PT-2026-70521

Name of the Vulnerable Software and Affected Versions Windows DNS affected versions not specified Description A numeric truncation error in Windows DNS allows an authorized attacker to elevate privileges locally, which can lead to full system compromise. Recommendations At the moment, there is no...

PT-2026-70455

Name of the Vulnerable Software and Affected Versions Windows Installer affected versions not specified Description A use-after-free condition occurs in Windows Installer, which allows an authorized attacker to elevate privileges locally. Use-after-free is a memory corruption issue where an...

PT-2026-70579

Name of the Vulnerable Software and Affected Versions Windows DNS affected versions not specified Description A numeric truncation error in Windows DNS allows an authorized attacker to elevate privileges locally, which can lead to full system compromise. Recommendations At the moment, there is no...

PT-2026-70520

Name of the Vulnerable Software and Affected Versions Windows Installer affected versions not specified Description A stack-based buffer overflow occurs in Windows Installer, which allows an authorized attacker to elevate privileges locally. A stack-based buffer overflow is a condition where a...

PT-2026-70739

Name of the Vulnerable Software and Affected Versions Apache Allura versions prior to 1.19.1 Description Webhooks are susceptible to Server-Side Request Forgery SSRF, a flaw that allows an attacker to induce the server-side application to make requests to an unintended location. Recommendations...

PT-2026-70407

Name of the Vulnerable Software and Affected Versions Windows Installer affected versions not specified Description An integer overflow or wraparound occurs in Windows Installer, which allows an authorized attacker to elevate privileges locally on the system. Recommendations At the moment, there ...

PT-2026-70560

Name of the Vulnerable Software and Affected Versions Windows DNS affected versions not specified Description A race condition occurs in Windows DNS due to improper synchronization when using a shared resource. This allows an unauthorized attacker to execute arbitrary code over a network and affe...

PT-2026-70331

Name of the Vulnerable Software and Affected Versions The product name cannot be determined. affected versions not specified Description An Incorrect Authorization issue allows a low-privileged attacker to achieve privilege escalation. This flaw enables unauthorized read and write access and can ...

PT-2026-70317

Protection mechanism failure for some IntelR Neural Compressor software before version v3.6 within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with a privileged user combined with a low complexity attack may enable escalation of privilege. This...

PT-2026-70604

Name of the Vulnerable Software and Affected Versions Microsoft Office SharePoint affected versions not specified Description Incorrect authorization allows an authorized attacker to perform tampering over a network, which enables them to affect the system. Recommendations At the moment, there is...

PT-2026-70709

Name of the Vulnerable Software and Affected Versions Microsoft Office Word affected versions not specified Description A heap-based buffer overflow occurs when a program writes more data to a heap memory buffer than it can hold, potentially leading to memory corruption. This issue allows an...

PT-2026-70674

Name of the Vulnerable Software and Affected Versions Windows Autopilot affected versions not specified Description A use-after-free condition in Windows Autopilot enables an authorized attacker to elevate privileges locally. Use-after-free is a memory corruption issue that occurs when an...

PT-2026-70285

Name of the Vulnerable Software and Affected Versions IntelR NPU Driver affected versions not specified Description Improper buffer restrictions within Ring 3 the least privileged level of the CPU architecture for User Applications may allow a denial of service. An unprivileged software adversary...

PT-2026-70680

Name of the Vulnerable Software and Affected Versions Windows DHCP Client affected versions not specified Description Uncontrolled resource consumption in the Windows DHCP Client allows an unauthorized attacker to cause a denial of service over an adjacent network. Recommendations At the moment,...

PT-2026-70125

An SQL injection vulnerability in Friendica through the 2026.08-dev branch allows unauthenticated remote attackers to execute arbitrary SQL statements via the photo-view order parameter. The parameter is concatenated unescaped into a SHOW COLUMNS query via a bare PDO::query call, enabling stacked...

PT-2026-70743

Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally...

