PT-2026-61356

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the drm/msm/snapshot component where the snapshotting code internally aligns data segments to 16 bytes. While this is effective for DPU code, it fails when snapshottin...

PT-2026-61451

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the ALSA PCM data transfer process where the iov iter setup is incorrectly applied during silencing when data is NULL. This leads to the calculation of a bogus iov ite...

PT-2026-60651

The Grav API plugin getgrav/grav-plugin-api before 1.0.0-rc.16 shipped Access-Control-Allow-Origin: as its default CORS configuration on all responses, including authenticated endpoints and preflight OPTIONS responses. Because the plugin accepts credentials via the Authorization and X-API-Token...

PT-2026-60877

A vulnerability was detected in AstrBotDevs AstrBot up to 4.25.2. This affects the function update plugin/update all plugins of the file astrbot/dashboard/routes/plugin.py of the component Plugin Update Handler. The manipulation of the argument download url/download urls/proxy results in...

PT-2026-60502

Buffa is a pure-Rust Protocol Buffers implementation with first-class protobuf editions support. Prior to 0.7.0, a soundness bug in the OwnedView type allowed safe Rust code to trigger a use-after-free: the OwnedView::decode constructor transmuted a borrowed slice to &'static u8, and the Deref...

PT-2026-60456

stoatchat versions before 0.7.8 fail to enforce account creation restrictions including invite-only mode, email verification, captcha, and shield verification. Attackers can create unlimited accounts with unverified email addresses, increasing denial-of-service risk and compromising service...

PT-2026-60559

Activepieces is an open source AI workflow automation platform. Prior to 0.83.0, the /v1/step-files/signed download endpoint verified the supplied JWT against the shared signing secret but did not check the token's audience, and combined with a missing null-check on the decoded fileId, this allow...

PT-2026-60415

The Happy Coders OTP Login for WooCommerce WordPress plugin before 2.8 does not verify that a one-time password was actually validated before authenticating a user based on a supplied identifier, allowing unauthenticated attackers to log in as any existing user, including administrators, as well ...

PT-2026-60591

Out-of-bounds write vulnerability in Legion of the Bouncy Castle Inc. BC-LTS bcprov-lts8on on ARM allows Overflow Buffers. This vulnerability is associated with program files https://github.Com/bcgit/bc-lts-java/blob/main/native c/arm/sha/shake.C,...

PT-2026-60306

Name of the Vulnerable Software and Affected Versions 9Router versions prior to 0.5.2 Description A remote authenticated attacker can achieve arbitrary code execution on the host operating system. This is possible by combining a Host header bypass of localhost-only routes with unvalidated MCP...

PT-2026-58885

The HCM developed by MetaGuru has a SQL Injection vulnerability. Authenticated remote attackers can inject SQL commands via specific parameters, thereby compromising the confidentiality, integrity, and availability of database data...

PT-2026-60153

Name of the Vulnerable Software and Affected Versions ImageMagick versions prior to 7.1.2-26 ImageMagick versions 6.x prior to 6.9.13-51 Description A memory leak exists in the TIFF encoder. This issue occurs when the system is unable to create a temporary file, leading to a small amount of memor...

PT-2026-58867

Name of the Vulnerable Software and Affected Versions Kasa EC71 v4 affected versions not specified Kasa EC70 v4 affected versions not specified Description The firmware contains a static cryptographic private key stored in a read-only filesystem that is shared across all devices. An attacker with...

PT-2026-60321

Wekan is open source kanban built with Meteor. Prior to 9.32, the Wekan copyBoard Meteor DDP method in server/publications/boards.js copies a board by caller-supplied board ID without checking this.userId, membership, or admin access. Any authenticated user can copy a private board they are not a...

PT-2026-58389

Name of the Vulnerable Software and Affected Versions Windows affected versions not specified Description A use-after-free condition in the Windows Runtime allows an authorized attacker to elevate privileges locally. A use-after-free is a memory corruption issue that occurs when an application...

PT-2026-58286

Name of the Vulnerable Software and Affected Versions pyasn1 versions prior to 0.6.4 Description The BER decoder used by CER and DER codecs parses long-form tags by accumulating continuation octets without an upper bound on the tag ID size. A crafted input can force the construction of an...

PT-2026-60101

Name of the Vulnerable Software and Affected Versions netlicensing-mcp version 0.1.5 Description When running in HTTP transport mode, the software fails to enforce authentication in the ApiKeyMiddleware. Requests that do not provide a client API key are unconditionally forwarded to the next...

