414789 matches found
PT-2026-114790
Uncaught exception vulnerability in Samsung Open Source Vyond allows Input Data Manipulation. This issue affects Vyond: before fb10a5c8b833df7f152d4a563a61d6090a1790d7...
PT-2026-115272
Name of the Vulnerable Software and Affected Versions Jooan JA-A12 IP cameras version 009 20171107 Jooan JA-A12 IP cameras version 05.02.31.105 Description Unauthenticated attackers can achieve remote code execution and gain full device control by utilizing hard-coded credentials. The issue occur...
PT-2026-115015
Name of the Vulnerable Software and Affected Versions Nuxt OG Image versions 6.2.5 through 6.6.x Description An unauthenticated attacker can perform content spoofing by manipulating the cache of Open Graph images. The dynamic endpoint / og/d/.png accepts unsigned requests, and the...
PT-2026-122725
GHSA-gcjh-h69q-9w9g affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...
PT-2026-122717
Security vulnerability affects the grafana-fips package. This issue is resolved in later releases. See references for vulnerability details...
PT-2026-122732
Security vulnerability affects the argo-cd package. This issue is resolved in later releases. See references for vulnerability details...
PT-2026-122720
Security vulnerability affects the grafana-fips package. This issue is resolved in later releases. See references for vulnerability details...
PT-2026-122704
GHSA-5p4m-2wfm-xmqj affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...
PT-2026-122775
Security vulnerability affects the grafana-fips package. This issue is resolved in later releases. See references for vulnerability details...
PT-2026-122862
Security vulnerability affects the grafana-fips package. This issue is resolved in later releases. See references for vulnerability details...
PT-2026-122870
Security vulnerability affects the argo-cd package. This issue is resolved in later releases. See references for vulnerability details...
PT-2026-122873
Security vulnerability affects the grafana-fips package. This issue is resolved in later releases. See references for vulnerability details...
PT-2026-114789
Name of the Vulnerable Software and Affected Versions User Rights Access Manager versions prior to 1.1.4 Description An issue exists where an AJAX account-registration handler does not restrict access, allowing unauthenticated attackers to register accounts. These newly created accounts are...
PT-2026-115269
NivoCart through 2.5.1 contains a CAPTCHA bypass vulnerability that allows unauthenticated attackers to defeat form protection because the expected code is printed as plain text in the HTML. Attackers can fetch protected forms, extract the captcha image value with a pattern match, and submit it t...
PT-2026-114890
An improper link resolution before file access 'link following' vulnerability has been reported to affect Virtualization Station. If a remote attacker gains a user account, they can then exploit the vulnerability to compromise the security of the system. We have already fixed the vulnerability in...
PT-2026-114866
A heap buffer overflow in HPE NonStop NDSREST could corrupt resume-execution address and may potentially redirect execution flow...
PT-2026-114893
A heap buffer overflow in HPE NonStop Debug Utilities could corrupt resume-execution address and may potentially redirect execution flow...
PT-2026-114895
A security vulnerability in HPE NonStop HTTP WEBSERVER can cause memory corruption which may result in a system halt...
PT-2026-114799
The Email Customizer for WooCommerce Pro plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 3.9.5. This is due to insufficient authorization and input sanitization in the send test mail function, which allows user-controlled PHP code to be written to...
PT-2026-114849
When Jetty's HttpClient make a request to a server through a forward proxy, the server may reply with a 407 Proxy Authentication Required. The client mistakenly interprets the 407 as coming from the proxy, so it re-sends the request with the Proxy-Authentication header, which arrives to the serve...
PT-2026-114776
The Post and Page Builder by BoldGrid – Visual Drag and Drop Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Table Designer 'data-label' Attribute in all versions up to, and including, 1.27.13 due to insufficient input sanitization and output escaping. This makes ...
PT-2026-114888
An unix symbolic link symlink following vulnerability has been reported to affect QuMagie. If a remote attacker gains a user account, they can then exploit the vulnerability to compromise the security of the system. We have already fixed the vulnerability in the following version: QuMagie 2.9.2 a...
PT-2026-114794
Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description A race condition exists in the kqueue fork copy knote function where it indexes into the child's file descriptor table using a knote's file descriptor number...
PT-2026-114793
Name of the Vulnerable Software and Affected Versions The product name cannot be determined. affected versions not specified Description A race condition exists when copying knotes from a parent kqueue to a child. The copy code fails to correctly exclude marker knotes, which are used internally t...
PT-2026-114795
Name of the Vulnerable Software and Affected Versions Document Gallery versions prior to 5.1.2 Description An unauthenticated AJAX action fails to properly sanitize and escape user input before reflecting it within an HTML attribute. This leads to a Reflected Cross-Site Scripting XSS issue, where...
PT-2026-115088
Helium is a free online student planner for classes, homework, grades, and notes. Prior to 2.2.60, the POST /planner/attachments/ endpoint allows authenticated users to upload SVG and HTML attachments because conf/configs/common.py omits those formats from BLOCKED ATTACHMENT EXTENSIONS and BLOCKE...
