PT-2026-29688

Name of the Vulnerable Software and Affected Versions W3 Total Cache versions up to and including 2.9.3 Description The W3 Total Cache plugin for WordPress is susceptible to information disclosure. The plugin bypasses its output buffering and processing when the User-Agent header contains "W3 Tot...

PT-2026-29684

A vulnerability was found in priyankark a11y-mcp up to 1.0.5. This vulnerability affects the function A11yServer of the file src/index.js. The manipulation results in server-side request forgery. The attack must be initiated from a local position. The exploit has been made public and could be use...

PT-2026-29016

Free IP Switcher 3.1 contains a buffer overflow vulnerability that allows local attackers to crash the application by supplying an excessively long string in the Computer Name field. Attackers can paste a malicious payload into the Computer Name input field and click Activate to trigger a denial ...

PT-2026-46552

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 149.0.7827.53 Description An inappropriate implementation in WebAppInstalls allows a remote attacker who has compromised the renderer process to bypass the same origin policy, which is a security mechanism that...

PT-2026-32988

Hackage package metadata stored XSS vulnerability User-controlled metadata from .cabal files are rendered into HTML href attributes without proper sanitization, enabling stored Cross-Site Scripting XSS attacks. The specific fields affected are: - homepage - bug-reports - source-repository.locatio...

PT-2026-28189

A security vulnerability has been detected in code-projects Accounting System 1.0. Impacted is an unknown function of the file /my account/add costumer.php of the component Web Application Interface. Such manipulation of the argument costumer name leads to cross site scripting. The attack may be...

PT-2026-27191

Name of the Vulnerable Software and Affected Versions AVideo versions up to and including 26.0 Description AVideo is an open source video platform. The downloadVideoFromDownloadURL function in objects/aVideoEncoder.json.php saves remote content to a web-accessible temporary directory using the...

PT-2026-26438

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. SuiteCRM 7.15.0 contains a reflected HTML injection vulnerability in the login page that allows attackers to inject arbitrary HTML content, enabling phishing attacks and page defacement. Versio...

PT-2026-41199

Name of the Vulnerable Software and Affected Versions Open WebUI versions prior to 0.8.11 Description The API endpoint '/api/v1/notes/note id' lacks proper authorization checks, allowing authenticated users to retrieve notes belonging to other users by guessing or enumerating note id UUIDs. This...

PT-2026-25681

A security flaw has been discovered in SSCMS 7.4.0. This vulnerability affects unknown code of the file SitesAddController.Submit.cs of the component DDL Handler. The manipulation of the argument tableHandWrite results in sql injection. The attack can be executed remotely. The exploit has been...

PT-2026-24584

🚨 CVE-2026-1753 The Gutena Forms WordPress plugin before 1.6.1 does not validate option to be updated, which could allow contributors and above role to update arbitrary boolean and array options such as users can register. 🎖@cveNotify...

PT-2026-37580

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the x86 architecture during the kexec process. When a second-stage kernel is booted using a limiting command line, such as mem=, the physical range containing the...

PT-2026-23098

Name of the Vulnerable Software and Affected Versions IDC SFX2100 satellite receiver affected versions not specified Description The /sbin/ip utility is installed with the setuid bit set on the IDC SFX2100 satellite receiver. This configuration allows any local user who can execute the binary to...

PT-2026-22910

Dell PowerScale OneFS, versions prior to 9.10.1.6 and versions 9.11.0.0 through 9.12.0.1, contains an execution with unnecessary privileges vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of privileges...

PT-2026-22885

Name of the Vulnerable Software and Affected Versions Delta Electronics CNCSoft-G2 affected versions not specified Description Delta Electronics CNCSoft-G2 does not properly validate user-supplied files. An attacker can exploit this by having a user open a malicious file, potentially leading to...

PT-2026-26419

Summary In [email protected], sandbox network hardening blocks network=host but still allows network=container:. This can let a sandbox join another container's network namespace and reach services available in that namespace. Preconditions and Trust Model Context This issue requires a...

PT-2026-22389

Name of the Vulnerable Software and Affected Versions phpMyFAQ versions prior to 4.0.18 Description The WebAuthn prepare endpoint, /api/webauthn/prepare, in versions prior to 4.0.18 lacks authentication, CSRF protection, captcha, or configuration checks. This allows unauthenticated attackers to...

PT-2026-44418

Name of the Vulnerable Software and Affected Versions Archer C64 v1 Description Improper enforcement of authentication rate-limiting on a debug SSH service allows unlimited authentication attempts. Because the SSH service uses the same credentials as the web interface, an attacker with adjacent...

