PT-2026-122813

Security vulnerability affects the elasticsearch package. snappy-java through 1...

PT-2026-122743

Security vulnerability affects the py3-pydantic-ai package. Pydantic AI is a Python agent framework for building applications and workflows with Generative AI...

PT-2026-122860

Security vulnerability affects the opentelemetry-collector-contrib package. RabbitMQ amqp091-go is a Go AMQP 0...

PT-2026-123084

TuxCare rebuilt 7 org.springframework.amqp packages to address 4 CVEs. Fixed in 3.2.8-tuxcare.1...

PT-2026-123086

TuxCare rebuilt 3 io.projectreactor packages to address 2 CVEs. Fixed in 3.5.12-tuxcare.1...

PT-2026-123087

TuxCare rebuilt 6 org.springframework.amqp packages to address 3 CVEs. Fixed in 2.4.17-tuxcare.9...

PT-2026-123088

TuxCare rebuilt 42 org.springframework.integration packages to address 10 CVEs. Fixed in 6.0.9-tuxcare.1...

PT-2026-123090

TuxCare rebuilt 47 io.netty packages to address 3 CVEs. Fixed in 4.1.87.Final-tuxcare.2...

PT-2026-122700

Security vulnerability affects the nfs-subdir-external-provisioner package. An issue in the Unmarshal function in Go-Yaml v3 causes the program to crash when attempting to deserialize invalid input...

PT-2026-122792

Security vulnerability affects the wso2mi package. The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes...

PT-2026-122839

Security vulnerability affects the temporal-server-fips package. When verifying a certificate chain containing excluded DNS constraints, these constraints are not correctly applied to wildcard DNS SANs which use a different case than the constraint...

PT-2026-115091

New Citrix XenServer flaws in versions 8.4 & 9 threaten host systems if VMs have elevated rights. Watch out for CVE-2026-79610, CVE-2026-102700, CVE-2026-102701 & -79611. The bulletin reveals host-impacting vulnerabilities, guest crash risks, and no full exploit code yet. Confirm your XenServer...

PT-2026-115241

Name of the Vulnerable Software and Affected Versions Microsoft Office Word affected versions not specified Description A heap-based buffer overflow occurs when a program writes more data to a heap memory block than it can hold, potentially corrupting memory. In Microsoft Office Word, this flaw...

PT-2026-123067

TuxCare rebuilt 16 org.apache.avro packages to address 1 CVE. Fixed in 1.7.7-tuxcare.5...

PT-2026-123077

TuxCare rebuilt tar to address 12 CVEs. Fixed in 6.0.2-tuxcare.6...

PT-2026-123073

TuxCare rebuilt 8 org.springframework.ldap packages to address 1 CVE. Fixed in 2.4.2-tuxcare.1...

PT-2026-123065

TuxCare rebuilt 14 org.asynchttpclient packages to address 3 CVEs. Fixed in 2.12.1-tuxcare.2...

PT-2026-123078

TuxCare rebuilt follow-redirects to address 4 CVEs. Fixed in 1.2.6-tuxcare.2...

PT-2026-114754

Wheels 1.1.8 through 4.1.1 allows SQL injection when caller-supplied quoted values are parsed again as SQL by dynamic finders such as findOneByEmail, the query builder's whereproperty, value and whereproperty, operator, value, string/UUID-key lookup paths findByKey, updateByKey, deleteByKey and...

PT-2026-114442

A stack-based buffer overflow vulnerability in HPE NonStop TELSERV can cause memory corruption that may result in DoS...

PT-2026-115157

Name of the Vulnerable Software and Affected Versions OpenJPH versions prior to 0.32.1 Description A heap out-of-bounds write exists in the HTJ2K cleanup-pass decoder. An attacker can cause memory corruption and crashes by providing a specially crafted .j2c or .jph codestream with small precinct...

PT-2026-115162

Name of the Vulnerable Software and Affected Versions libTiMidity versions prior to 0.2.9 Description An out-of-bounds access issue exists in the init soundfont function within src/sndfont.c. This occurs when the software processes unvalidated SF2 preset header bank and preset values. A remote...

PT-2026-115147

Name of the Vulnerable Software and Affected Versions zziplib versions prior to 0.13.81 Description An out-of-bounds read exists in the zzip parse root directory function within zzip/zip.c. In mmap builds, an ineffective bounds check allows reading past the mapped central directory. An attacker c...

PT-2026-115139

Name of the Vulnerable Software and Affected Versions libfsapfs versions prior to 20260922 Description An integer underflow exists in the libfsapfs key encrypted key read data function. This allows attackers to trigger heap out-of-bounds reads by providing a crafted encrypted APFS image with...

PT-2026-115271

Name of the Vulnerable Software and Affected Versions snap7 versions prior to 1.4.4 Description An out-of-bounds write occurs in the opReadArea function of TSnap7MicroClient. This issue allows malicious S7 peers to overflow client buffers by manipulating an unchecked DataLength field. Rogue or...

PT-2026-115264

Name of the Vulnerable Software and Affected Versions LibRaw versions prior to 0.22.3 Description A heap-based out-of-bounds read exists in the parseNikonMakernote function. This occurs when the software processes a specially crafted Nikon NEF/TIFF image containing a 5-byte ShotInfo tag that...

PT-2026-115129

Name of the Vulnerable Software and Affected Versions FluidSynth versions prior to 2.6.2 Description An out-of-bounds write issue exists where attackers can corrupt heap and stack memory by providing unvalidated SoundFont modulator destination values. By crafting an SF2 file with PMOD/IMOD...

