PT-2026-60964

Name of the Vulnerable Software and Affected Versions Apache Traffic Server versions 9.0.0 through 9.1.13 Apache Traffic Server versions 10.0.0 through 10.1.2 Description An uncontrolled resource consumption issue exists in Apache Traffic Server. This flaw allows for a denial of service via stall...

PT-2026-60864

Name of the Vulnerable Software and Affected Versions IBM Langflow OSS versions 1.0.0 through 1.10.0 Description A remote code execution issue exists in the disk-based caching mechanism. The AsyncDiskCache class uses the unsafe pickle.loads function to deserialize cached objects from disk without...

PT-2026-60521

Name of the Vulnerable Software and Affected Versions Legion Zone affected versions not specified Lenovo App Store affected versions not specified Description Insecure permissions in the Legion Zone and Lenovo App Store Windows applications, distributed exclusively in the Chinese market, may allo...

PT-2026-60526

HireFlow is a web-based interview management system for managing candidates, scheduling interviews, and tracking hiring progress. In 1.2 and earlier, app.py assigns a hard-coded Flask secret key used to sign session cookies, allowing unauthenticated attackers who know the public source value to...

PT-2026-60474

HCL DFXAnalytics is affected by an Internal File Path Disclosure vulnerability. The application dashboard inadvertently leaks sensitive information regarding its internal file structure and directory paths through unhandled error messages, system logs, or debugging output, which could allow a...

PT-2026-60575

SALTO ProAccess Space software using the tenancy feature / logical partition is vulnerable to a privilege escalation attack that could allow an authorized attacker to access any space managed by the affected product...

PT-2026-60549

An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. There is an XAPPLEPUSHSERVICE folder existence oracle and push hijack. An authenticated IMAP user could probe for the existence of arbitrary mailboxes on other users' accounts via the XAPPLEPUSHSERVICE command and then create...

PT-2026-60415

The Happy Coders OTP Login for WooCommerce WordPress plugin before 2.8 does not verify that a one-time password was actually validated before authenticating a user based on a supplied identifier, allowing unauthenticated attackers to log in as any existing user, including administrators, as well ...

PT-2026-60591

Out-of-bounds write vulnerability in Legion of the Bouncy Castle Inc. BC-LTS bcprov-lts8on on ARM allows Overflow Buffers. This vulnerability is associated with program files https://github.Com/bcgit/bc-lts-java/blob/main/native c/arm/sha/shake.C,...

PT-2026-60306

Name of the Vulnerable Software and Affected Versions 9Router versions prior to 0.5.2 Description A remote authenticated attacker can achieve arbitrary code execution on the host operating system. This is possible by combining a Host header bypass of localhost-only routes with unvalidated MCP...

PT-2026-60376

Name of the Vulnerable Software and Affected Versions safeurl versions prior to 0.2.4 Description The privateNetworks blocklist fails to include several newly added IPv6 CIDR ranges, specifically 64:ff9b:1::/48 NAT64 local-use prefix, 5f00::/16 Segment Routing SIDs, 3fff::/20 documentation prefix...

PT-2026-58876

Permissive Cross-domain Security Policy with Untrusted Domains in ASUS GameSDK allows a remote user to obtain a local user’s NTLM hash by convincing the user to visit a crafted web page that sends a request containing a UNC path to the application’s local service endpoint. This can result in...

PT-2026-58879

The Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin before 2.4.17 does not verify that a file upload is made against an existing form configured with a file-upload field, accepting uploads regardless of whether any such form exists, which allows unauthenticated users to upload...

PT-2026-60354

Name of the Vulnerable Software and Affected Versions Drupal core versions 0.0.0 through 11.3.14 Drupal core versions 11.4.0 through 11.4.4 Description Drupal core contains a cross-site scripting XSS issue due to improper neutralization of input during web page generation. The XSS filter does not...

PT-2026-58800

After Effects is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file...

PT-2026-58125

Name of the Vulnerable Software and Affected Versions SQL Server ODBC driver affected versions not specified Description A heap-based buffer overflow in the SQL Server ODBC driver allows an unauthorized remote attacker to execute arbitrary code over a network and achieve elevation of privilege. A...

PT-2026-58389

Name of the Vulnerable Software and Affected Versions Windows affected versions not specified Description A use-after-free condition in the Windows Runtime allows an authorized attacker to elevate privileges locally. A use-after-free is a memory corruption issue that occurs when an application...

