BigQuery, contains a flaw that could allow arbitrary file reads. This occurs because the...

PT-2026-3077

Name of the Vulnerable Software and Affected Versions Pimcore versions prior to 12.3.1 Pimcore versions prior to 11.5.14 Description The application does not properly enforce server-side authorization checks on the API endpoint responsible for reading or listing static routes. Static routes are...

PT-2026-2492

Name of the Vulnerable Software and Affected Versions Open Source Point of Sale versions 3.4.0 through 3.4.1 Description Open Source Point of Sale is a web-based point of sale application written in PHP using the CodeIgniter framework. A stored cross-site scripting XSS issue exists in the...

PT-2026-2338

Name of the Vulnerable Software and Affected Versions SAP ERP Central Component SAP ECC and SAP S/4HANA SAP EHS Management affected versions not specified Description A missing authorization check in SAP ERP Central Component SAP ECC and SAP S/4HANA SAP EHS Management allows an attacker to extrac...

PT-2026-2470

A CORS misconfiguration in Eramba Community and Enterprise Editions v3.26.0 allows an attacker-controlled Origin header to be reflected in the Access-Control-Allow-Origin response along with Access-Control-Allow-Credentials: true. This permits malicious third-party websites to perform authenticat...

PT-2026-2108

Name of the Vulnerable Software and Affected Versions Flag Forge versions 2.3.2 and below Description Flag Forge is a Capture The Flag CTF platform susceptible to a Regular Expression Denial of Service ReDoS condition. The issue resides in the user profile API endpoint, /api/user/username. The...

PT-2026-1848

Name of the Vulnerable Software and Affected Versions Plesk Obsidian versions 8.0.1 through 18.0.73 Description Plesk Obsidian versions 8.0.1 through 18.0.73 are susceptible to a Denial of Service DoS condition. The issue resides in the get password.php API endpoint, where a specifically crafted...

PT-2026-2094

CVE-2026-21744 - Adobe Flash Player Information Disclosure CVE ID : CVE-2026-21744 Published : Jan. 6, 2026, 4:15 a.m. | 1 hour, 39 minutes ago Description : Rejected reason: Not used Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...

PT-2026-1449

Adtec Digital SignEdje Digital Signage Player v2.08.28 contains multiple hardcoded default credentials that allow unauthenticated remote access to web, telnet, and SSH interfaces. Attackers can exploit these credentials to gain root-level access and execute system commands across multiple Adtec...

PT-2026-1221

Name of the Vulnerable Software and Affected Versions QOCA aim AI Medical Cloud Platform affected versions not specified Description A Missing Authorization issue exists in QOCA aim AI Medical Cloud Platform. Authenticated remote attackers can modify network packet parameters, potentially allowin...

PT-2026-8163

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The Linux kernel contains a flaw in the flexible proportions code. A lockdep splat can occur due to a race condition within the fprop new period function. Specifically, the issue arises...

PT-2026-6114

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The Linux kernel contains a flaw related to handling crypto compressors during hibernation. Specifically, the crypto alloc acomp function can return an error pointer ERR PTR instead of...

PT-2026-51383

Name of the Vulnerable Software and Affected Versions Picklescan versions prior to 0.0.33 Description Picklescan fails to detect the numpy.f2py.crackfortran. eval length gadget within pickle reduce methods. This allows attackers to craft malicious pickle files that execute arbitrary Python code...

PT-2025-46876

Name of the Vulnerable Software and Affected Versions Wolfram Cloud affected versions not specified Description The default Java Virtual Machine JVM can access files and directories within /tmp/, including the $TemporaryDirectory of other users on the same cloud instance located at...

PT-2025-46258

Name of the Vulnerable Software and Affected Versions My Geo Posts Free plugin for WordPress versions prior to 1.3 Description The My Geo Posts Free plugin for WordPress is susceptible to Stored Cross-Site Scripting through the 'mygeo city' shortcode. This occurs because the plugin does not...

PT-2025-40580

Name of the Vulnerable Software and Affected Versions QNAP versions prior to QTS 5.2.6.3195 build 20250715 QNAP versions prior to QuTS hero h5.2.6.3195 build 20250715 Description A flaw exists where a remote attacker, having obtained administrator privileges, can trigger a denial-of-service DoS...

PT-2025-37458

Name of the Vulnerable Software and Affected Versions: 1Panel-dev MaxKB versions up to 2.0.2 and 2.1.0 Description: A vulnerability exists in 1Panel-dev MaxKB due to improper processing of files. Specifically, the file /admin/api/workspace/default/tool/debug is susceptible to manipulation of the...

PT-2025-35706

Name of the Vulnerable Software and Affected Versions: mikecao/flight versions prior to v1.2 Description: The mikecao/flight PHP framework is susceptible to Denial of Service DoS attacks. This is due to the eager loading of request bodies within the Request class constructor. The framework...

