414789 matches found
PT-2026-122742
Security vulnerability affects the elasticsearch package. In specific scenarios involving WebSocket handshake redirects to a different origin, the Reactor Netty WebSocket client may leak credentials...
PT-2026-122804
Security vulnerability affects the nfs-subdir-external-provisioner package. httpTokenCacheKey uses path...
PT-2026-122816
Security vulnerability affects the langfuse package. Axios is a promise-based HTTP client for the browser and Node...
PT-2026-114891
A heap buffer overflow in HPE NonStop OCAX could corrupt address space and may potentially redirect execution flow...
PT-2026-115100
Missing Authorization vulnerability in WP Chill Strong Testimonials strong-testimonials allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Strong Testimonials: from n/a through 3.3.12...
PT-2026-114813
An observable timing discrepancy vulnerability has been reported to affect QuRouter. If exploited, the vulnerability could allow remote attackers to obtain sensitive data. We have already fixed the vulnerability in the following version: QuRouter 2.7.2.113 and later...
PT-2026-122868
GHSA-8wmf-6v46-5gfg affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...
PT-2026-122772
Security vulnerability affects the nfs-subdir-external-provisioner package. The ParseAddress function constructs domain-literal address components through repeated string concatenation...
PT-2026-122723
Security vulnerability affects the langfuse package. This issue is resolved in later releases. See references for vulnerability details...
PT-2026-115227
The EnergizeLab Eilik NestJS auth service accepts a user-controlled user ID in account update requests mass assignment. A registered user can set another account's identifier and take over that account...
PT-2026-115226
Name of the Vulnerable Software and Affected Versions EnergizeLab station-middleware NestJS Docker images versions 1.6.5 through 1.8.2 Description Insufficient authorization checks on administrative APIs allow authenticated users with low privileges to perform unauthorized actions. This includes...
PT-2026-115224
Name of the Vulnerable Software and Affected Versions EnergizeLab station-middleware NestJS Docker images versions 1.6.5 through 1.8.2 Description Low-privilege registered accounts can read arbitrary files from the server by providing a controlled file path. This issue allows unauthorized access ...
PT-2026-114990
Name of the Vulnerable Software and Affected Versions JetBrains TeamCity versions prior to 2026.2 JetBrains TeamCity versions prior to 2026.1.4 JetBrains TeamCity versions prior to 2025.11.8 Description Remote code execution is possible due to a whitelist bypass within the build messages protocol...
PT-2026-115292
Name of the Vulnerable Software and Affected Versions Likeshop versions prior to 3.5.2 Description An insecure direct object reference issue exists in AfterSale.php and AfterSaleLogic.php. Authenticated users with self-registered accounts can access after-sale records of other customers by...
PT-2026-115109
Name of the Vulnerable Software and Affected Versions Tianji versions prior to 1.31.29 Description The formatString function in src/server/utils/template.ts passes survey feedTemplate and monitor notification templates to the lodash template function while the default evaluate pattern is enabled....
PT-2026-114953
Name of the Vulnerable Software and Affected Versions Wavlink WL-WN530BE2-A versions prior to 2026-09-24-841a51c6d5 tclinux.bin Description An OS command injection flaw exists in the Login Processing component within the sub 12580 function of the api.cgi file. A remote attacker can exploit this b...
PT-2026-115135
Name of the Vulnerable Software and Affected Versions Open Asset Import Library assimp versions prior to 6.0.6 Description A NULL pointer dereference occurs in the Ogre3D binary mesh importer when handling unvalidated animation track targets within the ReadAnimationKeyFrames function. An attacker...
PT-2026-115140
Name of the Vulnerable Software and Affected Versions libfwsi versions prior to 20260522 Description A heap out-of-bounds read occurs in the libfwsi mtp file entry values read data function. This issue allows attackers to read data beyond the allocated buffer by using specially crafted MTP file...