PT-2026-58115

Name of the Vulnerable Software and Affected Versions Windows Audio Service affected versions not specified Description An issue in the Windows Audio Service allows an authorized attacker to locally disclose sensitive information to an unauthorized actor. Recommendations At the moment, there is n...

PT-2026-58851

Name of the Vulnerable Software and Affected Versions zhinianboke xianyu-auto-reply versions prior to 19fc3282a1bb78a05c34945c088525d20e081cbd Description An issue in the Backend User Endpoint allows remote attackers to perform manipulations that result in missing authorization. This occurs withi...

PT-2026-58695

Name of the Vulnerable Software and Affected Versions Microsoft Configuration Manager version 2509 Description Improper access control allows an authorized attacker to elevate privileges over a network. This issue can be part of an exploit chain involving broken access, CAB arbitrary-write path...

PT-2026-58728

Use after free in Ozone in Google Chrome prior to 150.0.7871.125 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: Critical...

PT-2026-58634

Name of the Vulnerable Software and Affected Versions Visual Studio Code versions prior to 1.128.1 Description The inclusion of functionality from an untrusted control sphere allows an unauthorized attacker to bypass a security feature over a network. Recommendations Update to version 1.128.1...

PT-2026-58827

A weakness has been identified in mastergo-design mastergo-magic-mcp up to 0.2.0. Impacted is the function z.string of the file src/tools/get-component-link.ts of the component mcp getComponentLink. Executing a manipulation of the argument url can lead to server-side request forgery. The attack m...

PT-2026-58840

Name of the Vulnerable Software and Affected Versions Illustrator affected versions not specified Description An out-of-bounds write issue exists that could allow arbitrary code execution within the context of the current user. This occurs when a user opens a specially crafted malicious file...

PT-2026-59757

Impact When the BaseCandidateSamplerOp function receives a value in true classes larger than range max, a heap oob vuln occurs. python tf.raw ops.ThreadUnsafeUnigramCandidateSampler true classes=0x100000,1, num true = 2, num sampled = 2, unique = False, range max = 2, seed = 2, seed2 = 2 Patches ...

PT-2026-57568

parse ipv4 in subsys/net/ip/utils.c reached via net ipaddr parse for strings of the form "a.b.c.d:port" copies the port substring into a fixed 17-byte stack buffer char ipaddrNET IPV4 ADDR LEN + 1 using a length of str len - end - 1, where str len is the full, unbounded input length and end is on...

PT-2026-57556

Capgo before 12.128.2 contains an information disclosure vulnerability in the unauthenticated /private/sso/check-domain endpoint that returns internal org id and provider id values. Attackers can enumerate email domains to build mappings of domains to organization UUIDs and SSO provider...

PT-2026-57439

PraisonAI before 4.6.78 contains arbitrary file write and command execution vulnerabilities in the AICoder component due to missing path validation and command sanitization in LLM tool calls. Attackers can inject malicious prompts through the chat interface to write files to arbitrary filesystem...

PT-2026-57480

The Bluetooth BAP Broadcast Assistant GATT client in subsys/bluetooth/audio/bap broadcast assistant.c reassembled remote Broadcast Receive State data into a single file-static net buf simple att buf, BT ATT MAX ATTRIBUTE LEN = 512 bytes shared by all connection instances, while the BUSY flag,...

PT-2026-56941

Missing Authorization vulnerability in themebeez Fascinate fascinate allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Fascinate: from n/a through = 1.1.5...

PT-2026-56548

Name of the Vulnerable Software and Affected Versions httplib2 versions prior to 0.32.0 Description An issue exists where the library performs unbounded decompression of HTTP response bodies encoded with Content-Encoding: gzip or deflate within the decompressContent function in httplib2/init.py. ...

PT-2026-56151

Name of the Vulnerable Software and Affected Versions Excelize versions prior to 2.11.0 Description The checkSheet function in github.com/xuri/excelize/v2 fails to validate the XML attribute value before using it as the length argument for a slice allocation in makexlsxRow, row. This lack of...

PT-2026-55989

Name of the Vulnerable Software and Affected Versions Qualcomm Snapdragon Auto affected versions not specified Description Memory corruption occurs when handling flash commands. This issue is caused by the use of outdated LED count values following modifications made in userspace. Recommendations...

PT-2026-55930

Name of the Vulnerable Software and Affected Versions GPAC versions prior to b40ce70f5 Description A heap-based buffer overflow occurs in the MP4Box component within the sgpd del entry function located in the src/isomedia/box code base.c file. This issue is triggered by the manipulation of the da...