PT-2026-55675

Name of the Vulnerable Software and Affected Versions picklescan versions prior to 0.0.30 Description The software fails to detect the asyncio.unix events. UnixSubprocessTransport. start function within pickle reduce methods. This allows remote code execution as attackers can create malicious...

PT-2026-51493

Name of the Vulnerable Software and Affected Versions picklescan versions prior to 0.0.28 Description An issue exists where the software fails to detect malicious torch.jit.unsupported tensor ops.execWrapper function calls embedded in pickle files. This allows attackers to craft malicious pickle...

PT-2025-32183

Name of the Vulnerable Software and Affected Versions Eaton affected versions not specified Description The server identity check mechanism for firmware upgrade performed via command shell is insecurely implemented, potentially allowing an attacker to perform a Man-in-the-middle attack...

PT-2026-7968

Name of the Vulnerable Software and Affected Versions Vnet/IP Interface Package versions R1.07.00 and earlier Description A flaw exists in the Vnet/IP Interface Package that could lead to the termination of the Vnet/IP software stack process if the affected product receives specially crafted...

PT-2025-12828

Name of the Vulnerable Software and Affected Versions NASA cFS Core Flight System Aquila affected versions not specified Description The issue concerns a segmentation fault that can occur in the Memory Management Module of NASA cFS Core Flight System Aquila when a malicious telecommand is sent...

PT-2025-2875 · Averta · Averta Shortcodes

Name of the Vulnerable Software and Affected Versions: By Averta Shortcodes and extra features for Phlox theme versions 2.17.2 and earlier Description: The issue affects the By Averta Shortcodes and extra features for the Phlox theme, allowing exploitation of incorrectly configured access control...

PT-2024-23494 · Jnt Telecom · Jnt Liftcom Ums

Name of the Vulnerable Software and Affected Versions: JNT Telecom JNT Liftcom UMS V1.J Core Version JM-V15 Description: An issue in the software allows a remote attacker to execute arbitrary code via the Network Troubleshooting functionality. Recommendations: For JNT Telecom JNT Liftcom UMS V1.J...

PT-2024-21904 · Maildev · Maildev

Name of the Vulnerable Software and Affected Versions: MailDev versions 2 through 2.1.0 Description: The issue allows Remote Code Execution via a crafted Content-ID header for an e-mail attachment, leading to lib/mailserver.js writing arbitrary code into the routes.js file. Recommendations: For...

PT-2024-18836 · Elementor · Elementor Website Builder

Name of the Vulnerable Software and Affected Versions: Elementor Website Builder versions up to, and including, 3.20.2 Description: The issue is related to Stored Cross-Site Scripting via the plugin's Path Widget due to insufficient output escaping on user-supplied attributes. This allows...

PT-2024-13729 · Couchbase · Couchbase Server

Name of the Vulnerable Software and Affected Versions: Couchbase Server versions 7.1.x through 7.2.3 Description: The issue concerns the lack of authentication requirement for certain API endpoints. Specifically, the /admin/stats and /admin/vitals endpoints on TCP port 8093 of localhost do not...

PT-2025-38390

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A memory leak exists in the trace/blktrace module when using the debugfs lookup function. Failing to call dput on the result of debugfs lookup leads to a memory leak over time. The issue...

PT-2023-6205 · Oracle · Oracle Enterprise Session Border Controller

Name of the Vulnerable Software and Affected Versions: Oracle Enterprise Session Border Controller versions 9.0 through 9.2 Description: The issue is related to insufficient input validation in the Web UI component. It allows an unauthenticated attacker with network access via HTTPS to compromise...

PT-2023-21413 · Autodesk · Autodesk Autocad

Name of the Vulnerable Software and Affected Versions: Autodesk AutoCAD version 2023 Description: A maliciously crafted X B file can cause an Integer Overflow when parsed through the software. This can be leveraged by a malicious actor to cause a crash, read sensitive data, or execute arbitrary...

PT-2023-20477 · Arm · Arm Aarch64Cryptolib

Name of the Vulnerable Software and Affected Versions: Arm AArch64cryptolib versions before 86065c6 Description: The issue concerns the armv8 dec aes gcm full API, which fails to verify the authentication tag of AES-GCM protected data. This failure is due to an improperly initialized variable,...

PT-2026-48639

Name of the Vulnerable Software and Affected Versions BeRocket Advanced AJAX Product Filters versions prior to 1.6.3.3 Description A missing authorization issue allows for the exploitation of incorrectly configured access control security levels. Recommendations Update to version 1.6.3.3 or later...

PT-2022-26953 · Siemens · Simcenter Star-Ccm+

Name of the Vulnerable Software and Affected Versions: Simcenter STAR-CCM+ versions prior to V2306 Description: A vulnerability has been identified in the affected application, where it improperly assigns file permissions to installation folders. This could allow a local attacker with an...