PT-2026-58837

Name of the Vulnerable Software and Affected Versions Adobe Illustrator affected versions not specified Description An improper input validation issue exists that could allow arbitrary code execution within the context of the current user. This occurs when a user opens a specially crafted malicio...

PT-2026-58675

Name of the Vulnerable Software and Affected Versions Devolutions Server version 2026.2.11 Devolutions Server version 2026.1.22 Description Improper authorization in the PAM SSH key and certificate retrieval endpoints allows an authenticated low-privileged user to disclose the private key of an S...

PT-2026-58394

Exposure of sensitive information to an unauthorized actor in Windows Media allows an unauthorized attacker to disclose information over a network...

PT-2026-58792

Animate is affected by an Untrusted Search Path vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed...

PT-2026-58057

A vulnerability in Sonatype Nexus Repository Manager's format-specific API key generation may allow a remote attacker to gain unauthorized access to repository operations as a targeted user. A format-specific API key realm NuGet API Key, Docker Bearer Token, or npm Bearer Token must be enabled an...

PT-2026-58790

Name of the Vulnerable Software and Affected Versions Creative Cloud Desktop affected versions not specified Description A Time-of-check Time-of-use TOCTOU Race Condition exists, which is a software bug where a program checks the state of a resource and then acts on that resource, but the state...

PT-2026-58406

Name of the Vulnerable Software and Affected Versions Windows affected versions not specified Description A use after free issue in the Content Delivery Manager allows an authorized local attacker to elevate privileges. Use after free is a memory corruption flaw that occurs when an application...

PT-2026-58836

Name of the Vulnerable Software and Affected Versions CAI Content Credentials affected versions not specified Description Improper input validation allows an attacker to bypass security features and obtain unauthorized write access. This issue can be exploited without any user interaction...

PT-2026-58840

Name of the Vulnerable Software and Affected Versions Illustrator affected versions not specified Description An out-of-bounds write issue exists that could allow arbitrary code execution within the context of the current user. This occurs when a user opens a specially crafted malicious file...

PT-2026-57978

Name of the Vulnerable Software and Affected Versions Apache Kylin versions 4 through 5.0.3 Description An SQL Injection issue exists where improper neutralization of special elements used in an SQL command occurs. This happens when a backend API refreshes the table catalog, which may lead to the...

PT-2026-59125

Impact In versions = 2.5.0, = 2.74.1 Workarounds If upgrading is not immediately possible: - reject file: and data: image references from untrusted input - allow only approved local or remote image sources - apply input size and memory limits to processing workers References - Fix release: v2.74....

PT-2026-59899

Impact If tf.raw ops.TensorListResize is given a nonscalar value for input size, it results CHECK fail which can be used to trigger a denial of service attack. python import numpy as np import tensorflow as tf a = data structures.tf tensor list newelements = tf.constantvalue=3, 4, 5 b = np.zeros0...

PT-2026-59132

Summary Dulwich's ProcessMergeDriver substitutes the file path from the git tree, controllable by an attacker via a malicious branch into the merge driver command via the %P placeholder and executes it with subprocess.run..., shell=True. An attacker who can cause a victim to merge an untrusted...

PT-2026-59529

Summary This vulnerability has been fixed in https://github.com/icip-cas/PPTAgent/commit/418491a9a1c02d9d93194b5973bb58df35cf9d00. CodeExecutor.execute actions pptagent/apis.py:126-205 processes LLM-generated slide editing actions using Python's eval: python pptagent/apis.py:184-186 partial func ...

PT-2026-57397

Name of the Vulnerable Software and Affected Versions Planyo Online Reservation System plugin for WordPress versions prior to 3.1 Description An unauthenticated Server-Side Request Forgery SSRF exists that leads to Local File Inclusion LFI. The ulap.php file functions as an AJAX proxy and is...

PT-2026-57427

Capgo before 12.128.12 contains a billing authorization bypass vulnerability in the plan valid calculation that allows organizations with exhausted or expired usage credit grants to bypass billing gates. Attackers can exploit the divergence between the plugin hot-path plan valid expression and th...

PT-2026-57013

Name of the Vulnerable Software and Affected Versions Vim versions prior to 9.2.0736 Description The PHP omni-completion script in runtime/autoload/phpcomplete.vim fails to escape class or trait names taken from the edited buffer before interpolating them into a search pattern executed via win...

