212496 matches found
PT-2026-32236
Access control vulnerability in the memo module. Impact: Successful exploitation of this vulnerability will affect availability and confidentiality...
PT-2026-32489
Name of the Vulnerable Software and Affected Versions Totolink A7100RU version 7.4cu.2313 b20191024 Description A security issue in the CGI Handler component allows for remote OS command injection. The problem exists in the setPasswordCfg function within the '/cgi-bin/cstecgi.cgi' file. An...
PT-2026-32257
Bluetooth ACPI Drivers provided by Dynabook Inc. contain a stack-based buffer overflow vulnerability. An attacker may execute arbitrary code by modifying certain registry values...
PT-2026-51970
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An out-of-bounds read occurs during the copying of elements from a BPF MAP TYPE CGROUP STORAGE map to a per-CPU pcpu map when the value size is not aligned to 8 bytes. The pcpu init valu...
PT-2026-31191
CVE-2026-39626 Improper Neutralization of Script-Related HTML Tags in a Web Page Basic XSS vulnerability in kutethemes Armania armania allows Code Injection.This issue affects Arm… https://t.co/tFnseFet6N...
PT-2026-30967
ChurchCRM is an open-source church management system. Prior to 7.1.0, there is a Reflected Cross-Site Scripting XSS vulnerability on the login page, which is caused by the lack of sanitization or encoding of the username parameter received from the URL. The username parameter value is directly...
PT-2026-31008
Name of the Vulnerable Software and Affected Versions Parse Server versions prior to 9.8.0-alpha.7 and prior to 8.6.75 Description Parse Server, an open-source backend deployable on Node.js infrastructures, is affected by an issue where the GET /sessions/me API endpoint improperly returns protect...
PT-2026-30568
A weakness has been identified in assafelovic gpt-researcher up to 3.4.3. This issue affects some unknown processing of the file gpt researcher/skills/researcher.py of the component WebSocket Interface. Executing a manipulation of the argument task can lead to cross site scripting. The attack may...
PT-2026-30005
Name of the Vulnerable Software and Affected Versions Electron versions prior to 38.8.6, 39.8.4, 40.8.4, and 41.0.0 Description Electron, a framework for building cross-platform desktop applications, had an issue where the nodeIntegrationInWorker webPreference was not correctly scoped. In specifi...
PT-2026-29684
A vulnerability was found in priyankark a11y-mcp up to 1.0.5. This vulnerability affects the function A11yServer of the file src/index.js. The manipulation results in server-side request forgery. The attack must be initiated from a local position. The exploit has been made public and could be use...
PT-2026-29675
Improper Check for Unusual or Exceptional Conditions vulnerability in Drupal SAML SSO - Service Provider allows Privilege Escalation. This issue affects SAML SSO - Service Provider: from 0.0.0 before 3.1.4...
PT-2026-29560
A vulnerability in the web-based management interface of Cisco IMC could allow an authenticated, remote attacker with admin-level privileges to execute arbitrary code as the root user. This vulnerability is due to improper validation of user-supplied input to the web-based management interface. A...
PT-2026-28272
Cache misconfiguration vulnerability in OpenText Identity Manager on Windows, Linux allows remote authenticated users to obtain another user's session data via insecure application cache handling. This issue affects Identity Manager: 25.2v4.10.1...
PT-2026-28426
Name of the Vulnerable Software and Affected Versions Keycloak affected versions not specified Description A flaw exists in Keycloak where an administrator possessing manage-clients permission can exploit a misconfiguration. This misconfiguration arises when the manage-clients permission is...
PT-2026-28600
Name of the Vulnerable Software and Affected Versions Stirling-PDF versions prior to 2.8.0 Description Stirling-PDF is a locally hosted web application designed for PDF file operations. The /api/v1/convert/eml/pdf API endpoint, when used with the downloadHtml=true parameter, returns unsanitized...
PT-2026-28167
Name of the Vulnerable Software and Affected Versions yaml versions prior to 1.10.3 yaml versions prior to 2.8.3 Description The yaml library is susceptible to a stack overflow when parsing YAML documents. The issue occurs during the node resolution/composition phase, which uses recursive functio...
PT-2026-51011
Name of the Vulnerable Software and Affected Versions Grafana Tempo affected versions not specified Description A TraceQL query containing a large exemplars hint value can lead to excessive memory allocation within the Tempo instance. This condition may result in an out-of-memory crash, allowing ...
