PT-2026-60333

Name of the Vulnerable Software and Affected Versions Dulwich versions prior to 1.1.0 Description Dulwich fails to perform SSH host key verification within the contrib/paramiko vendor.py file. This lack of verification allows for potential man-in-the-middle attacks during SSH connections...

PT-2026-60233

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.4.1 Splunk Enterprise versions prior to 10.2.5 Splunk Enterprise versions prior to 10.0.8 Splunk Enterprise versions prior to 9.4.13 Splunk Cloud Platform versions prior to 10.5.2605.0 Splunk Cloud Platfo...

PT-2026-60145

Name of the Vulnerable Software and Affected Versions grav-plugin-api versions prior to 1.0.4 Description An unauthenticated attacker can cause a password reset email to contain a link pointing to a server under their control. This occurs because the sanitizeHttpUrl function fails to verify the...

PT-2026-58424

Name of the Vulnerable Software and Affected Versions Windows 10 Windows 11 Windows Server versions 2012 through 2025 Description A heap-based buffer overflow exists in Windows Message Queuing MSMQ, a service used for asynchronous communication between applications. This flaw allows an unauthoriz...

PT-2026-58817

ColdFusion is affected by an Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction. Scope is changed...

PT-2026-58286

Name of the Vulnerable Software and Affected Versions pyasn1 versions prior to 0.6.4 Description The BER decoder used by CER and DER codecs parses long-form tags by accumulating continuation octets without an upper bound on the tag ID size. A crafted input can force the construction of an...

PT-2026-60102

Name of the Vulnerable Software and Affected Versions Anyquery affected versions not specified Description When operating in server mode, the software does not restrict outbound HTTP requests initiated by built-in SQLite virtual table modules, such as json reader and log reader. Unauthenticated...

PT-2026-58230

Heap-based buffer overflow in Windows Kernel allows an unauthorized attacker to elevate privileges with a physical attack...

PT-2026-58820

ColdFusion is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized read access. Exploitation of this issue does not require user...

PT-2026-58288

Name of the Vulnerable Software and Affected Versions jackson-databind versions 2.15.0 through 2.18.7 jackson-databind versions 2.21.0 through 2.21.3 jackson-databind versions 3.1.0 through 3.1.3 Description Java Records using a PropertyNamingStrategy can bypass the @JsonIgnore annotation. This...

PT-2026-58319

Name of the Vulnerable Software and Affected Versions Windows Server Update Service affected versions not specified Description An uncaught exception in the Windows Server Update Service allows an unauthorized attacker to perform tampering over a network. Recommendations Deploy the July 14 update...

PT-2026-58334

Name of the Vulnerable Software and Affected Versions Windows affected versions not specified Description Improper authorization in the RPC Runtime allows an authorized attacker to elevate privileges locally. This issue specifically involves the Netlogon RPC, which can be leveraged to escalate a...

PT-2026-58151

Name of the Vulnerable Software and Affected Versions Windows 10 Version 1607 Description Improper privilege management in the Windows WalletService allows an authorized attacker to elevate privileges locally. This issue enables an attacker to gain higher-level access to the system. Recommendatio...

PT-2026-58503

Name of the Vulnerable Software and Affected Versions Windows DHCP Server affected versions not specified Description A heap-based buffer overflow exists in Windows DHCP Server. This flaw allows an authorized attacker located on an adjacent network to elevate their privileges. A heap-based buffer...

PT-2026-58019

Name of the Vulnerable Software and Affected Versions Arena Simulation affected versions not specified Description An issue exists in the model.exe Siman component where improper validation of user-supplied data leads to memory corruption via an out-of-bounds write. This occurs when the software...

PT-2026-58182

Name of the Vulnerable Software and Affected Versions Windows Kernel affected versions not specified Description An issue in the Windows Kernel allows a local unauthorized attacker to disclose sensitive system information to an unauthorized control sphere. Recommendations At the moment, there is ...

PT-2026-58057

A vulnerability in Sonatype Nexus Repository Manager's format-specific API key generation may allow a remote attacker to gain unauthorized access to repository operations as a targeted user. A format-specific API key realm NuGet API Key, Docker Bearer Token, or npm Bearer Token must be enabled an...

PT-2026-57766

Deserialization of Untrusted Data vulnerability in axiomthemes 777 triple-seven allows Object Injection.This issue affects 777: from n/a through = 1.13.0...