PT-2026-70689

Name of the Vulnerable Software and Affected Versions Windows iSCSI Target Service affected versions not specified Description A heap-based buffer overflow occurs in the Windows iSCSI Target Service. This issue allows an unauthorized attacker to cause a denial of service over a network. A...

PT-2026-70742

Improper neutralization of special elements used in an os command 'os command injection' in Visual Studio Code allows an unauthorized attacker to execute code over a network...

PT-2026-70354

ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. The vulnerable component is restricted to an administrative network zone by...

PT-2026-70204

Name of the Vulnerable Software and Affected Versions Streambert versions prior to 2.5.0 Description Streambert is a cross-platform Electron Desktop App used for streaming and downloading video content. The application contains an unvalidated auto-updater URL issue where a compromised renderer...

PT-2026-70890

DB-GPT v0.8.1 contains an unauthenticated path traversal vulnerability that allows remote attackers to write arbitrary files to any location on the server by injecting directory traversal sequences into the user id HTTP header of the Python file-upload endpoint. Attackers can send a crafted...

PT-2026-70106

Name of the Vulnerable Software and Affected Versions CommServe affected versions not specified Description An authorization bypass exists affecting a limited set of command execution operations. This issue allows an attacker to bypass security checks when executing specific commands...

PT-2026-70249

Vim is an open source, command line text editor. Prior to 9.2.0841, prop add one in src/textprop.c uses the proplen value from get text props to increment a uint16 t property count beyond 0xffff, wrapping the count to zero and copying existing text-property records into a heap allocation sized fo...

PT-2026-70140

Name of the Vulnerable Software and Affected Versions Ghost Foundation Ghost versions 5.x Description An issue with broken access control allows authenticated users with the Author role to delete posts belonging to other users. This occurs because the permissible function in the post model lacks ...

PT-2026-70655

Name of the Vulnerable Software and Affected Versions Microsoft Office SharePoint affected versions not specified Description Deserialization of untrusted data allows an authorized attacker to execute arbitrary code over a network, which can affect the system. Deserialization is the process of...

PT-2026-70563

Name of the Vulnerable Software and Affected Versions Remote Desktop Client affected versions not specified Description A stack-based buffer overflow occurs in the Remote Desktop Client, which allows an unauthorized attacker to execute arbitrary code over a network and affect the system. A...

PT-2026-70444

Name of the Vulnerable Software and Affected Versions Windows Installer affected versions not specified Description Incorrect authorization in Windows Installer allows an authorized attacker to elevate privileges locally, which enables them to affect the system. Recommendations At the moment, the...

PT-2026-70679

Name of the Vulnerable Software and Affected Versions Windows NTFS affected versions not specified Description An out-of-bounds read in Windows NTFS allows an authorized attacker to disclose sensitive information locally, which can affect the system. Recommendations At the moment, there is no...

PT-2026-70812

Name of the Vulnerable Software and Affected Versions Lightroom Classic affected versions not specified Description An out-of-bounds write issue exists that could allow arbitrary code execution in the context of the current user. This occurs when a user opens a malicious file, requiring user...

PT-2026-70389

Exposure of sensitive information to an unauthorized actor in Microsoft Defender for Endpoint allows an authorized attacker to disclose information locally...

PT-2026-70199

Craft CMS versions = 5.0.0-RC1 before 5.10.7 and = 4.0.0-RC1 before 4.18.3 contain a remote code execution vulnerability in the Twig sandbox mechanism. Because Craft marks the ElementInterface as safe via the AllowedInSandbox attribute and the sandbox allowlisting extends to the entire class...

PT-2026-70706

Stack-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally...

PT-2026-70922

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 151.0.7922.137 Description A use-after-free issue exists in the HTML component, which allows a remote attacker to execute arbitrary code within a sandbox by inducing the user to open a specially crafted HTML pag...

PT-2026-70919

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 151.0.7922.137 Description A use-after-free issue exists in the V8 engine, which is the open-source JavaScript and WebAssembly engine used by Google Chrome. This flaw allows a remote attacker to execute arbitrar...