PT-2026-114779
The Mang Board WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'data type' parameter in all versions up to, and including, 2.4.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...
PT-2026-115006
Sonatype Nexus Repository 3 allows an unauthenticated remote attacker to supply attacker-controlled input to a Java class loading call through an ExtDirect endpoint. This allows the attacker to learn whether specific classes are present in the application. The issue does not by itself allow code...
PT-2026-115005
A missing authorization check in Nexus Repository 3's NuGet Components API upload path allows an account holding only repository read and browse privileges to upload and persist NuGet symbol packages .snupkg to a hosted repository, bypassing the write-permission check enforced for ordinary packag...
PT-2026-115312
The Apache Airflow SFTP provider's deferrable code paths SFTPTrigger, SFTPHookAsync, SFTPClientPool disable SSH host-key verification by default unless the connection explicitly sets no host key check to false. Deployments that run SFTP sensors or operators in deferrable mode are affected. An...
PT-2026-115313
Name of the Vulnerable Software and Affected Versions apache-airflow-providers-keycloak versions prior to 0.11.1 Description The Keycloak auth manager fails to terminate the session during logout. While the logout route revokes the provided token, the KeycloakJWTMiddleware issues a new, unrevoked...
PT-2026-115182
Netgate pfSense CE through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with Virtual IP edit privileges to execute commands as root by storing an unvalidated CARP VHID. Attackers can supply a VHID containing shell metacharacters that executes via interface...
PT-2026-114762
A security vulnerability in HPE NonStop EXPAND may result in out-of-bounds memory read/write operations...
PT-2026-122739
Security vulnerability affects the langfuse package. This issue is resolved in later releases. See references for vulnerability details...
PT-2026-114909
The WholesaleX – B2B & Wholesale Plugin for WooCommerce with Wholesale Prices plugin for WordPress is vulnerable to Limited Privilege Escalation in all versions up to, and including, 3.0.8 via the 'process registration' due to missing validation on the 'wholesalex registration role' parameter. Th...
PT-2026-115138
Name of the Vulnerable Software and Affected Versions GNOME libgxps versions 0.3.2 and earlier Description A heap out-of-bounds read exists in the path geometry start element function. This occurs when a crafted XPS document contains PolyBezierSegment or PolyQuadraticBezierSegment Points attribut...
PT-2026-115308
Name of the Vulnerable Software and Affected Versions ClassroomIO version 1.0.0 Description An insecure direct object reference IDOR exists in the Hono API course submission routes. This allows course tutors or admins to modify submissions belonging to other courses by providing their own course ...
PT-2026-115028
Lychee is a free, open-source photo-management tool. Prior to 7.7.1, the Supporter or Pro webshop POST /api/v2/Shop/Checkout/Process flow accepts an unrestricted additional data array and CheckoutService::preparePurchaseParameters merges it after server-computed purchase parameters. Because later...
PT-2026-114933
In Progress® Kendo® UI for jQuery prior to 2026.3.1015, the TabStrip, Menu, and PanelBar components insert data source imageUrl values into single-quoted image src attributes without proper escaping. An attacker who can modify an image URL can inject additional HTML attributes, including event...
PT-2026-115105
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WP Chill Download Monitor download-monitor allows Stored XSS.This issue affects Download Monitor: from n/a through 5.3.3...
PT-2026-115325
Name of the Vulnerable Software and Affected Versions NoMachine affected versions not specified Description A local privilege escalation flaw exists in the NoMachine Device Service due to incorrect permissions assigned to a named pipe. A named pipe is a mechanism for inter-process communication. ...
PT-2026-115277
Name of the Vulnerable Software and Affected Versions JobOps versions prior to 0.13.2 Description A server-side request forgery SSRF issue exists in the 'POST /api/manual-jobs/fetch' endpoint. This allows authenticated users, or unauthenticated clients when the system is in demo mode, to force th...
PT-2026-114802
The Tutor LMS WordPress plugin before 4.1.1 does not perform a capability check in a routine that regenerates its managed pages, allowing unauthenticated users to force-publish unpublished pages and overwrite their content, create missing ones, and change the options that reference them...
PT-2026-115102
Missing Authorization vulnerability in WPdreams Ajax Search Lite ajax-search-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ajax Search Lite: from n/a through 4.14.5...
PT-2026-123078
TuxCare rebuilt follow-redirects to address 4 CVEs. Fixed in 1.2.6-tuxcare.2...
PT-2026-123086
TuxCare rebuilt 3 io.projectreactor packages to address 2 CVEs. Fixed in 3.5.12-tuxcare.1...
PT-2026-123084
TuxCare rebuilt 7 org.springframework.amqp packages to address 4 CVEs. Fixed in 3.2.8-tuxcare.1...
PT-2026-123073
TuxCare rebuilt 8 org.springframework.ldap packages to address 1 CVE. Fixed in 2.4.2-tuxcare.1...