PT-2026-115150
Name of the Vulnerable Software and Affected Versions libansilove versions 1.3.0 through 1.4.2 Description A NULL pointer dereference occurs in the ansilove xbin function when processing a specially crafted XBIN file. An attacker can trigger this by setting the 512-character flag while omitting t...
PT-2026-115160
Name of the Vulnerable Software and Affected Versions libTiMidity versions prior to 0.2.9 Description The SoundFont loader contains a stack out-of-bounds write issue. An attacker can corrupt stack memory by providing a specially crafted .sf2 file containing out-of-range pgen or igen operator...
PT-2026-115125
Name of the Vulnerable Software and Affected Versions AdPlug versions prior to 2.5 Description A heap-based buffer overflow occurs in the CksmPlayer::update function within src/ksm.cpp. The issue arises because the software writes past the fixed databuf2048 array without performing bounds checkin...
PT-2026-115130
Name of the Vulnerable Software and Affected Versions CFITSIO versions prior to 4.7.1 Description A heap-based out-of-bounds read exists in the unquantize helpers within imcompress.c. This occurs when a zero or negative ZDITHER0 seed is used, allowing memory to be read before the fits rand value...
PT-2026-115145
Name of the Vulnerable Software and Affected Versions libnsbmp versions prior to 0.1.8 Description An out-of-bounds read exists in the bmp decode mask function. An attacker can trigger a heap over-read, which may crash applications calling bmp decode, by providing a specially crafted ICO file whe...
PT-2026-114901
Name of the Vulnerable Software and Affected Versions bannersky BSK PDF Manager versions prior to 3.8.1 Description Improper neutralization of input during web page generation allows for Stored Cross-site Scripting XSS, a condition where malicious scripts are permanently stored on the target serv...
PT-2026-122826
Security vulnerability affects the nfs-subdir-external-provisioner package. The net/url package does not set a limit on the number of query parameters in a query...
PT-2026-114934
In Progress® Kendo® UI for jQuery versions starting with 2019.2.514 and prior to 2026.3.1015, the PanelBar component inserts data source item URL values into a single-quoted href attribute without proper encoding. An attacker who can control an item URL can inject additional HTML attributes,...
PT-2026-115079
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in PluginUs.Net MDTF wp-meta-data-filter-and-taxonomy-filter allows Stored XSS.This issue affects MDTF: from n/a through 1.4.0...
PT-2026-114996
Use of Externally-Controlled format string vulnerability in Unitronics Unitronics UniStream Pro/UniLogic. This issue affects Unitronics UniStream Pro/UniLogic: Unitronics UniStream Pro versions only B10 / C10 – UniLogic versions prior to 1.41.329...
PT-2026-115156
Name of the Vulnerable Software and Affected Versions ValleyBell libvgm versions prior to commit a6eed945 Description The PCM data-block decompressor contains a heap out-of-bounds read issue caused by an unbounded compression-table index. An attacker can provide a specially crafted .vgm file...
PT-2026-114822
Name of the Vulnerable Software and Affected Versions bhyve affected versions not specified Description The framebuffer device model contains duplicated maximum resolution constants between the framebuffer and RFB modules that are out of sync. Furthermore, writes to the framebuffer BAR allow the...
PT-2026-115280
Name of the Vulnerable Software and Affected Versions Archon versions 0.2.13 through 0.11.1 Description Missing authentication allows unauthenticated attackers to access the /api/ control API, which binds to 0.0.0.0 by default. Attackers with network access can send messages to the AI coding agen...
PT-2026-115223
EnergizeLab AI Station firmware, EilikO Linux robot firmware v2.1 20260617182218 release, and the EnergizeLab Windows desktop app 3.1.2 download firmware updates over plain HTTP and do not verify their integrity or authenticity. An attacker able to intercept or modify the traffic can substitute a...
