PT-2026-115147

Name of the Vulnerable Software and Affected Versions zziplib versions prior to 0.13.81 Description An out-of-bounds read exists in the zzip parse root directory function within zzip/zip.c. In mmap builds, an ineffective bounds check allows reading past the mapped central directory. An attacker c...

PT-2026-115271

Name of the Vulnerable Software and Affected Versions snap7 versions prior to 1.4.4 Description An out-of-bounds write occurs in the opReadArea function of TSnap7MicroClient. This issue allows malicious S7 peers to overflow client buffers by manipulating an unchecked DataLength field. Rogue or...

PT-2026-115264

Name of the Vulnerable Software and Affected Versions LibRaw versions prior to 0.22.3 Description A heap-based out-of-bounds read exists in the parseNikonMakernote function. This occurs when the software processes a specially crafted Nikon NEF/TIFF image containing a 5-byte ShotInfo tag that...

PT-2026-115129

Name of the Vulnerable Software and Affected Versions FluidSynth versions prior to 2.6.2 Description An out-of-bounds write issue exists where attackers can corrupt heap and stack memory by providing unvalidated SoundFont modulator destination values. By crafting an SF2 file with PMOD/IMOD...

PT-2026-115164

Name of the Vulnerable Software and Affected Versions EarthScope libmseed versions prior to 3.5.5 Description A heap out-of-bounds read occurs in the ms3 detect function within parseutils.c when processing truncated miniSEED 2 record buffers. An attacker can trigger this by providing a 40 to 47...

PT-2026-115168

Name of the Vulnerable Software and Affected Versions WildMIDI versions 0.5.0 and earlier Description A heap out-of-bounds read exists in the HMP parser WM ParseNewHmp function. An attacker can provide a specially crafted .hmp file with a chunk length between 0 and 12, causing an underflow that...

PT-2026-115090

Attackers converted grocery store refrigeration systems into heating units, reaching 50°C 120°F across 400+ European stores. They exploited Internet-exposed Danfoss controllers via CVE-2024-41450/41451/41452, then moved laterally through OT networks to coordinate simultaneous temperature...

PT-2026-122709

Security vulnerability affects the langfuse package. Next...

PT-2026-115133

Name of the Vulnerable Software and Affected Versions catdoc versions prior to 0.96 Description An out-of-bounds read occurs in the copy unicode string function within src/xlsparse.c due to an unchecked string character count. An attacker can use a specially crafted .xls file that declares 0xFFFF...

PT-2026-115165

Name of the Vulnerable Software and Affected Versions libewf versions prior to 20260924 Description A heap out-of-bounds read occurs in the libewf lef extended attribute read data function because UTF-16 name and value sizes are validated before being doubled. An attacker can use a specially...

PT-2026-115170

UADE through 3.05 contains an out-of-bounds read vulnerability in uade filemagic in amifilemagic.c caused by unsigned bufsize subtraction wrapping on short inputs. Attackers can supply a crafted short module that passes format probe bounds checks and reads far past the buffer, crashing applicatio...

PT-2026-115175

La Suite Docs through 6.0.0 contains an authorization bypass vulnerability that allows authenticated users to write comments into threads of documents they cannot access. Attackers who know a thread UUID can route a POST comment request through their own document's resource id, inserting comments...

PT-2026-115153

Name of the Vulnerable Software and Affected Versions Libyal libesedb versions prior to 20260704 Description A heap out-of-bounds read occurs in the libesedb record get multi value function. This issue allows attackers to read past buffers using unbounded multi-value offset tables. By providing a...

PT-2026-122874

Security vulnerability affects the renovate package. js-yaml is a JavaScript YAML parser and dumper...

PT-2026-122812

Security vulnerability affects the argo-cd package. go-git is an extensible git implementation library written in pure Go...

PT-2026-122713

Security vulnerability affects the py3-pydantic-ai package. Pydantic AI is a Python agent framework for building applications and workflows with Generative AI...

