212496 matches found
PT-2026-88442
The Okta Privileged Access client URL handler does not insert an option terminator before appending the target value to the command-line arguments. When a scaleft:// protocol handler link contains a value beginning with a hyphen, the underlying CLI framework interprets it as a command-line flag,...
PT-2026-87463
Heap-based buffer overflow in Volume Manager Driver allows an authorized attacker to elevate privileges locally...
PT-2026-88169
In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, Jenkins does not rotate the session when a user is authenticated via the "remember me" cookie, allowing attackers able to serve content on the same site as Jenkins to set a known session cookie in the victim's browser, which after the victim...
PT-2026-88436
The Okta Access Gateway does not sanitize dashboard label values before writing them into generated PHP configuration files. The generated file is automatically included during authentication requests, resulting in execution with the privileges of the web server process...
PT-2026-87485
Heap-based buffer overflow in Windows Power Dependency Coordinator allows an authorized attacker to elevate privileges locally...
PT-2026-88179
🔒 CYBERSECURITY, PRIVACY & OPEN SOURCE ROUNDUP — September 9, 2026 1️⃣ CPANEL EMAILTRACK SQL INJECTION LEADS TO ROOT A critical flaw in cPanel CVE-2026-67401 turns the EmailTrack feature into a full remote-code-execution path: a regular authenticated cPanel account with mail privileges can abuse...
PT-2026-87421
External control of file name or path in Windows Shell allows an authorized attacker to elevate privileges locally...
PT-2026-88379
Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting XSS vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in...
PT-2026-88334
Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting XSS vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in...
PT-2026-87183
New security alarm: Fortinet’s Agentless ZTNA has a certificate‐validation flaw CVE-2026-84393 letting attackers perform MITM on FortiOS and FortiProxy. Versions 7.6.1-7.6.6 are vulnerable; upgrade to 7.6.7 or later. This unauthenticated risk puts exposed portals at serious risk—patch now if you...
PT-2026-88347
🚨 CVE-2026-75635 Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting XSS vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires use...
PT-2026-88302
Photoshop Desktop is affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file...
PT-2026-88262
In stpropnci process std of stpropnci std.cc, there is a possible memory safety issue due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...
PT-2026-87522
Use after free in Windows Image Acquisition allows an authorized attacker to elevate privileges locally...
PT-2026-88589
Memory corruption in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted Chrome extension. Chromium security severity: Low...
PT-2026-88728
Use after free in Cast in Google Chrome prior to 153.0.8010.36 allowed an adjacent attacker to potentially execute arbitrary code outside the sandbox via crafted network traffic. Chromium security severity: Critical...
PT-2026-88352
🚨 CVE-2026-75642 Adobe Experience Manager is affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the pa...
PT-2026-87590
Null pointer dereference in Windows IKE Extension allows an unauthorized attacker to deny service over a network...
PT-2026-88397
Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting XSS vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in...
PT-2026-88427
The Okta Access Gateway management console passes user-supplied input to eval without sanitization during an authenticated administrator SSH session. As a result, the unsanitized input is executed directly, leading to code execution with the privileges of the management console...
PT-2026-87376
Use after free in Windows Win32K allows an authorized attacker to elevate privileges locally...
PT-2026-88734
Use after free in WebPackaging in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: Low...
PT-2026-87201
Improper authorization in XBox Gaming Services allows an authorized attacker to elevate privileges locally...
PT-2026-87856
Null pointer dereference in Windows Routing and Remote Access Service RRAS allows an authorized attacker to deny service over a network...
PT-2026-88287
Out-of-bounds read in Skype for Business allows an authorized attacker to deny service over a network...
PT-2026-87249
Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network...
PT-2026-86617
🚨 HIGH Severity: CVE-2026-86313 CVSS 7.8 Out-of-bounds write flaw in Samsung Opensource Walrus enables buffer overflow attacks. Local exploit, no privileges required. Affected: Walrus commit af80e665ea CVE Vulnerability PatchNow ThreatIntel DFIR https://t.co/6XjdaUNUYK...
