PT-2026-116132

Name of the Vulnerable Software and Affected Versions IBM i versions 7.3 through 7.6 Description An authenticated attacker can elevate their privileges to perform operations with QSECOFR/Root authority on the system. Recommendations At the moment, there is no information about a newer version tha...

PT-2026-116129

🛡️We added Fortinet path traversal vulnerability CVE-2026-61624 & BeyondTrust remote support authentication bypass vulnerability CVE-2026-102764 to our KEV Catalog. Visit https://t.co/myxOwap1Tf & apply mitigations to protect your org from cyberattacks. Cybersecurity InfoSec https://t.co/5hHRiyX6s...

PT-2026-116176

A flaw was found in libarchive. An attacker can cause a Denial of Service DoS or potential information disclosure due to a use-after-free vulnerability, which occurs when a program reads memory that has already been released. This issue arises when the archive entry copy mac metadata function...

PT-2026-115472

Name of the Vulnerable Software and Affected Versions Salon Booking System WordPress plugin versions prior to 10.31.9 Description The plugin fails to generate booking-API access tokens using a secure random source. Instead, tokens are derived from a hardcoded value and the specific second the tok...

PT-2026-115474

Name of the Vulnerable Software and Affected Versions The Salon Booking System versions prior to 10.31.9 Description The plugin fails to correctly verify the authenticity of REST API requests by discarding the WordPress core nonce check for cookie-authenticated sessions across the entire REST API...

PT-2026-116175

Name of the Vulnerable Software and Affected Versions Nautilus affected versions not specified Description An issue exists where Nautilus fails to verify if trash directory paths are symbolic links when a removable drive or disk image is unmounted or ejected. An attacker can exploit this by...

PT-2026-116037

sshportal through 1.19.5 contains a missing authorization vulnerability in the management shell 'key show' command that allows authenticated non-admin users to obtain decrypted backend private SSH keys. Attackers can request predictable key names like 'default' or 'host' to retrieve private keys...

PT-2026-116013

🚨 CVE-2026-111614 DataCap through 2025.1.1 contains an insecure direct object reference vulnerability in BaseController.getInfoForPath that allows authenticated users to read other users' datasources, snippets and dashboards by numeric id. Low-privileged attackers can enumerate auto-increment ids...

PT-2026-116093

🚨 CVE-2026-111694 qKnow through 2.4.3 contains a missing authentication vulnerability that allows unauthenticated remote attackers to access /flyflow workflow integration endpoints permitted in SecurityConfig. Attackers can POST sequential userId values to /flyflow/userById or call roleAll and...

PT-2026-116092

DataBuff ai-apm-web through 0.1.10 contains a hard-coded default credentials vulnerability that allows unauthenticated attackers to gain administrator access using the built-in admin/Databuff@123 account. Attackers can POST these credentials to /webapi/api/v1/auth/login to obtain an administrator...

PT-2026-116098

🚨 CVE-2026-111699 Niefy wx-api through 0.8.2 contains an authentication bypass vulnerability that allows unauthenticated attackers to impersonate WeChat fans by supplying a raw openid cookie to fan-facing controllers. Attackers knowing a victim's openid can call /wxUser/getUserInfo and /wxUserTag...

PT-2026-116099

🚨 CVE-2026-111700 WebVella ERP through 1.8.8 contains an sql injection vulnerability that allows any authenticated user to inject SQL through WHERE-clause text literals in the EQL query API. Attackers can send crafted single-quoted literals to POST /api/v3/en US/eql, escaping the unsanitized...

PT-2026-116088

🚨 CVE-2026-111689 Exrick XBoot through 3.3.4 contains an authorization bypass vulnerability that allows authenticated users to read user records of any department by ignoring role data scope. Attackers can request GET /xboot/user/getByDepartmentId/departmentId with arbitrary department ids to...

PT-2026-116084

🚨 CVE-2026-111685 IceCMS through 4.1.5 contains an unauthenticated sql injection vulnerability that allows remote attackers to inject SQL by supplying a crafted num path parameter to /WebResource/findresourcebynum. Attackers can append SQL after the LIMIT clause concatenated via QueryWrapper.last...

PT-2026-116089

Name of the Vulnerable Software and Affected Versions Simple Admin Core versions prior to 1.8.8 Description An authentication bypass exists due to a hard-coded Auth.AccessSecret located in the api/etc/core.yaml file. This allows unauthenticated remote attackers to forge JSON Web Tokens JWT by...