PT-2026-70386

Name of the Vulnerable Software and Affected Versions Windows LUAFV affected versions not specified Description A heap-based buffer overflow in Windows LUAFV allows an authorized attacker to elevate privileges locally. A heap-based buffer overflow occurs when a program writes more data to a heap...

PT-2026-70874

Name of the Vulnerable Software and Affected Versions PapersGPT for Zotero version 0.6.1 Description A remote code execution issue exists where arbitrary JavaScript can be executed by returning malicious code from an LLM endpoint. This occurs because the response is passed unsanitized to the...

PT-2026-70092

Name of the Vulnerable Software and Affected Versions JBoss EAP affected versions not specified Description A flaw exists in the Undertow HTTP/1.1 chunked-transfer decoder. The absence of limits on size and count allows an unauthenticated attacker to trigger an OutOfMemory error in the Java Virtu...

PT-2026-70765

Name of the Vulnerable Software and Affected Versions Microsoft Office Excel affected versions not specified Description An out-of-bounds read allows an unauthorized attacker to disclose sensitive information over a network. Recommendations At the moment, there is no information about a newer...

PT-2026-70813

Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker with high privileges could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require use...

PT-2026-70345

Name of the Vulnerable Software and Affected Versions ColdFusion affected versions not specified Description An Incorrect Authorization issue allows a low-privileged attacker to crash the application, resulting in a denial-of-service condition. This exploitation occurs without requiring any user...

PT-2026-70182

Name of the Vulnerable Software and Affected Versions Solid Edge SE2025 versions prior to V225.0 Update 15 Solid Edge SE2026 versions prior to V226.0 Update 7 Description A use-after-free issue exists when parsing specially crafted DFT files. This flaw allows an attacker to execute arbitrary code...

PT-2026-70707

Name of the Vulnerable Software and Affected Versions Microsoft Office SharePoint affected versions not specified Description Deserialization of untrusted data allows an authorized attacker to execute arbitrary code over a network, which can affect the system. Deserialization is the process of...

PT-2026-76420

These are all security issues fixed in the clusterctl-1.14.0-1.1 package on the GA media of openSUSE Tumbleweed...

PT-2026-70931

The Mira hormone monitor device firmware accepts a 0x01 write from any BLE central without authentication, causing the device to reboot into bootloader mode. An attacker could cause a denial-of-service condition or disrupt ovulation tracking and fertility monitoring workflow...

PT-2026-70543

Name of the Vulnerable Software and Affected Versions Windows NTFS affected versions not specified Description A buffer over-read in Windows NTFS allows an authorized attacker to disclose sensitive information locally, which can affect the system. Recommendations At the moment, there is no...

PT-2026-70296

Name of the Vulnerable Software and Affected Versions IntelR TDX Guest software versions prior to 0.3.1 Description An incorrect calculation within Ring 3: User Applications allows a privileged system software adversary to perform an escalation of privilege. This issue can be exploited via local...

PT-2026-70255

TypeBot is a chatbot builder tool. Prior to version 3.17.0, an authenticated user who has read access to any typebot can resume a waiting webhook session that belongs to a different typebot by mixing an authorized typebotId and blockId and a foreign live resultId. The webhook resume handler...

PT-2026-70933

The Mira Android companion app v4.5.15.4 identifies the paired Mira hormone analyzer by performing a substring match against the BLE advertisement name only, with no cryptographic peripheral authentication, MAC allowlist, or bonded-identity check. An attacker could capture live session token...

PT-2026-70411

Name of the Vulnerable Software and Affected Versions Windows TCP/IP affected versions not specified Description A null pointer dereference in Windows TCP/IP allows an unauthorized attacker to cause a denial of service over a network. A null pointer dereference occurs when a program attempts to...

PT-2026-70026

Name of the Vulnerable Software and Affected Versions SAP Approuter affected versions not specified Description SAP Approuter fails to sufficiently validate certain token content under specific configurations. An unauthenticated attacker can send a specially crafted token to force the transmissio...