PT-2026-56803

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Twiser Informatics Technology Consulting, Trade and Education Inc. OKRs & Goals allows Stored XSS. This issue affects OKRs & Goals: from 28220 before 28398...

PT-2026-56394

Name of the Vulnerable Software and Affected Versions Smash Balloon Social Photo Feed – Easy Social Feeds Plugin versions prior to 6.11.2 Description Cross-Site Request Forgery occurs due to missing or incorrect nonce validation in the maybe connection data function. This allows unauthenticated...

PT-2026-56425

Capgo before 12.128.2 contains a policy bypass vulnerability in app versions update enforcement that allows app-scoped API keys to downgrade encrypted bundles to non-encrypted state. Attackers with app-scoped all API keys can directly update the app versions table via PostgREST to clear session k...

PT-2026-56573

Name of the Vulnerable Software and Affected Versions MOVEit Transfer versions prior to 2025.0.7 MOVEit Transfer versions 2025.1.0 through 2025.1.2 Description An incorrect authorization issue exists within the Audit User module, which may allow unauthorized access or actions. Recommendations...

PT-2026-56272

Name of the Vulnerable Software and Affected Versions DBI versions prior to 1.650 Description Code injection is possible via a caller-influenced Profile attribute. When a string is assigned to this attribute, the software splits it into path, package, and arguments, then interpolates the package...

PT-2026-56259

Name of the Vulnerable Software and Affected Versions FastGPT versions 4.14.17 through 4.15.0-beta3 Description An authenticated tenant user can call the 'POST /api/core/dataset/collection/create/reTrainingCollection' endpoint to persist a datasetId value belonging to another tenant. This results...

PT-2026-56137

Name of the Vulnerable Software and Affected Versions Coolify versions prior to 4.0.0-beta.471 Description Coolify is an open-source tool for managing servers, applications, and databases. An authenticated member can execute commands as root on managed servers by injecting shell metacharacters in...

PT-2026-56176

Name of the Vulnerable Software and Affected Versions Apache Airflow versions prior to 3.3.0 Description The Bulk Variables API fails to pass the variable's key to the redactor. This prevents the should hide value for key function from identifying secret-suffixed key names, such as password, toke...

PT-2026-56274

Name of the Vulnerable Software and Affected Versions DBI versions prior to 1.650 Description An out-of-bounds read of one byte occurs in the preparse function when deleting an initial SQL comment. This happens during the normalization of SQL and the removal of comments. On memory-hardened builds...

PT-2026-56151

Name of the Vulnerable Software and Affected Versions Excelize versions prior to 2.11.0 Description The checkSheet function in github.com/xuri/excelize/v2 fails to validate the XML attribute value before using it as the length argument for a slice allocation in makexlsxRow, row. This lack of...

PT-2026-56063

Name of the Vulnerable Software and Affected Versions Langroid versions prior to 0.65.2 Description A sandbox escape exists in the TableChatAgent and VectorStore capabilities that allows unauthenticated remote code execution RCE on the host system. The issue occurs when agents evaluate...

PT-2026-55995

Name of the Vulnerable Software and Affected Versions The product name cannot be determined. affected versions not specified Description Memory corruption occurs when processing asynchronous input parameters. This is caused by a Time-of-Check to Time-of-Use TOCTOU race condition, where values are...

PT-2026-55868

The Admin and Site Enhancements ASE WordPress plugin before 8.8.4, admin-site-enhancements-pro WordPress plugin before 8.8.4 does not perform authentication, authorization, or nonce checks on a role-restoration request handler, allowing unauthenticated attackers to restore a previously demoted...

PT-2026-56019

Name of the Vulnerable Software and Affected Versions Coolify versions prior to 4.0.0-beta.471 Description An authenticated user with permissions to add file storage can execute arbitrary commands when storage is saved. This occurs because the LocalFileVolume::saveStorageOnServer function...

PT-2026-55966

Name of the Vulnerable Software and Affected Versions Pillow versions prior to 12.3.0 Description The WindowsViewer.get command function constructs a cmd.exe shell command by embedding a file path into an f-string without proper escaping. This result is then passed to subprocess.Popen...,...

PT-2026-55895

Name of the Vulnerable Software and Affected Versions Apache Camel versions 4.18.0 through 4.18.2 Apache Camel versions 4.19.0 through 4.20.x Description Deserialization of untrusted data in the Apache Camel PQC component occurs when HashicorpVaultKeyLifecycleManager,...