PT-2024-35086

Name of the Vulnerable Software and Affected Versions changedetection.io versions prior to 0.47.06 Description The validation for the file URI scheme in changedetection.io falls short, allowing an attacker to read any file on the system. This issue only affects instances with a webdriver enabled...

PT-2023-28865 · Lenovo · Reflash

Name of the Vulnerable Software and Affected Versions: Lenovo Desktop products affected versions not specified Description: A buffer overflow was reported in the ReFlash module that may allow a local attacker with elevated privileges to execute arbitrary code. Recommendations: At the moment, ther...

PT-2026-72361

In the Linux kernel, the following vulnerability has been resolved: fs/proc/task mmu: do not warn on seeing non-migration pmd entry Patch series "mm/hmm: A fix and a selftest", v3. Patch 1 fixes a stale warning present from the time when only migration softleaf entries were supported at the PMD...

PT-2026-67399

Telenia Software TVox 26.5.3 and prior 26.x versions, and 24.9.21 and prior 24.x versions, contain an authentication bypass vulnerability in set env.php where the redirectToLoginAdminIRequestHaveAccessToken function derives the current page name from PHP SELF and skips authentication when the val...

PT-2026-58882

The Quotes llama WordPress plugin before 3.1.6 does not properly sanitize and escape a user-supplied parameter before using it in a SQL query, allowing unauthenticated attackers to perform UNION-based SQL injection and read arbitrary data from the database, including password hashes...

PT-2026-56210

Name of the Vulnerable Software and Affected Versions EGroupware versions prior to 26.2.20260224 EGroupware versions prior to 23.1.20260224 Description An issue allows an authenticated attacker to execute arbitrary commands on the server, which may lead to full system compromise. If user...

PT-2026-56086

Name of the Vulnerable Software and Affected Versions Kiwi TCMS versions prior to 16.1 Description User input in the TestCase.extra link and TestPlan.extra link fields is not sanitized and is rendered verbatim, allowing for cross-site scripting XSS, a technique where malicious scripts are injecte...

PT-2026-55826

Name of the Vulnerable Software and Affected Versions FormLayer versions prior to 1.0.7 Description An issue in Softaculous FormLayer allows for the insertion of sensitive information into sent data, which can lead to the retrieval of embedded sensitive data. Recommendations Update FormLayer to...

PT-2026-54378

Name of the Vulnerable Software and Affected Versions Google Chrome on ChromeOS versions prior to 150.0.7871.47 Description A use after free issue exists in the SSL component. This occurs when a program continues to use a pointer after the memory it points to has been freed, which can lead to...

PT-2026-53422

Impact EPyT-Flow’s REST API parses attacker-controlled JSON request bodies using a custom deserializer my load from json that supports a type field. When type is present, the deserializer dynamically imports an attacker-specified module/class and instantiates it with attacker-supplied arguments...

PT-2026-51596

Name of the Vulnerable Software and Affected Versions jackson-databind versions 2.10.0 through 2.18.7 jackson-databind versions 2.19.0 through 2.21.3 jackson-databind versions 3.0.0 through 3.1.3 Description The BasicPolymorphicTypeValidator.Builder.allowIfSubTypeIsArray function allowlists any...

PT-2026-48452

A vulnerability was identified in the Lenovo Android Application, distributed exclusively on tablets in the Chinese market, that could allow a website visited by the built-in browser to overwrite system clipboard contents...

PT-2026-23554

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.2.15 Description The software uses SHA-1 to hash sandbox identifier cache keys for Docker and browser sandbox configurations. SHA-1 is a deprecated cryptographic hash function with known collision weaknesses. A...

PT-2025-52605

An issue was discovered in Lantronix EDS3000PS 3.1.0.0R2. The host parameter of the TFTP client in the Filesystem Browser page is not properly sanitized. This can be exploited to escape from the original command and execute an arbitrary one with root privileges...

PT-2025-51220

An issue was discovered in Wekan The Open Source kanban board system up to version 18.15, fixed in 18.16. Attachment upload API treats the Authorization bearer value as a userId and enters a non-terminating body-handling branch for any non-empty bearer token, enabling trivial application-layer Do...

PT-2025-34380 · D Link · D-Link Dir-619L

Name of the Vulnerable Software and Affected Versions: D-Link DIR-619L version 2.06B01 Description: The D-Link DIR-619L device is susceptible to a buffer overflow in the formWlanSetup function through the f wds wepKey parameter. Recommendations: Update to a newer version that contains a fix for...

PT-2024-23230 · WordPress · Essential Addons For Elementor

Name of the Vulnerable Software and Affected Versions: The Essential Addons for Elementor plugin for WordPress versions up to, and including, 5.9.13 Description: The issue allows authenticated attackers with author-level access and above to inject a PHP Object via deserialization of untrusted inp...