PT-2026-22230

Name of the Vulnerable Software and Affected Versions Charging station software affected versions not specified Description Authentication identifiers for charging stations are publicly accessible through web-based mapping platforms. This exposure potentially allows unauthorized access or...

PT-2026-21986

Name of the Vulnerable Software and Affected Versions Windows versions prior to September 2025 cumulative update for Windows 11 2024 LTSC and Windows Server 2025 Windows 11 23H2 and earlier Description The issue is caused by improper handling of invalid use of special elements within the CLFS.sys...

PT-2026-21622

A null pointer dereference vulnerability in the account settings CGI program of the Zyxel VMG3625-T50B firmware versions through 5.50ABPM.9.6C0 and the Zyxel WX3100-T0 firmware versions through 5.50ABVL.4.8C0 could allow an authenticated attacker with administrator privileges to trigger a...

PT-2026-21786

Name of the Vulnerable Software and Affected Versions Devolutions Server versions prior to 2025.3.15 Description An authenticated user can bypass permissions and access entries due to a permission cache poisoning issue in Devolutions Server. Recommendations Update Devolutions Server to version...

PT-2026-20895

Name of the Vulnerable Software and Affected Versions GFI MailEssentials AI versions prior to 22.4 Description GFI MailEssentials AI versions prior to 22.4 contain a stored cross-site scripting issue in the Sender Policy Framework Email Exceptions interface. An authenticated user can inject HTML ...

PT-2026-20791

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.2.15 Description The application logs Telegram bot tokens without redaction when they appear in error messages or stack traces, such as in request URLs including https://api.telegram.org/bot/.... This can lead t...

PT-2026-20336

Name of the Vulnerable Software and Affected Versions Beetel 777VR1 versions prior to 01.00.10 Description A security issue exists in the SSH Service component of Beetel 777VR1. The issue involves the use of risky cryptographic algorithms and is potentially exploitable remotely. The exploitabilit...

PT-2026-7972

Name of the Vulnerable Software and Affected Versions SIMATIC CN 4100 versions prior to V5.0 Description The application does not properly restrict unauthenticated connections, making it susceptible to resource exhaustion. This condition allows an attacker to disrupt normal operations or perform...

PT-2026-6982

A vulnerability was identified in SourceCodester/Patrick Mvuma Patients Waiting Area Queue Management System 1.0. Impacted is an unknown function of the file /registration.php of the component Patient Registration Module. The manipulation of the argument First Name leads to cross site scripting...

PT-2026-5454

Name of the Vulnerable Software and Affected Versions IBM Db2 for Windows versions 12.1.0 through 12.1.3 Description IBM Db2 for Windows versions 12.1.0 through 12.1.3 may allow a local user with filesystem access to escalate their privileges. This is due to the use of an unquoted search path...

PT-2026-5091

Johnson Controls iSTAR Configuration Utility ICU has Stack-based Buffer Overflow vulnerability. This issue affects iSTAR Configuration Utility ICU version 6.9.7 and prior. Successful exploitation of this vulnerability could result in failure within the operating system of the machine hosting the...

PT-2026-5019

Name of the Vulnerable Software and Affected Versions Taiga versions prior to 6.10.2 Description Missing authorization allows unauthenticated remote attackers to create default due-date records in any project. This is achieved by exploiting unprotected POST endpoints on the user-story, task, and...

PT-2026-4724

Name of the Vulnerable Software and Affected Versions code-projects Online Examination System version 1.0 Description A flaw exists in the Add Pages component of the software, allowing for cross site scripting. This manipulation can be executed remotely. The exploit details have been publicly...

PT-2026-4599

The SurveyJS: Drag & Drop WordPress Form Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.12.20. This is due to missing nonce validation on the SurveyJS AddSurvey AJAX action. This makes it possible for unauthenticated attackers to...

PT-2026-4317

Name of the Vulnerable Software and Affected Versions FOG versions 1.5.10.1754 and below Description FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Versions 1.5.10.1754 and below contain an unauthenticated Server-Side Request Forgery SSRF condition in the...

PT-2026-4499

Name of the Vulnerable Software and Affected Versions LavaLite CMS versions up to and including 10.1.0 Description LavaLite CMS is affected by a stored cross-site scripting issue in the package creation and search functionality. Authenticated users can inject crafted HTML or JavaScript into the...