PT-2026-115164

Name of the Vulnerable Software and Affected Versions EarthScope libmseed versions prior to 3.5.5 Description A heap out-of-bounds read occurs in the ms3 detect function within parseutils.c when processing truncated miniSEED 2 record buffers. An attacker can trigger this by providing a 40 to 47...

PT-2026-115168

Name of the Vulnerable Software and Affected Versions WildMIDI versions 0.5.0 and earlier Description A heap out-of-bounds read exists in the HMP parser WM ParseNewHmp function. An attacker can provide a specially crafted .hmp file with a chunk length between 0 and 12, causing an underflow that...

PT-2026-115074

Name of the Vulnerable Software and Affected Versions AsyncHttpClient versions 2.0.0 through 2.16.0 AsyncHttpClient versions 3.0.0 through 3.0.11 Description The PropertiesBasedResumableProcessor stores resumable download state at a predictable shared path...

PT-2026-122759

Security vulnerability affects the langfuse package. This issue is resolved in later releases. See references for vulnerability details...

PT-2026-115216

Name of the Vulnerable Software and Affected Versions ZoneMinder versions 1.34.0 through 1.36.38 Description The web interface mishandles failed token authentication in the web/includes/auth.php file. The validateToken function returns false when a token is malformed or has an invalid signature,...

PT-2026-122798

Security vulnerability affects the py3-pydantic-ai package. Pydantic AI is a Python agent framework for building applications and workflows with Generative AI...

PT-2026-115282

Name of the Vulnerable Software and Affected Versions rustdesk-api versions prior to 2.8 Description An authorization bypass allows unauthenticated attackers to overwrite existing peer records. By sending a target device ID to the 'POST /api/sysinfo' endpoint, attackers can modify the hostname,...

PT-2026-115090

Attackers converted grocery store refrigeration systems into heating units, reaching 50°C 120°F across 400+ European stores. They exploited Internet-exposed Danfoss controllers via CVE-2024-41450/41451/41452, then moved laterally through OT networks to coordinate simultaneous temperature...

PT-2026-122709

Security vulnerability affects the langfuse package. Next...

PT-2026-115133

Name of the Vulnerable Software and Affected Versions catdoc versions prior to 0.96 Description An out-of-bounds read occurs in the copy unicode string function within src/xlsparse.c due to an unchecked string character count. An attacker can use a specially crafted .xls file that declares 0xFFFF...

PT-2026-114782

Apply the DSA-2026-405 security update for Dell Wyse Management Suite to fix four XSS flaws, including critical bug CVE-2026-82158 CVSS 9.0. Dell WyseManagementSuite Cybersecurity Vulnerability XSS InfoSec https://t.co/PeIVNUn0pa...

PT-2026-115173

GNU LibreDWG through 0.14.8612 contains a global out-of-bounds read vulnerability in the AcDs decoder acds private that allows attackers to read beyond a static table via an unchecked schema property type index. Attackers can supply a crafted R2004 or R2010+ DWG file with a large 'schdat' propert...

PT-2026-115165

Name of the Vulnerable Software and Affected Versions libewf versions prior to 20260924 Description A heap out-of-bounds read occurs in the libewf lef extended attribute read data function because UTF-16 name and value sizes are validated before being doubled. An attacker can use a specially...

PT-2026-115170

UADE through 3.05 contains an out-of-bounds read vulnerability in uade filemagic in amifilemagic.c caused by unsigned bufsize subtraction wrapping on short inputs. Attackers can supply a crafted short module that passes format probe bounds checks and reads far past the buffer, crashing applicatio...

PT-2026-115175

La Suite Docs through 6.0.0 contains an authorization bypass vulnerability that allows authenticated users to write comments into threads of documents they cannot access. Attackers who know a thread UUID can route a POST comment request through their own document's resource id, inserting comments...

PT-2026-115261

Name of the Vulnerable Software and Affected Versions libical versions prior to 4.0.7 Description A heap-based out-of-bounds read occurs in the icalvalue decode ical string function within src/libical/icalvalue.c when decoding input that ends with a backslash. An attacker can provide escaped...

PT-2026-114775

The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting via 'order email' in all versions up to, and including, 7.0.5 due to insufficient input sanitization and output escaping. This makes it possible for...

PT-2026-115167

libADLMIDI 1.6.2 through 1.6.2.1 contains an off-by-one stack out-of-bounds write vulnerability in BW MidiSequencer that allows attackers to corrupt stack memory via crafted MIDI files. Attackers can supply a MIDI file with a note-on using status 0x9F and note 0x7F through adl openFile or adl...

PT-2026-115122

Insertion of Sensitive Information Into Sent Data vulnerability in ClikIT Infinite Uploads infinite-uploads allows Retrieve Embedded Sensitive Data.This issue affects Infinite Uploads: from n/a through 3.4.1...

PT-2026-115153

Name of the Vulnerable Software and Affected Versions Libyal libesedb versions prior to 20260704 Description A heap out-of-bounds read occurs in the libesedb record get multi value function. This issue allows attackers to read past buffers using unbounded multi-value offset tables. By providing a...

PT-2026-122874

Security vulnerability affects the renovate package. js-yaml is a JavaScript YAML parser and dumper...

PT-2026-122812

Security vulnerability affects the argo-cd package. go-git is an extensible git implementation library written in pure Go...

PT-2026-115071

Name of the Vulnerable Software and Affected Versions Nutanix Prism Element versions prior to 7.6.0.8 Nutanix Prism Element versions prior to 7.5.2 Nutanix Prism Element versions prior to 7.3.1.18 Nutanix Prism Central versions prior to 7.6.0.8 Nutanix Prism Central versions prior to 7.5.2 Nutani...