PT-2026-30912
Name of the Vulnerable Software and Affected Versions Cockpit versions prior to 360 Description The remote login feature in Cockpit fails to validate or sanitize user-supplied hostnames and usernames passed from the web interface to the SSH client. An attacker with network access to the web servi...
PT-2026-26548
A vulnerability was found in Comfast CF-AC100 2.6.0.8. This impacts an unknown function of the file /cgi-bin/mbox-config?method=SET§ion=wireless device dissoc. The manipulation results in command injection. The attack can be executed remotely. The exploit has been made public and could be use...
PT-2026-25918
Sipeed NanoKVM before 2.3.1 exposes a Wi-Fi configuration endpoint without proper security checks, allowing an unauthenticated attacker with network access to change the saved configured Wi-Fi network to one of the attacker's choosing, or craft a request to exhaust the system memory and terminate...
PT-2026-25681
A security flaw has been discovered in SSCMS 7.4.0. This vulnerability affects unknown code of the file SitesAddController.Submit.cs of the component DDL Handler. The manipulation of the argument tableHandWrite results in sql injection. The attack can be executed remotely. The exploit has been...
PT-2026-25720
Next Click Ventures RealtyScript 4.0.2 contains a cross-site request forgery vulnerability that allows unauthenticated attackers to create unauthorized user accounts and administrative users by crafting malicious forms. Attackers can submit hidden form data to /admin/addusers.php and...
PT-2026-25220
Missing Authorization vulnerability in Cozy Vision SMS Alert Order Notifications sms-alert allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SMS Alert Order Notifications: from n/a through = 3.9.0...
PT-2026-24632
Socket.IO clients can send arbitrary JavaScript objects as the id argument to any service method get, patch, update, remove. The transport layer performs no type checking on this argument. When the service uses the MongoDB adapter, these objects pass through getObjectId and land directly in the...
PT-2026-24246
A NULL Pointer Dereference vulnerability CWE-476 vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.2, FortiWeb 7.6.0 through 7.6.6, FortiWeb 7.4 all versions, FortiWeb 7.2 all versions, FortiWeb 7.0 all versions may allow an authenticated attacker to crash the HTTP daemon via crafted HTTP...
PT-2026-23972
A flaw has been found in SourceCodester Client Database Management System 1.0. This issue affects some unknown processing of the file /superadmin user delete.php of the component Endpoint. Executing a manipulation of the argument user id can lead to improper authorization. The attack may be...
PT-2026-23660
Name of the Vulnerable Software and Affected Versions AppEngine affected versions not specified Description An attacker may perform unauthenticated read and write operations on sensitive filesystem areas via the AppEngine Fileaccess over HTTP due to improper access restrictions. A critical...
PT-2026-23729
Name of the Vulnerable Software and Affected Versions Binutils version 2.44 Description Binutils objdump is susceptible to a denial-of-service condition when processing a specially crafted binary file containing improperly formatted DWARF debug information. A flaw in the handling of DWARF...
PT-2026-41140
Name of the Vulnerable Software and Affected Versions Portainer Community Edition versions 2.33.0 through 2.33.7 Portainer Community Edition versions 2.39.0 through 2.39.1 Portainer Community Edition versions prior to 2.41.0 Description Portainer includes a security setting to disable bind mounts...
PT-2026-22944
Name of the Vulnerable Software and Affected Versions affected versions not specified Description A flaw in how network packets are handled could let an authorized attacker create a harmful Wi-Fi frame. This frame could trick an Access Point AP into treating it as group traffic and re-encrypting ...
PT-2026-26419
Summary In [email protected], sandbox network hardening blocks network=host but still allows network=container:. This can let a sandbox join another container's network namespace and reach services available in that namespace. Preconditions and Trust Model Context This issue requires a...
PT-2026-47313
Name of the Vulnerable Software and Affected Versions Apache HTTP Server versions 2.4.0 through 2.4.67 Description A Use After Free issue exists in Apache HTTP Server when using mod ldap in per-directory configuration. Use After Free occurs when an application continues to use a pointer after it...
PT-2026-22627
Name of the Vulnerable Software and Affected Versions ZimaOS versions prior to 1.5.1 Description ZimaOS, a fork of CasaOS, is susceptible to a flaw stemming from inadequate validation or restriction of target URLs. An authenticated local user can construct requests that target internal IP...