PT-2026-57779

Improper Control of Generation of Code 'Code Injection' vulnerability in Realtyna Realtyna Organic IDX plugin real-estate-listing-realtyna-wpl allows Remote Code Inclusion.This issue affects Realtyna Organic IDX plugin: from n/a through = 5.2.0...

PT-2026-59280

In mcp-server-git versions prior to 2026.1.14, the git add tool did not validate that file paths provided in the files argument were within the repository boundaries. The tool used GitPython's repo.index.add, which did not enforce working-tree boundary checks for relative paths. As a result,...

PT-2026-57527

Name of the Vulnerable Software and Affected Versions TRENDnet TEW-821DAP version 1.12B01 Description A buffer overflow can be triggered remotely via the nslookup target argument in the sub 41EC14 function within the /goform/tools nslookup file of the ssi component. This issue affects products th...

PT-2026-57068

The Chat Help – Click to Chat Button & Form plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.1.3 via the REST API endpoints /wp-json/chat-help/v1/leads and /wp-json/chat-help/v1/leads/id. This is due to the plugin not performing any...

PT-2026-57269

Name of the Vulnerable Software and Affected Versions Snipe-IT versions prior to 8.6.2 Description An authorization flaw exists in the IT asset and license management system. The endpoint "/api/v1/kits/kit id/licenses" verifies if the user has permissions to edit kits but fails to authorize acces...

PT-2026-56830

Name of the Vulnerable Software and Affected Versions Open WebUI versions 0.9.0 through 0.9.x Description The execute automation function rehydrated automation owners without verifying if they remained active or retained features.automations permissions. Additionally, the check model access...

PT-2026-57016

The LoginPress Pro plugin for WordPress is vulnerable to Authentication Bypass via Unverified OAuth Email in all versions up to and including 6.2.3. The vulnerability exists in the loginpress on discord login Discord OAuth callback handler, which accepts the email field returned by Discord's...

PT-2026-57043

Name of the Vulnerable Software and Affected Versions rattler cache affected versions not specified py-rattler affected versions not specified Description These components are susceptible to package-cache path traversal when processing package metadata from conda channels. During cache...

PT-2026-56843

Name of the Vulnerable Software and Affected Versions note-mark affected versions not specified Description An unauthenticated user can access metadata of soft-deleted notes belonging to public books. This occurs because the endpoint '/api/books/bookID/notes' allows the use of a deleted query...

PT-2026-56659

Name of the Vulnerable Software and Affected Versions Drupal Login Disable versions 0.0.0 through 2.1.4 Description The Login Disable module, which restricts site access by requiring a secret key on the login form, does not sufficiently protect the form from brute force attacks. An attacker could...

PT-2026-56487

Name of the Vulnerable Software and Affected Versions Socket.IO versions 6.5.0 through 6.6.6 Description Engine.IO servers with WebTransport enabled are susceptible to a denial of service. During WebTransport upgrade handling, the server can resolve a crafted session ID, such as proto , through a...

PT-2026-56587

Name of the Vulnerable Software and Affected Versions GitLab EE versions 9.5 through 18.11.6 GitLab EE versions 19.0 through 19.0.3 GitLab EE versions 19.1 through 19.1.1 Description Improper authorization controls could allow an authenticated user with maintainer-role permissions to obtain the...

PT-2026-56641

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 150.0.7871.115 Description Insufficient validation of untrusted input in Codecs allows a remote attacker who has compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. ...

PT-2026-61024

Name of the Vulnerable Software and Affected Versions xrdp versions prior to 0.10.6.1 Description An issue exists when an authenticated user session is initialized using the Xvnc backend over UNIX domain sockets, as the Xvnc process is launched with insufficient authentication mechanisms. A local...

PT-2026-56174

Name of the Vulnerable Software and Affected Versions PcVue versions prior to 17.0.0 Description The encryption algorithm used to protect the configuration of user accounts within the built-in user directory of projects is insufficient. This weakness allows a local attacker to modify the existing...

PT-2026-56248

Name of the Vulnerable Software and Affected Versions DataEase versions prior to 2.10.24 Description DataEase is an open source data visualization and analysis tool. The H2 database JDBC URL validation logic can be bypassed using special Unicode characters. This occurs because the case-conversion...

PT-2026-55986

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description Memory corruption occurs when processing multiple IOCTL Input/Output Control calls that use the same buffer file descriptor input. This issue is caused by a...