PT-2026-86620
Integer overflow in the source-bounds check in Memory::init src/runtime/Memory.cpp in Samsung walrus on all platforms allows a remote attacker to cause an out-of-bounds heap read and denial of service via a crafted WebAssembly module in which a 32-bit unsigned addition wraps around and bypasses t...
PT-2026-86626
An out-of-bounds write caused by numeric truncation Samsung Open Source Escargot on Linux x86-64 allows an attacker who can supply JavaScript for execution to corrupt native memory and crash the host process via a crafted class definition whose instance initialization entry count exceeds UINT16...
PT-2026-86595
A security vulnerability has been detected in FastAdmin up to 1.2.0.20210401 beta. Affected is the function register/login of the file application/index/controller/User.php of the component User Controller. Such manipulation of the argument url leads to cross site scripting. The attack may be...
PT-2026-86629
A vulnerability was determined in Beijing Meite Software Technology U+Smart Enjoyment WebSite 18.6001.1096.1000. This impacts an unknown function of the file /Report/Upload/UploadFormImg.ashx. Executing a manipulation of the argument File can lead to unrestricted upload. It is possible to launch...
PT-2026-86814
A flaw has been found in itsourcecode Sales and Inventory System 1.0. Impacted is an unknown function of the file /pages/pro searchfrm.php. This manipulation of the argument ID causes sql injection. The attack can be initiated remotely. The exploit has been published and may be used...
PT-2026-86813
A vulnerability was detected in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. This issue affects some unknown processing of the file App/Common/Conf/config.php of the component Debug Mode. The manipulation of the argument DB DEBUG results in...
PT-2026-86806
Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Use of Hard-coded Cryptographic Key vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to information disclosure...
PT-2026-86774
PocketMine-MP versions before 4.2.9 fail to properly validate NBT data types during deserialization of inventory transaction packets from clients. Attackers can send crafted inventory transactions with malformed NBT tags to trigger server crashes and cause denial of service...
PT-2026-86829
Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Use of Hard-coded Credentials vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to protection mechanism bypa...
PT-2026-86827
Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Insertion of Sensitive Information into Log File vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to informati...
PT-2026-86807
Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Authentication vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to protection mechanism bypass...
PT-2026-86917
Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Insufficient Verification of Data Authenticity vulnerability. An unauthenticated attacker with remote access could exploit this, leading to unauthorized access. This...
PT-2026-86875
In JetBrains IntelliJ IDEA before 2026.2.2 opening an untrusted project could trigger SSRF via Kubernetes spec-source URL fetching...
PT-2026-86877
In JetBrains IntelliJ IDEA before 2026.2.2 missing project-trust check leaked project metadata to JetBrains Marketplace...
PT-2026-86876
In JetBrains IntelliJ IDEA before 2026.2.2 missing project-trust confirmation before building a Dev Container allowed host-level code execution...
PT-2026-86773
PocketMine-MP before 4.2.10 fails to validate the total length of incoming chat message blobs before splitting them by newline characters, allowing attackers to send large messages containing many newlines. Malicious clients can send megabyte-sized chat packets and bombard the server with thousan...
PT-2026-86805
A flaw was found in 389 Directory Server. The SELFDN ACI bind-rule evaluator incorrectly matches an anonymous LDAP client's empty bind DN against an empty stored attribute value, allowing an unauthenticated client to satisfy access control checks intended to require a matching authenticated...
PT-2026-86804
The WP Fusion Pro plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.47.13. This is due to insufficient authorization checks on the role parameter in the ThriveCart Auto Login handler's thrivecart function. This makes it possible for authenticated...
PT-2026-86919
Lara Dashboard before 1.3.2 fails to authorize access to the post-builder image and video upload endpoints, allowing authenticated accounts without content permissions to upload files. Attackers can upload polyglot files with attacker-chosen extensions to the public web root and execute code if t...
PT-2026-86836
Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Certificate Validation vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to protection mechanism...
PT-2026-86914
Protocol::HTTP2 versions before 1.14 for Perl allow memory exhaustion via closed streams that stream state never removes from the connection stream table. When a stream reaches the CLOSED state, stream state returns the concurrency slot and clears most of the stream's keys, but the entry itself...