PT-2026-22285
A vulnerability was detected in libvips 8.19.0. This affects the function vips bandrank build of the file libvips/conversion/bandrank.c. Performing a manipulation of the argument index results in heap-based buffer overflow. The attack must be initiated from a local position. The exploit is now...
PT-2026-22122
The installer of FinalCode Client provided by Digital Arts Inc. contains an incorrect default permissions vulnerability. A non-administrative user may execute arbitrary code with SYSTEM privilege...
PT-2026-22230
Charging station authentication identifiers are publicly accessible via web-based mapping platforms...
PT-2026-21923
Name of the Vulnerable Software and Affected Versions Budibase versions prior to 3.30.4 Description Budibase, a low-code platform for creating internal tools, workflows, and admin panels, contains an unsafe eval vulnerability in its view filtering implementation. This issue affects Budibase Cloud...
PT-2026-21405
Name of the Vulnerable Software and Affected Versions UTT HiPER 810G version 1.7.7-171114 Description A buffer overflow issue exists in the strcpy function within the /goform/ConfigExceptAli file of UTT HiPER 810G version 1.7.7-171114. The strcpy function lacks bounds checking, allowing malicious...
PT-2026-20716
Missing Authorization vulnerability in WP Chill Image Photo Gallery Final Tiles Grid final-tiles-grid-gallery-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Image Photo Gallery Final Tiles Grid: from n/a through = 3.6.10...
PT-2026-8347
Name of the Vulnerable Software and Affected Versions SOLIDWORKS eDrawings versions 2025 through 2026 Description An Out-Of-Bounds Write issue exists in the EPRT file reading process of SOLIDWORKS eDrawings. Successful exploitation of this issue could allow an attacker to execute arbitrary code b...
PT-2026-43757
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A flaw in the xen-netback component allows a malicious or buggy Xen guest to cause a guest-to-host denial of service on systems where panic on warn is set to 1. The issue occurs because...
PT-2026-8030
Name of the Vulnerable Software and Affected Versions Calero VeraSMART versions prior to 2022 R1 Description An unauthenticated .NET Remoting HTTP service is exposed on TCP port 8001 in affected versions. The service publishes default ObjectURIs, including EndeavorServer.rem and...
PT-2026-7435
Under specific conditions when processing a maliciously crafted value of type Hash r, Mongoid::Criteria.from hash may allow for executing arbitrary Ruby code...
PT-2026-7246
The Name Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via double HTML-entity encoding in all versions up to, and including, 1.32.0. This is due to the plugin's sanitization function calling html entity decode before wp kses, and then calling html entity decode again...
PT-2026-7161
Name of the Vulnerable Software and Affected Versions PlaciPy version 1.0.0 Description PlaciPy is a placement management system for educational institutions. The admin authorization middleware in version 1.0.0 trusts client-controlled JWT claims, specifically the role and scope, without performi...
PT-2026-6994
Name of the Vulnerable Software and Affected Versions D-Link DIR-600 versions prior to 2.15WWb02 Description A flaw exists in D-Link DIR-600 firmware up to version 2.15WWb02 related to the ssdp.cgi file. Manipulation of the HTTP ST/REMOTE ADDR/REMOTE PORT/SERVER ID argument can lead to command...
PT-2026-6680
Name of the Vulnerable Software and Affected Versions Orange Confort+ accessibility toolbar for WordPress plugin versions prior to 0.7 Description The Orange Confort+ accessibility toolbar for WordPress plugin is susceptible to Stored Cross-Site Scripting. This is due to insufficient input...
PT-2026-5903
Name of the Vulnerable Software and Affected Versions AION version 2.0 Description A configuration issue exists where the root file system is not mounted as read-only. This can allow unintended modifications to critical system files, potentially increasing the risk of system compromise or...
PT-2026-5614
A vulnerability was identified in JeecgBoot 3.9.0. This vulnerability affects unknown code of the file /JeecgBoot/sys/api/loadDictItemByKeyword of the component Online Report API. Such manipulation of the argument keyword leads to sql injection. The attack can be executed remotely. The exploit is...
PT-2026-6479
Summary SageMaker Python SDK is an open source library for training and deploying machine learning models on Amazon SageMaker. An issue where the HMAC secret key is stored in environment variables and disclosed via the DescribeTrainingJob API has been identified. Impact - Function and Payload...