PT-2026-116118

🚨 CVE-2026-111719 Roncoo-pay through commit 9428382 contains a missing authorization vulnerability in F2FPayController.orderQuery that allows unauthenticated attackers to retrieve payment records by supplying a trxNo parameter. Attackers can guess transaction numbers, a '7' prefix plus a snowflak...

PT-2026-116119

🚨 CVE-2026-111720 fish-island-backend through commit 7c61b78 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to make the server fetch attacker-supplied URLs via the url parameter of GET /api/web/parse. Attackers can target internal hosts, loopbac...

PT-2026-116122

Name of the Vulnerable Software and Affected Versions LingGuo-Drama versions prior to commit 8a6924a Description An authorization flaw allows any registered user to manage all accounts via the '/admin/v1/admins' API endpoint, which is only protected by AuthAdminJWT. This allows attackers to...

PT-2026-116104

🚨 CVE-2026-111705 Fuint through commit 57ec018 contains an insecure direct object reference vulnerability that allows authenticated members to read other members' booking records by supplying arbitrary bookId values to /clientApi/book/myBookDetail. Attackers can iterate the auto-increment bookId ...

PT-2026-116108

🚨 CVE-2026-111709 WhaTicket Community through commit cf04795 contains an insecure direct object reference vulnerability that allows authenticated agents to access other agents' tickets because ShowTicketService performs no ownership or queue checks. Attackers can supply another agent's ticket id ...

PT-2026-116114

🚨 CVE-2026-111715 Arkon through 0.9.2 contains a missing authorization vulnerability in GET /api/wiki/graph that lets authenticated employees read other departments' wiki metadata by supplying a foreign slug. Attackers with only wiki:read:own dept permission can query get neighborhood without sco...

PT-2026-116058

🚨 CVE-2026-111659 Waynboot-mall through 2.0.0 contains a missing authentication vulnerability that allows unauthenticated attackers to forge orders by calling the internal /callback/order/submit message-queue callback. Attackers can supply arbitrary userId, addressId and cart ids in the order JSO...

PT-2026-116059

🚨 CVE-2026-111660 waynboot-mall through 2.0.0 contains a missing authentication vulnerability that allows unauthenticated attackers to cancel any member's pending order via the /callback/order/unpaid endpoint. Attackers can submit predictable orderSn values, built from epoch seconds and a...

PT-2026-116062

Chaskiq through 2.0.3 contains a server-side request forgery vulnerability that allows unauthenticated attackers to fetch arbitrary URLs via the createUrlUpload GraphQL mutation. Attackers can submit internal URLs, including cloud instance metadata endpoints, through POST /graphql and retrieve th...

PT-2026-116064

🚨 CVE-2026-111665 Piranha CMS through 12.2 contains a missing authorization vulnerability in the Piranha.Manager LanguageApiController that allows any authenticated manager user to list, create, edit and delete site languages without the granular Language, LanguageAdd, LanguageEdit or...

PT-2026-116054

🚨 CVE-2026-111655 ThinkAdmin think-plugs-admin through 1.0.81 contains an insecure direct object reference vulnerability that allows non-super administrators to read and overwrite other administrators' file records via admin/file.edit. Attackers holding the admin/file.edit node can request or POS...

PT-2026-116057

SiteServer SSCMS through 7.4.0 contains an authorization bypass vulnerability in ChannelsController that allows site-scoped administrators to access other sites' channels by supplying foreign channel IDs. Attackers with Channels permission on one site can read and overwrite another site's channel...

PT-2026-116079

🚨 CVE-2026-111680 APIPark through 1.9.7-beta contains an authorization bypass vulnerability that allows authenticated team managers to access other teams' services and applications by supplying their own team id in the team query parameter. Attackers can target service or app ids exposed by...

PT-2026-116073

🚨 CVE-2026-111674 Tbed through 20240319 contains a missing authorization vulnerability that allows any authenticated user to rename other users' images through the /admin/setImgFileName endpoint. Attackers can supply a victim's imgname, exposed in public image URLs and album listings, to overwrit...

PT-2026-116067

AIHelms through 0.1.25 contains a missing authorization vulnerability in apps/api/v1/efficiency.py that allows authenticated low-privileged users to bypass efficiency:read and efficiency:write permission checks. Attackers can query routes like /cost/detail, /top-users and /budget to read...

PT-2026-116068

🚨 CVE-2026-111669 ZR.Admin.NET through 3.8.2 contains an sql injection vulnerability that allows authenticated attackers to manipulate the ORDER BY clause by supplying a crafted PagerInfo.Sort query parameter to the shared ToPage paging helper. Attackers holding the system:user:list permission ca...

