212496 matches found
PT-2026-86852
🚨Critical - JetBrains Hub Unauth Trusted Service Registration PrivEsc CVE-2026-86480 JetBrains Hub exposes a critical trusted-service registration endpoint where the service trust flag can be set without authentication. An unauthenticated attacker can register a malicious trusted service, then...
PT-2026-86850
In JetBrains YouTrack before 2025.3.161254, 2026.1.14042 improper authentication in YouTrack Helpdesk allowed unauthenticated account takeover via a self-asserted email address...
PT-2026-86830
A vulnerability has been found in itsourcecode Sales and Inventory System 1.0. The affected element is an unknown function of the file /pages/cust edit1.php. Such manipulation of the argument ID leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the...
PT-2026-86819
A flaw was found in 389-ds-base. The Cockpit 389 Console's LDAP editor constructs an ldapsearch command by embedding an LDAP entry's distinguished name DN into a shell command string without proper escaping. An LDAP user with delegated privileges to create or rename directory entries could craft ...
PT-2026-86816
A heap buffer overflow flaw was found in the SASL I/O layer of 389 Directory Server 389-ds-base. In sasl io start packet, the wrapped-record length read from the wire is validated only against an upper bound. A small wire length 0, 1, or 2 produces an encrypted buffer count below the...
PT-2026-86826
Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Certificate Validation vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to protection mechanism...
PT-2026-86672
HCL MyXalytics was affected by Potential DOS Vulnerability. It allows users to input data without any restriction on the number of characters which can impact system performance or availability...
PT-2026-86864
In JetBrains YouTrack before 2026.2.18634 a shared token cache allowed cross-tenant theft of GitHub App installation tokens...
PT-2026-86859
In JetBrains YouTrack before 2026.2.18634 a crafted WebSocket message allowed read-only whiteboard users to modify canvas content...
PT-2026-86849
Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains a Plaintext Storage of a Password vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to information disclosure...
PT-2026-86847
Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Certificate Validation vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to unauthorized access...
PT-2026-86842
Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Locking vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to filesystem access for attacker...
PT-2026-86591
A vulnerability was identified in liufee FeehiCMS up to 2.1.1. The impacted element is the function UeditorAction::init of the file backend/widgets/ueditor/UeditorAction.php of the component UEditor Widget. The manipulation leads to unrestricted upload. Remote exploitation of the attack is...
PT-2026-88204
These are all security issues fixed in the python313-idna-3.19-1.1 package on the GA media of openSUSE Tumbleweed...
PT-2026-86615
A security flaw has been discovered in sfturing hosp order up to 627f426331da8086ce8fff2017d65b1ddef384f8. The affected element is the function modifyPassWord of the file ssm pro/src/main/java/cn/sfturing/web/CommonUserController.java of the component Password Recovery. Performing a manipulation...
PT-2026-88196
These are all security issues fixed in the kernel-devel-7.2.3-1.1 package on the GA media of openSUSE Tumbleweed...
PT-2026-86603
In Power HAL, there is a possible escalation of privilege due to type confusion. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11165543; Issue ID: MSV-9012...
PT-2026-86618
A security vulnerability has been detected in sfturing hosp order up to 627f426331da8086ce8fff2017d65b1ddef384f8. This affects the function updateOrderSta1/updateOrderdiseaseInfo of the file ssm pro/src/main/java/cn/sfturing/web/OrderController.java of the component Order Handler. The manipulatio...
PT-2026-88189
These are all security issues fixed in the curl-8.22.0-1.1 package on the GA media of openSUSE Tumbleweed...
PT-2026-86600
In Modem, there is a possible system crash due to a missing bounds check. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch I...
PT-2026-86610
In gpu, there is a possible system crash due to use after free. This could lead to local information disclosure with User execution privileges needed. User interaction is needed for exploitation. Patch ID: ALPS11122991; Issue ID: MSV-8132...
PT-2026-88203
These are all security issues fixed in the python313-fastapi-0.138.0-2.1 package on the GA media of openSUSE Tumbleweed...
PT-2026-86646
A vulnerability was identified in SourceCodester Syllabus-Aligned Learning Management & Examination System 1.0. This affects an unknown function of the file cict portal.sql. Such manipulation leads to cleartext storage of sensitive information. It is possible to launch the attack remotely. The...
PT-2026-86644
OpenVPN 2.0.0 through 2.6.22 and 2.7 alpha1 through 2.7.6 on Windows allows local authenticated users to cause a denial of service via a NULL DACL on named IPC objects...
PT-2026-86649
When using the Direct XIP update strategy, the main application image starts other cores i.e. radio core, based on the currently active slot without additional verification. The MCUboot in the bare upstream configuration assumes that if there is at least a single slot for each image available, th...
PT-2026-86647
A security flaw has been discovered in SourceCodester Syllabus-Aligned Learning Management & Examination System 1.0. This impacts an unknown function. Performing a manipulation results in cross-site request forgery. The attack can be initiated remotely. The exploit has been released to the public...
PT-2026-86642
OpenVPN 2.5.0 through 2.7.6 on Windows using the tap-windows6 driver allows attackers to trigger an out-of-bounds write via crafted DOMAIN-SEARCH entries...