PT-2026-55876

uniFLOW Universal Login Manager ULM Standalone contains an information disclosure vulnerability that may allow an authenticated administrator to access sensitive configuration information through the ULM Remote User Interface RUI. Exploitation requires administrative privileges and may disclose...

PT-2026-55994

Name of the Vulnerable Software and Affected Versions Qualcomm Snapdragon affected versions not specified Description Memory corruption occurs when processing invalid HT40 channel layouts during dynamic channel switching operations. HT40 refers to a High Throughput mode in wireless networking tha...

PT-2026-55975

Name of the Vulnerable Software and Affected Versions OP-TEE versions 3.3.0 through 4.10.x Description A resource leak exists in the shared memory cleanup logic of OP-TEE, a Trusted Execution Environment designed for Arm Cortex-A cores using TrustZone technology. The function cleanup shm refs in...

PT-2026-56022

Name of the Vulnerable Software and Affected Versions mrubyc versions prior to 3.4.2 Description A NULL pointer dereference occurs in the src/vm.c file within the op super function OP SUPER. This issue is caused by a missing runtime guard for top-level super. Recommendations Update to version 3.4...

PT-2026-55865

The Ultimate Member WordPress plugin before 2.12.0 does not properly sanitise and escape the value of custom textarea profile fields before outputting it on user profiles, allowing authenticated users with Subscriber-level access and above to store JavaScript that executes when any user, includin...

PT-2026-55991

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description Memory corruption occurs when the system attempts to allocate memory with sizes that exceed the maximum allowed value. Recommendations At the moment, there is no...

PT-2026-55983

The Form Vibes – Database Manager for Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Contact Form 7 Form Field in all versions up to, and including, 1.5.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers ...

PT-2026-55761

Name of the Vulnerable Software and Affected Versions code-projects Internship Management System version 1.0 Description An issue exists in the Employer Login Endpoint within the file employer/login.php. The manipulation of the email and password arguments allows for SQL injection, which is a...

PT-2026-55749

A vulnerability was determined in 666ghj BettaFish up to 1.2.1. Impacted is the function deduplicate results of the file InsightEngine/agent.py of the component InsightEngine search-result Deduplication. Executing a manipulation can lead to partial string comparison. The attack can be launched...

PT-2026-55788

A vulnerability was identified in code-projects Real State Services 1.0. The impacted element is an unknown function of the file /normalHomeSale.php. Such manipulation of the argument loc leads to sql injection. The attack may be performed from remote. The exploit is publicly available and might ...

PT-2026-55732

Name of the Vulnerable Software and Affected Versions SourceCodester Simple and Nice Shopping Cart Script version 1.0 Description An SQL injection issue exists in the Admin Login component within the /admin/login.php endpoint. The flaw allows remote attackers to manipulate the Username variable t...

PT-2026-55643

Name of the Vulnerable Software and Affected Versions Microsoft Edge for Android affected versions not specified Description An issue in Microsoft Edge for Android allows an unauthorized actor to disclose private personal information over a network. Recommendations At the moment, there is no...

PT-2026-55528

Name of the Vulnerable Software and Affected Versions Dell PowerProtect Data Domain versions 7.7.1.0 through 8.6 Dell PowerProtect Data Domain versions 8.6.1.0 through 8.6.1.10 Dell PowerProtect Data Domain versions 8.3.1.0 through 8.3.1.30 Dell PowerProtect Data Domain versions 7.13.1.0 through...

PT-2026-55645

Name of the Vulnerable Software and Affected Versions Microsoft Edge for Android affected versions not specified Description A time-of-check time-of-use TOCTOU race condition exists, which is a software bug where a system checks the state of a resource before using it, but the state changes betwe...

PT-2026-55647

Name of the Vulnerable Software and Affected Versions Microsoft Edge for Android affected versions not specified Description A relative path traversal issue exists in Microsoft Edge for Android. This flaw allows an unauthorized attacker to disclose information locally. Path traversal is a techniq...

PT-2026-55533

Name of the Vulnerable Software and Affected Versions Dell PowerProtect Data Domain versions 7.7.1.0 through 8.7 Dell PowerProtect Data Domain LTS2026 release versions 8.6.1.0 through 8.6.1.10 Dell PowerProtect Data Domain LTS2025 release versions 8.3.1.0 through 8.3.1.30 Dell PowerProtect Data...