PT-2026-56078

Name of the Vulnerable Software and Affected Versions Coder versions 2.33.0 through 2.33.7 Coder versions 2.34.0 through 2.34.1 Description AI Bridge provider handlers read request bodies using io.ReadAll without enforcing a maximum size. An authenticated user with AI Bridge access can send an...

PT-2026-56212

Name of the Vulnerable Software and Affected Versions xWiki versions prior to 17.10.5 xWiki versions prior to 18.2.0 Description When used with Jetty 12+, a user can craft a URL to access any resource the Jetty instance is permitted to access. This allows for the unauthorized download of sensitiv...

PT-2026-55852

Name of the Vulnerable Software and Affected Versions radareorg radare2 versions prior to 6.1.7 Description A stack-based buffer overflow exists in the Memory64ListStream Parser component within the file libr/bin/format/mdmp/mdmp.c. This issue can be triggered through local manipulation...

PT-2026-55967

Name of the Vulnerable Software and Affected Versions ArcGIS Server versions prior to 12.1 Description An unauthenticated attacker can exploit a directory traversal issue by sending crafted path parameters. This allows the attacker to access sensitive files on the system. Directory traversal is a...

PT-2026-55969

Name of the Vulnerable Software and Affected Versions Tenda firmware versions US FH1201V1.0BR V1.2.0.14408 EN TD Tenda firmware versions US W15EV1.0br V15.11.0.51068 1567 841 EN TDE Tenda firmware versions US AC10V1.0re V15.03.06.46 multi TDE01 Tenda firmware versions US AC5V1.0RTL V15.03.06.48...

PT-2026-55895

Name of the Vulnerable Software and Affected Versions Apache Camel versions 4.18.0 through 4.18.2 Apache Camel versions 4.19.0 through 4.20.x Description Deserialization of untrusted data in the Apache Camel PQC component occurs when HashicorpVaultKeyLifecycleManager,...

PT-2026-55783

Name of the Vulnerable Software and Affected Versions code-projects Smart Parking System version 1.0 Description An issue exists in the /parkings/parkings.php file where improper handling of the street, city, and status arguments allows for remote SQL injection. SQL injection is a technique where...

PT-2026-55550

Name of the Vulnerable Software and Affected Versions Keycloak affected versions not specified Description A flaw exists in the ClientResource component of the admin services when Fine-Grained Admin Permissions FGAP v2 is enabled. This issue allows a delegated administrator with limited control...

PT-2026-55524

Name of the Vulnerable Software and Affected Versions Eclipse Theia versions 1.26.0 and later Description The backend /services/request-service RPC accepts a URL controlled by an attacker from any client connected to the standard /services messaging endpoint. The server performs the HTTP request...

PT-2026-55547

Name of the Vulnerable Software and Affected Versions Dell PowerProtect Data Domain versions 7.7.1.0 through 8.7 Dell PowerProtect Data Domain versions 8.6.1.0 through 8.6.1.10 Dell PowerProtect Data Domain versions 8.3.1.0 through 8.3.1.30 Dell PowerProtect Data Domain versions 7.13.1.0 through...

PT-2026-55659

Name of the Vulnerable Software and Affected Versions Microsoft Edge for Android affected versions not specified Description Improper access control allows an unauthorized attacker to bypass a security feature over a network. Recommendations At the moment, there is no information about a newer...

PT-2026-55498

Name of the Vulnerable Software and Affected Versions CM Business Directory versions prior to 1.5.8 Description Insufficient input sanitization and output escaping allow authenticated attackers with contributor-level access and above to perform Stored Cross-Site Scripting. This occurs when...

PT-2026-55660

Name of the Vulnerable Software and Affected Versions NousResearch hermes-agent versions prior to 2026.4.31 Description An issue exists in the Streaming Reasoning Tag Filter component within the GatewayStreamConsumer. filter and accumulate function located in the gateway/stream consumer.py file...

PT-2026-55875

Name of the Vulnerable Software and Affected Versions PHP version 8.2 Description A failure to establish a TLS handshake the process where a client and server authenticate each other and establish encryption keys with a remote server can lead to a Denial of Service DoS condition. Recommendations ...

PT-2026-55479

Name of the Vulnerable Software and Affected Versions ZEBRA versions prior to 4.5.0 Description An address normalization mismatch between the handshake path and the mempool misbehavior path allows an unauthenticated IPv4 peer to deterministically crash a synced Zebra node. This occurs when a node...