PT-2023-31662 · Villatheme · Villatheme Curcy – Multi Currency For Woocommerce

Name of the Vulnerable Software and Affected Versions: VillaTheme CURCY – Multi Currency for WooCommerce versions 2.2.0 and earlier Description: The issue is related to improper neutralization of input during web page generation, which allows for stored cross-site scripting XSS. This means that a...

PT-2023-5866

Name of the Vulnerable Software and Affected Versions HTTP/2 protocol affected versions not specified Description A flaw exists in the handling of multiplexed streams within the HTTP/2 protocol. Multiplexing allows multiple requests to be sent over a single TCP connection as parallel streams. A...

PT-2026-86314

The Dear Flipbook – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'post content class attribute of .dvcss element' parameter in all versions up to, and including, 2.4.30 due to insufficient input sanitization and output...

PT-2026-57217

Name of the Vulnerable Software and Affected Versions Grav versions prior to 1.7.53 Grav versions prior to 2.0.0-rc.8 Description An unauthenticated visitor can cause server memory and CPU exhaustion by requesting image derivatives with oversized dimensions. This occurs through URL query image...

PT-2026-57320

Name of the Vulnerable Software and Affected Versions Phalcon versions prior to 5.14.1 Description The decrypt function within PhalconEncryptionCrypt uses a byte-wise identity comparison to verify the HMAC tag. Because this comparison returns early upon encountering the first differing byte, it...

PT-2026-56556

Name of the Vulnerable Software and Affected Versions Nomad Community Edition versions prior to 2.0.4 Nomad Enterprise versions prior to 2.0.4 Nomad Enterprise versions prior to 1.11.8 Nomad Enterprise versions prior to 1.10.14 Description A sandbox escape exists in the Docker task driver. This...

PT-2026-55517

Name of the Vulnerable Software and Affected Versions Zakra versions prior to 4.2.1 Description The Zakra theme for WordPress contains a Stored Cross-Site Scripting issue. This occurs because the theme registers three post meta fields—zakra menu item color, zakra menu item hover color, and zakra...

PT-2026-54979

Name of the Vulnerable Software and Affected Versions Automotive Car Dealership Business versions prior to 13.3.4 Description An unauthenticated Cross Site Scripting XSS issue exists, allowing an attacker to execute malicious scripts in the browser of a user without requiring authentication...

PT-2026-52933

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the mailbox-test component where a double-free occurs during the process of freeing channels. This happens because the RX channel can be aliased to the TX channel if i...

PT-2026-51499

Inefficient algorithmic complexity in Plug's nested-parameter decoder allows an unauthenticated remote attacker to cause denial of service. Plug.Conn.Query.decode/4 and Plug.Conn.Query.decode each/2 parse query strings and application/x-www-form-urlencoded request bodies. When a key contains many...

PT-2026-50640

The SysBasics Customize My Account for WooCommerce – Dashboard, Endpoints, Avatar & Menu Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tab' parameter in all versions up to, and including, 4.3.6 due to insufficient input sanitization and output escaping. Thi...

PT-2026-48482

Name of the Vulnerable Software and Affected Versions Nezha Monitoring versions 2.0.0 through 2.0.13 Description Private services configured with EnableShowInService: false are enumerable, leading to the leak of service names and timing data. While the main service-listing endpoint correctly...

PT-2026-39240

Name of the Vulnerable Software and Affected Versions OpenTelemetry.Exporter.Instana affected versions not specified Description The OpenTelemetry.Exporter.Instana NuGet package fails to validate HTTPS/TLS certificates when sending telemetry to an Instana back-end if a proxy is configured via the...

PT-2026-23153

Name of the Vulnerable Software and Affected Versions Mikado-Themes Cortex versions through 1.5 Description The software contains an Improper Control of Filename for Include/Require Statement issue, also known as a PHP Remote File Inclusion. This allows for PHP Local File Inclusion. Recommendatio...

PT-2026-5411

Dolibarr 11.0.3 contains a persistent cross-site scripting vulnerability in LDAP synchronization settings that allows attackers to inject malicious scripts through multiple parameters. Attackers can exploit the host, slave, and port parameters in /dolibarr/admin/ldap.php to execute arbitrary...

PT-2026-3796

GetSimple CMS My SMTP Contact Plugin 1.1.2 contains a PHP code injection vulnerability. An authenticated administrator can inject arbitrary PHP code through plugin configuration parameters, leading to remote code execution on the server...