PT-2026-114884

A relative path traversal vulnerability has been reported to affect QuMagie. If a remote attacker gains an administrator account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version:...

PT-2026-122813

Security vulnerability affects the elasticsearch package. snappy-java through 1...

PT-2026-123088

TuxCare rebuilt 42 org.springframework.integration packages to address 10 CVEs. Fixed in 6.0.9-tuxcare.1...

PT-2026-115155

FreeImage danoli3 fork through 3.19.23 contains a heap out-of-bounds read vulnerability in Unpack32Bits in PluginPICT.cpp because rowBytes is never checked against the file-controlled PixMap width. Attackers can supply a crafted PICT file with a truncated or undersized rowBytes to over-read up to...

PT-2026-114837

undici is an HTTP client library for Node.js. In versions 8.11.0 and 8.11.1, its experimental WebSocket client, which is enabled by default when HTTP/2 is allowed, mishandles a failed WebSocket handshake over HTTP/2: the request is already marked completed, so the abort becomes a no-op and the...

PT-2026-114968

A buffer overflow vulnerability in HPE NonStop RDMA SERVICES NSK may cause out-of-bounds memory write, which may result in memory corruption...

PT-2026-114437

A vulnerability in HPE NonStop CIPSAM allows an out-of-bounds write that can corrupt buffer data...

PT-2026-114441

A buffer overflow vulnerability in HPE NonStop TELSERV can cause memory corruption and DoS...

PT-2026-114836

"ゲオアプリ" provided by GEO CORPORATION contains an issue with cleartext storage of sensitive information, which may allow an attacker to obtain the password of a user of the affected application...

PT-2026-115078

XXL-JOB =3.5.0-SNAPSHOT contains a stored Cross-Site Scripting XSS vulnerability in the job log list page /joblog. An authenticated user who holds permission on a target executor job group can inject arbitrary JavaScript via the executorParam argument of the manual-trigger endpoint POST...

PT-2026-114898

A stack buffer overflow vulnerability in HPE NonStop SQL/MX Executor may potentially result in information disclosure or process crash...

PT-2026-114937

In Progress® Kendo® UI for jQuery prior to 2026.3.1015, Model.accept passes server-response keys to kendo.setter without guarding against unsafe object paths containing proto , constructor, or prototype. An attacker who can supply data accepted by an affected model can modify object prototype...

PT-2026-115213

temporal-proxy 0.2.0 through 0.8.0 does not bind encrypted payloads to the namespace they were encrypted for. When payload encryption is enabled, the proxy chooses the decryption key by an identifier stored in the payload rather than by the namespace of the request, and nothing in the ciphertext...

PT-2026-114828

In Eclipse Vert.x versions 4.0.0, 4.5.34 or 5.0.0,5.0.12 or 5.1.0,5.1.9 or 5.2.0, 5.2.0, the TDS message decoder in the Vert.x MSSQL client vertx-mssql-client aggregates inbound TDS packets into a composite direct-memory buffer without any cumulative size limit. A malicious, compromised, or...

PT-2026-115289

Trudesk through 1.2.11 contains an authorization bypass vulnerability that allows any authenticated user to read private conversations by supplying another conversation's id. Attackers can request GET /api/v1/messages/conversation/:id, which lacks participant checks, to obtain full message histor...

PT-2026-114788

The Spin Wheel WordPress plugin before 2.2.1 does not verify that a visitor actually performed a legitimate spin before returning and consuming a configured prize coupon, allowing unauthenticated users to disclose and drain the stored coupon codes of any campaign, including unpublished ones...

PT-2026-114881

A cross-site scripting XSS vulnerability has been reported to affect Notes Station 3. If a remote attacker gains a user account, they can then exploit the vulnerability to inject malicious code. We have already fixed the vulnerability in the following version: Notes Station 3 3.9.12 and later...

PT-2026-115110

Missing Authorization vulnerability in WPExperts WP EasyPay wp-easy-pay allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP EasyPay: from n/a through 4.5.4...