PT-2026-114947
Name of the Vulnerable Software and Affected Versions Siemens Software Center versions prior to 4.0.9.8 Description Siemens Software Center loads dynamic-link libraries DLLs from an uncontrolled search path, a behavior known as DLL side-loading. This allows an authenticated local attacker to plac...
PT-2026-115324
Name of the Vulnerable Software and Affected Versions GStreamer gst-plugins-base versions prior to 1.28.8 GStreamer gst-plugins-good versions prior to 1.28.8 Description A heap-based buffer overflow exists in the RTP L8, L16, and L24 audio depayloaders. This issue can be triggered via crafted RTS...
PT-2026-114792
Name of the Vulnerable Software and Affected Versions Elementor Website Builder versions prior to 4.2.4 Description Authenticated attackers with contributor-level access and above can cause sensitive information exposure via the keys conversion map parameter. This allows the extraction of the ful...
PT-2026-114868
Name of the Vulnerable Software and Affected Versions jetty-security affected versions not specified jetty-eeN-security affected versions not specified jetty-eeN-servlet affected versions not specified Description Jakarta Spec constraints defined as http-method-omission can be bypassed by using...
PT-2026-114985
Name of the Vulnerable Software and Affected Versions symfony/expression-language versions prior to 5.4.54 symfony/expression-language versions 6.0.0-BETA1 through 6.4.47 symfony/expression-language versions 7.0.0-BETA1 through 7.4.20 symfony/expression-language versions 8.0.0-BETA1 through 8.1.8...
PT-2026-114815
A NULL pointer dereference vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service DoS attack. We have already fixed the vulnerability in the following version: File Station 5...
PT-2026-114880
A server-side request forgery SSRF vulnerability has been reported to affect Download Station. If a remote attacker gains a user account, they can then exploit the vulnerability to read application data. We have already fixed the vulnerability in the following version: Download Station 5.10.1.312...
PT-2026-115331
A potential authentication bypass vulnerability was reported in some Lenovo tablets that could allow a user with physical access to gain unauthorized device access...
PT-2026-114994
: Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Unitronics Unitronics UniStream Pro/UniLogic. This issue affects Unitronics UniStream Pro/UniLogic: Unitronics UniStream Pro versions only B10 / C10 – UniLogic versions prior to 1.41.329...
PT-2026-115228
Name of the Vulnerable Software and Affected Versions Microsoft Office Word affected versions not specified Description A heap-based buffer overflow occurs when a program writes more data to a heap memory block than it can hold, potentially corrupting memory. In Microsoft Office Word, this flaw...
PT-2026-114916
A vulnerability in HPE NonStop SQL/MX UDR SERVER may allow a crafted message to cause process termination, service disruption or memory corruption, resulting in undefined behavior...
PT-2026-114999
OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, src/www/system advanced admin.php reads certificate records into $a cert but omits that array from legacy html escape form data before rendering each certificate descr value in the SSL Certificate selector. The...
PT-2026-114865
A directory traversal vulnerability in HPE NonStop Python 3.x could allow attackers to overwrite arbitrary files via a .. dot dot sequence in filenames in a TAR archive...
PT-2026-114973
Name of the Vulnerable Software and Affected Versions OPNsense versions prior to 26.1.11 Description Firewall Rules and NAT views fail to apply quote-safe encoding to stored category names and alias descriptions within the filter rule.volt and nat rule.volt files. Because the response layer...
PT-2026-123147
TuxCare rebuilt 19 org.springframework.security packages to address 8 CVEs. Fixed in 5.1.5.RELEASE-tuxcare.1...
PT-2026-123145
TuxCare rebuilt 10 packages to address 1 CVE. Fixed in 4.5.0-tuxcare.8...
PT-2026-114781
"The sandbox wasn't connected to an open proxy, it was connected to a server connected to an open proxy." 😭 @AviN102, please read that out loud to yourself. You are literally explaining Transitive Trust and a wide-open Network Path while pretending it proves your point. In real enterprise securit...