417722 matches found
PT-2026-115586
Name of the Vulnerable Software and Affected Versions spice-server affected versions not specified Description Multiple migration data handlers fail to perform bounds validation on client-supplied offsets within SPICE MSGC MIGRATE DATA messages. This allows an authenticated SPICE client to perfor...
PT-2026-115612
Name of the Vulnerable Software and Affected Versions Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental versions prior to 3.0.2 Description Insufficient input sanitization and output escaping allow authenticated attackers with subscriber-level access or higher to perform Stored...
PT-2026-115482
Name of the Vulnerable Software and Affected Versions Coinsnap Bitcoin Crowdfunding WordPress plugin versions prior to 1.2.1 Description The plugin fails to restrict access to the secret used to authenticate its payment gateway webhook, allowing unauthenticated users to obtain it. This disclosure...
PT-2026-115572
Name of the Vulnerable Software and Affected Versions NordVPN for Windows versions prior to 8.12 Description A low-privileged local attacker can connect to the named pipe ".pipe ord-securityv1NordVpnServiceServer" by acting as a trusted process. This allows the attacker to invoke the...
PT-2026-116160
Name of the Vulnerable Software and Affected Versions OpenHuman versions prior to 0.56.0 Description Cross-site request forgery is possible via the unauthenticated GET '/auth/telegram' loopback callback. The telegram auth handler function processes an attacker-supplied one-time Telegram login tok...
PT-2026-115433
The Mang Board plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content' parameter in all versions up to, and including, 2.4.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts...
PT-2026-115539
Authorization bypass through User-Controlled key vulnerability in SFM Software Technologies Inc. Costifier allows Exploitation of Trusted Identifiers. This issue affects Costifier: through 2026-10-16. NOTE: The vendor was contacted early about this disclosure but did not respond in any way...
PT-2026-115416
The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.2.1 via the 'password' parameter due to missing validation on a user controlled key...
PT-2026-115592
Name of the Vulnerable Software and Affected Versions The Events Calendar versions prior to 6.18.2 Description Stored Cross-site Scripting XSS occurs due to improper neutralization of input during web page generation. This allows an attacker to inject malicious scripts that are stored on the serv...
PT-2026-116074
🚨 CVE-2026-111675 Course-tencent-cloud through 2.0.1 contains an improper restriction of authentication attempts vulnerability that allows unauthenticated attackers to brute force 6-digit SMS/email verification codes, which are never invalidated or attempt-limited. Attackers who know a victim's...
PT-2026-116101
ChatOllama through commit 96c3ce5 contains an insecure direct object reference vulnerability that allows remote attackers to access other users' private knowledge bases by supplying sequential ids. Attackers can enumerate ids via GET /api/knowledgebases/id or the knowledgebaseId parameter of POST...
PT-2026-116177
A flaw was found in GIMP. An attacker can cause a Denial of Service DoS or potentially disclose sensitive memory contents by convincing a user to open or preview a specially crafted Bohemia Interactive PAA texture file. Due to an integer overflow when calculating image dimensions during file...
PT-2026-115847
When Gitea's built-in SSH server is enabled START SSH SERVER = true, the presented public key was looked up with an SQL LIKE comparison of its encoded content, which is case-insensitive on some databases, including the default SQLite. An attacker who can construct a case variant of another user's...
PT-2026-115421
The FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.7.0 via the 'order id + billing address id also shipping address id' parameter due to missing validation on a user...
PT-2026-115382
FreeRDP from 3.30.0 before 3.32.0 contains a heap out-of-bounds read vulnerability in the Windows client's CliprdrStream New that allows malicious RDP servers to trigger invalid memory reads via short clipboard responses. Attackers can answer a FILECONTENTS SIZE request with a cbRequested of fewe...
PT-2026-116560
CVE-2025-3778 - Rejected reason: This CVE ID has been rejected or CVE ID :CVE-2025-3778 Published : Oct. 15, 2026, 11:17 p.m. | 1 hour, 34 minutes ago Description :Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. Severity: 0.0 | NA Visit the link for mor...
PT-2026-116049
Name of the Vulnerable Software and Affected Versions ChronoFrame version 1.0.0 Description Missing authentication in the server/api/wizard/ handlers allows unauthenticated attackers to reconfigure already configured instances. By sending a POST request to the '/api/wizard/storage' endpoint, an...
PT-2026-116149
Name of the Vulnerable Software and Affected Versions Apache Kylin versions 4 through 5.0.4 Description An issue exists that allows the exposure of sensitive information to an unauthorized actor through unauthorized SQL execution to the Spark SQL environment. Recommendations Upgrade to version...