PT-2026-4460

Name of the Vulnerable Software and Affected Versions Stylish Cost Calculator versions through 8.1.8 Description The software contains a flaw due to improper handling of user-supplied data when creating web pages, leading to a potential Cross-site Scripting XSS issue. This specific instance allow...

PT-2026-3524

Name of the Vulnerable Software and Affected Versions CRMEB versions prior to 5.6.4 Description A security flaw exists in CRMEB that allows improper authentication. This is due to manipulation of the openId argument within the appleLogin function located in the file...

PT-2026-3510

Name of the Vulnerable Software and Affected Versions Arcane versions prior to 1.13.2 Description Arcane, an interface for managing Docker containers, images, networks, and volumes, had a flaw where unauthenticated requests could be forwarded to remote environment agents, granting access to remot...

PT-2026-3365

A security vulnerability has been detected in LigeroSmart up to 6.1.26. The affected element is an unknown function of the file /otrs/index.pl. Such manipulation of the argument TicketID leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed...

PT-2026-3269

Name of the Vulnerable Software and Affected Versions Kafka Connect BigQuery Connector versions prior to 2.11.0 Description The Kafka Connect BigQuery Connector, a sink connector from Apache Kafka to Google BigQuery, contains a flaw that could allow arbitrary file reads. This occurs because the...

PT-2026-2073

Name of the Vulnerable Software and Affected Versions UBB-XG versions 1.2.2 and earlier UDB-Pro/UDB-Pro-Sector versions 1.4.1 and earlier UBB versions 3.1.5 and earlier Description A malicious actor within Wi-Fi range of the affected product could exploit a flaw in the airMAX Wireless Protocol to...

PT-2026-1321

Name of the Vulnerable Software and Affected Versions Samsung Mobile Processor, Wearable Processor, and Modem Exynos 980 Samsung Mobile Processor, Wearable Processor, and Modem Exynos 990 Samsung Mobile Processor, Wearable Processor, and Modem Exynos 850 Samsung Mobile Processor, Wearable...

PT-2026-8163

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The Linux kernel contains a flaw in the flexible proportions code. A lockdep splat can occur due to a race condition within the fprop new period function. Specifically, the issue arises...

PT-2025-50968

Name of the Vulnerable Software and Affected Versions Frappe Learning Management System LMS versions prior to 2.42.0 Description Frappe Learning Management System LMS allows authenticated attackers to inject JavaScript code through the Company Website field within the Job Form. This can lead to a...

PT-2025-46865

Name of the Vulnerable Software and Affected Versions Linksys E1200 v2 routers versions prior to v2.0.11.001 us Description A stack-based buffer overflow exists in the httpd binary of Linksys E1200 v2 routers. The apply cgi and block cgi functions copy user-supplied input from the url CGI paramet...

PT-2025-46876

Name of the Vulnerable Software and Affected Versions Wolfram Cloud affected versions not specified Description The default Java Virtual Machine JVM can access files and directories within /tmp/, including the $TemporaryDirectory of other users on the same cloud instance located at...

PT-2026-50786

Name of the Vulnerable Software and Affected Versions libssh2 versions prior to 1.11.1 commit 2dae302 Description An out-of-bounds heap read exists in the sftp symlink function within src/sftp.c. A malicious SSH server or man-in-the-middle attacker can disclose heap memory contents or cause a cra...

PT-2025-41180

『allow an unauthenticated user to execute arbitrary commands with lower user privileges on the system』 IBM Security Verify Access and IBM Verify Identity Access products. CVE-2025-36354, CVE-2025-36355, CVE-2025-363546 https://t.co/SJGzwogo72...

PT-2025-35402

Name of the Vulnerable Software and Affected Versions: Portabilis i-Educar versions up to 2.10 Description: A vulnerability exists in Portabilis i-Educar that allows for cross site scripting. The issue is related to the manipulation of the nm tipo argument within the file /intranet/educar tipo...

PT-2025-34680 · Lostvip Com · Ruoyi-Go

Name of the Vulnerable Software and Affected Versions: lostvip-com ruoyi-go versions prior to 2.1 Description: A security flaw exists in the DownloadTmp/DownloadUpload function within the modules/system/controller/CommonController.go file. Manipulation of the fileName argument can lead to a path...

PT-2025-32141

Name of the Vulnerable Software and Affected Versions: Qualcomm Snapdragon QCA7005 affected versions not specified Description: The vulnerability allows information disclosure while accessing and modifying the PIB file of a remote device via powerline communication. Recommendations: At the moment...