PT-2026-115366

Name of the Vulnerable Software and Affected Versions Ultralytics FastSAM versions up to b4ed20c2fed75eadc5aa7d8b09fedd137b873b52 Description An issue exists in the AutoBackend Model Loading component within the session.get modelmeta.custom metadata map function of the ultralytics/nn/autobackend....

PT-2026-115915

MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. From 3.3.0 until 3.5.4, the zero-configuration TLS fingerprint-validation path calls Ed25519PasswordAuth.hash through Authentication.validateFingerPrint, but Ed25519PasswordAuth.hash...

PT-2026-116148

Name of the Vulnerable Software and Affected Versions ZoneMinder versions prior to 1.39.2 ZoneMinder versions prior to 1.38.2 ZoneMinder versions prior to 1.36.40 Description An authenticated user with monitor-create or monitor-edit permissions can execute arbitrary commands as the web server use...

PT-2026-116135

Name of the Vulnerable Software and Affected Versions IBM i versions 7.3 through 7.6 Description Local attackers can obtain sensitive information because the system fails to perform subtree checks during file handle resolution. Recommendations At the moment, there is no information about a newer...

PT-2026-116146

Authentication bypass within in-house network in Apache Kylin. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted. This issue affects Apache Kylin: from 4.0.4 through 5.0.4. Users are recommended t...

PT-2026-116012

AllData through 0.7.1 contains an unauthenticated JDBC injection vulnerability that allows remote attackers to open arbitrary database connections by supplying jdbcUrl and jdbcDriverClass values to the data-dts /jobJdbcDatasource/test endpoint. Attackers can supply a MySQL JDBC URL with...

PT-2026-115515

Mattermost versions 11.9.x = 11.9.1, 11.8.x = 11.8.5, 11.7.x = 11.7.10, 11.10.x = 11.10.1 fail to sanitize authentication tokens before writing them to server log entries, which allows an attacker with access to server logs to obtain valid session tokens or OAuth access tokens and impersonate...

PT-2026-116094

Shaiwz data-platform-open through commit efeacd3 contains an insecure direct object reference vulnerability that allows authenticated workspace members to access other workspaces' datasources by numeric id. Attackers can send foreign sequential ids to /datasource/detail, /listSchemaTable,...

PT-2026-116165

Name of the Vulnerable Software and Affected Versions LoopX versions 0.0.1 through 0.4.4 Description The loopx serve-status command in loopx/status server.py uses StatusRequestHandler. send json and do OPTIONS to send an Access-Control-Allow-Origin: header for unauthenticated responses on...

PT-2026-115585

Name of the Vulnerable Software and Affected Versions HTML affected versions not specified Description A flaw in HTML could allow unauthenticated remote code presentation on any server. Recommendations At the moment, there is no information about a newer version that contains a fix for this...

PT-2026-116433

These are all security issues fixed in the libXi-devel-1.8.3-3.1 package on the GA media of openSUSE Tumbleweed...

PT-2026-115399

Name of the Vulnerable Software and Affected Versions Backdrop CMS Core versions 1.34.x through 1.34.5 Backdrop CMS Core versions 1.35.x through 1.35.1 Description Insufficient validation of uploaded SVG images allows the inclusion of dangerous SVG tags, which can contain clickable links or...

PT-2026-116152

Exposure of unauthorized cross-project job manipulation vulnerability in Apache Kylin. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted. This issue affects Apache Kylin: from 4 through 5.0.4. Use...

PT-2026-115978

Name of the Vulnerable Software and Affected Versions Microsoft Identity Web affected versions not specified Description An authentication bypass exists due to the use of assumed-immutable data, which allows an authorized attacker to elevate privileges over a network. Recommendations At the momen...

PT-2026-115613

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description An endpoint exhibits a response discrepancy when processing ID values, acting as an enumeration oracle. A request using a nonexistent ID returns a different erro...

PT-2026-116049

Name of the Vulnerable Software and Affected Versions ChronoFrame version 1.0.0 Description Missing authentication in the server/api/wizard/ handlers allows unauthenticated attackers to reconfigure already configured instances. By sending a POST request to the '/api/wizard/storage' endpoint, an...

PT-2026-115896

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the CONNECT engine's DOS table type used an incorrect boundary check that permitted a one-byte null write beyond a stack buffer at an attacker-controlled offset...

PT-2026-115897

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the qc info plugin could be confused by a query containing embedded null bytes. Reading information schema.query cache info after such a query was cached could...

PT-2026-115900

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB insufficiently validated counts, offsets, lengths, and field boundaries in FRM metadata while opening binary FRM files. An attacker able to place a craft...