PT-2026-116170
Name of the Vulnerable Software and Affected Versions Text::CSV XS versions prior to 1.65 Description An issue exists in the print function where the end of a record and its line ending are dropped when a UTF-8 flagged field precedes invalid UTF-8 bytes. During buffer flushes, the system holds ba...
PT-2026-115336
Name of the Vulnerable Software and Affected Versions bitcoinj versions prior to 0.18 Description In the Payment Request Handler component, the url.openConnection function within the PaymentSession.java file is susceptible to server-side request forgery. This occurs when the pki type argument is...
PT-2026-115665
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.10, looks up BookmarkletImport by sequential primary key within the active Space without restricting created by to the requesting user when an authenticated member of a shared Space...
PT-2026-115497
Name of the Vulnerable Software and Affected Versions GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress versions prior to 2.8.193 Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Authenticat...
PT-2026-115423
The The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.58.1. This is due to the software allowing users to execute an action that does not properly validate a value...
PT-2026-124913
TuxCare rebuilt @angular/router to address 3 CVEs. Fixed in 14.3.0-tuxcare.12...
PT-2026-124764
TuxCare rebuilt @angular/router to address 1 CVE. Fixed in 8.0.3-tuxcare.3...
PT-2026-115882
When an HTTP server handler sends a 2xx response to an HTTP/1 CONNECT request and returns without hijacking the connection, the server improperly continues to read and serve requests from the connection. Since a 2xx response to an HTTP/1 CONNECT converts the connection into a tunnel, the server...
PT-2026-115889
HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because the server modifies the HPACK encoder from two goroutines without synchronization: one uses the encoder to encode a HEADERS frame as part of a response sent to a client and the...
PT-2026-115885
Previously, a user operating inside of a malicious Go project that defines a bogus golang.org/toolchain go.sum entry and operates a malicious GOMODPROXY the user chooses to use can bypass the intended checksum. We now ensure that golang.org/toolchain always goes to the network for the canonical...
PT-2026-124906
TuxCare rebuilt @angular/router to address 3 CVEs. Fixed in 13.4.0-tuxcare.11...
PT-2026-124911
TuxCare rebuilt @angular/router to address 3 CVEs. Fixed in 13.3.11-tuxcare.5...
PT-2026-124892
TuxCare rebuilt @angular/router to address 5 CVEs. Fixed in 19.2.25-tuxcare.1...
PT-2026-124762
TuxCare rebuilt @angular/router to address 1 CVE. Fixed in 16.2.12-tuxcare.10...
PT-2026-124024
TuxCare rebuilt @angular/animations to address 1 CVE. Fixed in 11.2.0-tuxcare.7...
PT-2026-125575
TuxCare rebuilt axios to address 4 CVEs. Fixed in 1.16.0-tuxcare.3...
PT-2026-123981
TuxCare rebuilt @angular/animations to address 3 CVEs. Fixed in 15.2.1-tuxcare.4...
PT-2026-124027
TuxCare rebuilt @angular/animations to address 1 CVE. Fixed in 8.2.14-tuxcare.14...
PT-2026-125585
TuxCare rebuilt @babel/plugin-transform-runtime to address 1 CVE. Fixed in 7.23.2-tuxcare.2...
PT-2026-124028
TuxCare rebuilt @angular/animations to address 1 CVE. Fixed in 12.0.0-tuxcare.7...
PT-2026-124004
TuxCare rebuilt @angular/animations to address 1 CVE. Fixed in 18.2.12-tuxcare.8...
PT-2026-124030
TuxCare rebuilt @angular/animations to address 1 CVE. Fixed in 12.2.16-tuxcare.7...
PT-2026-125563
TuxCare rebuilt 2 packages to address 2 CVEs. Fixed in 17.2.0-tuxcare.1...
PT-2026-124397
TuxCare rebuilt @babel/parser to address 1 CVE. Fixed in 7.18.9-tuxcare.3...
PT-2026-123990
TuxCare rebuilt @angular/animations to address 3 CVEs. Fixed in 17.1.0-tuxcare.6...
PT-2026-125564
TuxCare rebuilt svgo to address 3 CVEs. Fixed in 2.8.2-tuxcare.1...
PT-2026-124037
TuxCare rebuilt @angular/animations to address 1 CVE. Fixed in 15.2.6-tuxcare.7...
PT-2026-124032
TuxCare rebuilt @angular/animations to address 1 CVE. Fixed in 13.4.0-tuxcare.12...
PT-2026-124010
TuxCare rebuilt @angular/animations to address 1 CVE. Fixed in 6.0.1-tuxcare.8...
PT-2026-125574
TuxCare rebuilt axios to address 2 CVEs. Fixed in 1.18.1-tuxcare.2...