PT-2026-86736
Composer is a dependency Manager for the PHP language. From 1.0 until 2.2.30 and 2.10.3, a malicious dependency package from a custom Composer repository or an untrusted composer.lock file could set source.type to perforce and source.url to an rsh: or jsh: P4PORT value. When the Perforce p4 clien...
PT-2026-86675
Zohocorp ManageEngine Endpoint Central versions below 11.5.2605.01 are vulnerable to Local privilege escalation due to loading a dll from an untrusted path...
PT-2026-86676
In Eclipse Ankaios versions 0.1.0 through 1.0.1, the agent does not limit the length declared by a workload in a length-delimited protobuf message received through the Control Interface FIFO. A workload granted Control Interface access can specify an excessive message length, causing an unbounded...
PT-2026-86799
commonmark versions from 1.5.0 before 2.8.4 contain a denial of service vulnerability in the Attributes extension where AttributesListener::findTargetAndDirection performs quadratic-time sibling list scanning. Unauthenticated attackers can submit approximately 32 KB of repeated attribute blocks t...
PT-2026-86784
A security flaw has been discovered in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. Affected by this issue is the function Upload::upload of the file ThinkPHP/Library/Think/Upload.class.php. Performing a manipulation results in unrestricted...
PT-2026-86781
Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Check or Handling of Exceptional Conditions vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to...
PT-2026-86652
A flaw was found in environment-modules. A local attacker can exploit this vulnerability by placing a maliciously named modulefile in a location visible to the victim's MODULEPATH. When the victim uses Bash completion for module or ml commands, the malicious module name, containing shell...
PT-2026-86599
In Modem, there is a possible system crash due to a missing bounds check. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch I...
PT-2026-86739
Incorrect Authorization CWE-863 in Kibana Entity Analytics can lead to a loss of security monitoring via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. An authenticated user holding only read-level Security feature access, and no Elasticsearch privileges, could stop the recurri...
PT-2026-86686
A vulnerability has been found in code-projects Hospital Information System 1.0. Affected is an unknown function of the file /HIS/src/patients/editPatient.php of the component Patient Management. Such manipulation of the argument ID leads to cross site scripting. The attack may be launched...
PT-2026-86683
Cross-site scripting in the Evernote and Google Keep note importers in Standard Notes for Android through 3.201.24 allows an attacker to execute arbitrary JavaScript in the application context when a victim imports a crafted .enex or Google Keep HTML file, leading to theft of encryption keys and...
PT-2026-86660
A vulnerability was found in Ollama up to 0.31.1. This issue affects the function readGGUFV1String of the file fs/ggml/gguf.go of the component GGUF Decoder. Performing a manipulation results in integer overflow. The attack is possible to be carried out remotely. The exploit has been made public...
PT-2026-86656
Vulnerability involving incorrect access control in the Tools::getRemoteAddr function in PrestaShop, which allows the client’s IP address to be spoofed via the X-Forwarded-For header when the application is running behind a reverse proxy, load balancer or CDN. The application incorrectly processe...
PT-2026-86655
Any application that uses external QSPI flash for encrypted XIP on nRF5340 and relies on that encryption for confidentiality and/or integrity of the externally stored code. No specific nRF Connect SDK version is the root cause; the weakness is in the on-the-fly decryption scheme...
PT-2026-86763
A vulnerability was found in code-projects Hospital Information System 1.0. Affected by this vulnerability is an unknown functionality of the file /HIS/his.sql of the component SQL Database Backup File Handler. Performing a manipulation results in information disclosure. Remote exploitation of th...
PT-2026-86765
Affected versions of MISP do not enforce parent-event visibility when serving cryptographic keys through CryptographicKeysController::view. The vulnerable handler queried CryptographicKey directly using the supplied key ID and selected sensitive fields such as: type key data fingerprint but did n...
PT-2026-86800
league/commonmark versions = 2.0.0 and 2.8.4 patched in 2.9.0 contain a denial of service vulnerability in UniqueSlugNormalizer::normalize, which restarts its numeric-suffix search from 1 on every slug collision, resulting in OK^2 time complexity for K headings that collapse to the same base slug...
PT-2026-86662
A weakness has been identified in SourceCodester Online Voting System 1.0. This affects an unknown function of the file /voting/ajax.php?action=save category. This manipulation of the argument Category causes sql injection. The attack can be initiated remotely. The exploit has been made available...
PT-2026-86789
ImageMagick before 7.1.2-30 and 6.9.x before 6.9.13-55 contains a heap-use-after-free vulnerability in the GetList method of PerlMagick. A crafted call to the GetList method can trigger the use-after-free, resulting in a crash denial of service...
PT-2026-86792
LibreNMS before 26.8.0 contains an authentication bypass vulnerability in the REST API that allows unauthenticated attackers to access protected endpoints by sending numeric values instead of string tokens. Attackers can exploit MySQL type coercion by sending small integers like 0 through 9 to...
PT-2026-86796
league/commonmark versions before 2.9.1 contain multiple denial of service vulnerabilities in fenced code block detection, reference link label lookup, and emphasis delimiter processing that perform super-linear work on crafted input. Attackers can submit specially crafted Markdown with long...
PT-2026-86637
A vulnerability was found in SourceCodester Syllabus-Aligned Learning Management & Examination System 1.0. The affected element is an unknown function of the file manage subjects.php. The manipulation of the argument msg/title/content results in cross site scripting. The attack may be performed...