PT-2024-31800 · Mattermost +1 · Mattermost Desktop App +1

Name of the Vulnerable Software and Affected Versions: Mattermost Desktop App versions =5.8.0 Description: The Mattermost Desktop App fails to sufficiently configure Electron Fuses, allowing an attacker to gather Chromium cookies or abuse other misconfigurations via remote or local access. This...

PT-2023-32023 · Unknown · Online Banquet Booking System

Name of the Vulnerable Software and Affected Versions: Online Banquet Booking System version 1.0 Description: A problematic issue was found in the Online Banquet Booking System, affecting an unknown function of the file /view-booking-detail.php of the component Account Detail Handler. The...

PT-2026-79260

Name of the Vulnerable Software and Affected Versions NLTK versions prior to 3.10.1 Description The URLS regular expression in nltk/tokenize/casual.py, which is compiled into TweetTokenizer.WORD RE and used by TweetTokenizer.tokenize, contains an unbounded domain-label prefix. When processing inp...

PT-2026-78530

Name of the Vulnerable Software and Affected Versions FFmpeg versions prior to commit 983dae9 Description An out-of-bounds read exists in the AV1 RTP packetizer within the libavformat/rtpenc av1.c file. The issue occurs during the keyframe detection loop when searching for a sequence header OBU...

PT-2026-57607

A vulnerability was determined in GNU LibreDWG 0.13.4-154-g0b573035. This impacts the function decompress R2004 section of the file src/decode.c of the component R2004 Section Decompression. Executing a manipulation can lead to heap-based buffer overflow. The attack requires local access. The...

PT-2026-56169

In MLflow versions prior to 3.14.0, when running with authentication enabled, the trace API endpoints lack proper authorization validators. This allows any authenticated user to bypass experiment-level authorization controls on all trace operations, including reading, deleting, and modifying trac...

PT-2026-54096

Name of the Vulnerable Software and Affected Versions Google Chrome on Mac versions prior to 150.0.7871.47 Description An out of bounds read exists in ANGLE, a compatibility layer that allows developers to use WebGL across different graphics APIs. A remote attacker who has already compromised the...

PT-2026-52617

Name of the Vulnerable Software and Affected Versions picklescan versions prior to 0.0.30 Description The software fails to detect malicious pickle files that invoke idlelib.pyshell.ModifiedInterpreter.runcode within reduce methods. This allows attackers to embed undetected code in pickle files...

PT-2026-51046

Name of the Vulnerable Software and Affected Versions Capgo versions prior to 12.128.2 Description A scope escalation issue exists in the 'POST /functions/v1/apikey' endpoint. This allows users with app-limited API keys to generate unrestricted keys by providing empty limits. An attacker possessi...

PT-2026-49647

Unauthenticated Cross Site Scripting XSS in Pods = 3.3.8 versions...

PT-2026-49691

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 152 Thunderbird versions prior to 152 Description A clickjacking issue exists in the Widget: Gtk component. Clickjacking is a technique where an attacker tricks a user into clicking something different from what the...

PT-2026-47172

An autonomous AI security agent just found 21 zero-days in FFmpeg for $1,000. Some were 23 years old. All came with working PoCs. CVE-2026-39210 through 39218 assigned. 12 more fixed, not yet numbered. This is what commodity AI vulnerability research https://t.co/zpeiwGSVQh https://t.co/ad6T1JxzD...

PT-2026-45540

Name of the Vulnerable Software and Affected Versions AI Tensor Engine for ROCm AITER versions prior to 0.1.15 Description An unauthenticated remote code execution issue exists in the MessageQueue.recv function within shm broadcast.py. This occurs because a ZMQ SUB socket lacks authentication,...

PT-2026-39453

Name of the Vulnerable Software and Affected Versions Wavlink NU516U1 version 240425 Description A weakness in the wzdapMesh function within the '/cgi-bin/adm.cgi' endpoint allows for remote OS command injection. This occurs when the system fails to properly sanitize input, enabling an attacker t...

PT-2026-41480

Name of the Vulnerable Software and Affected Versions opensearch versions prior to 2.19.0 opensearch-ingest-attachment-plugin affected versions not specified opensearch-mapper-annotated-text-plugin affected versions not specified opensearch-mapper-murmur3-plugin affected versions not specified...

PT-2026-37214

Name of the Vulnerable Software and Affected Versions OpenCTI versions 6.6.0 through 6.9.12 Description OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. A privilege escalation issue allows unauthenticated attackers to query the API as any existi...

PT-2026-36933

Name of the Vulnerable Software and Affected Versions RTGS2017 NagaAgent versions prior to 5.1.1 Description Improper processing of the file 'apiserver/routes/extensions.py' within the Skills Endpoint component allows for a remote path traversal attack. This occurs through the manipulation of the...