PT-2026-115327

Name of the Vulnerable Software and Affected Versions Docker affected versions not specified Description A failure in the Docker Buildx filesystem entitlements protection mechanism allows for remote code execution. Recommendations At the moment, there is no information about a newer version that...

PT-2026-115214

An issue in Trisolutions BRPerfX version 1.4.4.0 exposes LDAP credentials in plaintext within the administrative configuration interface. An authenticated administrator can inspect the client-side code to retrieve the credential...

PT-2026-114966

A buffer overflow vulnerability in HPE NonStop ODBC/MX Server may cause memory corruption, resulting in application crash...

PT-2026-114842

On request the sdbootutil script creates a world-readable debug log in /var/log/sdbootutil.log. The log file is created world-readable, however, which means that arbitrary low-privileged users in the system will be able to extract secrets from it...

PT-2026-114811

Improper certificate validation in the tunnel handshake in Cato Client allows a man-in-the-middle attacker to impersonate a Cato Point of Presence PoP server and intercept or modify tunnel traffic...

PT-2026-114820

Name of the Vulnerable Software and Affected Versions bhyve affected versions not specified Description The xHCI USB 3 device model fails to validate or save the event ring size provided by the guest. Because the size is re-read from guest memory during each use, Transfer Request Block TRB fields...

PT-2026-115294

Papermark through 0.22.0 contains a missing authorization vulnerability in the data room viewer group API that allows authenticated users to delete other teams' viewer groups and share links. Attackers who know a victim team's data room and group identifiers can send DELETE requests, read group...

PT-2026-115208

Name of the Vulnerable Software and Affected Versions Python Social Auth versions prior to 5.0.2 Description The LINE backend fails to validate the returned OAuth state during the exchange of an authorization code. This allows an attacker to initiate an authorization flow for an account they...

PT-2026-114977

Name of the Vulnerable Software and Affected Versions jackson-mapper-asl versions 1.8.3, 1.9.2, 1.9.11, 1.9.12, and 1.9.13 Description An issue exists where attackers can cause a denial of service by providing deeply nested JSON input to an application that deserializes untrusted JSON using the...

PT-2026-115116

Name of the Vulnerable Software and Affected Versions Kuadrant operator affected versions not specified Description A flaw exists in the internal WebAssembly WASM shim used by the operator. The shim fails to correctly escape values from HTTPRoute match fields when generating the Common Expression...

PT-2026-115011

Name of the Vulnerable Software and Affected Versions Matomo version 5.11.2 Description An issue in the SiteContentDetector / SitesManager component allows a remote attacker to obtain sensitive information. Recommendations At the moment, there is no information about a newer version that contains...

PT-2026-114440

Name of the Vulnerable Software and Affected Versions Netgate pfSense FRR package pfSense-pkg-frr versions 2.0.2 1 and 2.1.2 1 Description An authenticated WebGUI user with page-status-frr privileges can perform OS command injection through the FRR status filter. The issue occurs when a filter...

PT-2026-115275

Aureus ERP through 1.6.0 contains a stored cross-site scripting vulnerability in HolidayAction.php that allows authenticated users to inject scripts via unescaped holiday names rendered as HtmlString. Attackers permitted to create Public Holidays or Mandatory Days can store JavaScript payloads th...

PT-2026-114930

Name of the Vulnerable Software and Affected Versions OpenSSH affected versions not specified Description An issue exists where a compressed payload can expand beyond the maximum supported packet size after compression is negotiated. This occurs because the inflate loop does not stop at the defin...

PT-2026-114929

Name of the Vulnerable Software and Affected Versions OpenSSH affected versions not specified Description When GSSAPI authentication is enabled, a failed GSSAPI attempt may leave delegated credentials stored for the connection despite the failure of user authorization. Consequently, a subsequent...

PT-2026-115152

Name of the Vulnerable Software and Affected Versions ytnef versions 2.1.2 and earlier Description A heap out-of-bounds read exists in the MAPIPrint function. This occurs when the software processes compressed RTF Rich Text Format properties within a crafted winmail.dat file. If the decompressed...