414381 matches found
PT-2026-121786
The "ASMobile" web interface, which is part of the VertiGIS software package "GIS Portal", allows authenticated users to define a business reference. JavaScript code can be inserted into this field. On its own this only affects the user who entered it self-XSS. However, the business reference is...
PT-2026-121814
LoadPublicKey resolved an EC key's curve with an unchecked type assertion, algToOptsMapalg.ECDSAOptions. A JWK declaring "kty":"EC" together with a non-EC "alg" — which RFC 7517 §4.4 permits — reaches that assertion and panics...
PT-2026-121747
OpenStack Ironic before 39.0.1 sometimes allows a user to change the maintenance setting on a node via PATCH to /v1/nodes/ident - in other words, not using the specific maintenance endpoint...
PT-2026-121744
Part-DB is an open source inventory management system for electronic components. Prior to version 2.12.1, the part attachment upload handler stores uploaded files under the web-served media directory using the client-supplied file extension, and its extension blocklist does not include phar...
PT-2026-121750
Part-DB is an open source inventory management system for electronic components. Prior to version 2.12.3, Part-DB-server sanitizes SVG files based solely on the user-controlled filename extension rather than actual file content type. An authenticated attacker can upload a malicious SVG with...
PT-2026-122427
Summary Wasmtime may panic when the host lowers a component model stream or future into a guest, if the host created that stream or future with one payload type and the guest expects a different one. This can happen when an embedder creates a stream or future, passes it through a guest, receives ...
PT-2026-121745
Part-DB is an open source inventory management system for electronic components. Prior to version 2.12.1, the file .env committed in the Part-DB repository contains a fixed value for APP SECRET a03498528f5a5fc089273ec9ae5b2849. The official Docker image jbtronics/part-db1 does not override or...
PT-2026-122417
Summary An unbounded-buffer vulnerability CWE-770 in the Twisted words IRC server lets any unauthenticated remote client exhaust server memory. twisted.words.protocols.irc.IRC.dataReceived appends every received byte to a per-connection buffer and only removes data at a line feed, with no maximum...
PT-2026-122441
Summary An incomplete header-value validation CWE-444 in the Twisted HTTP server lets a bare carriage return or line feed in a header value hide a following header from the parser. twisted.web.http.HTTPChannel.headerReceived rejects a NUL byte in a header value but not a bare CR or LF, even thoug...
PT-2026-122908
These are all security issues fixed in the go1.27-1.27.3-1.1 package on the GA media of openSUSE Tumbleweed...
PT-2026-122240
Name of the Vulnerable Software and Affected Versions serialize-javascript versions prior to 7.1.3 Description The software fails to properly neutralize a bare closing-script prefix when the source text of a function ends exactly with that prefix. Because function bodies are escaped independently...
PT-2026-122203
This is a solid Metasploit release cycle. The Langflow coverage is the headline here—six modules targeting a single LLM workflow builder is unusual and signals that tooling is becoming a prime attack surface. Technical Breakdown Langflow CVE-2026-93680, CVE-2026-0768, CVE-2026-0769, CVE-2026-1013...
PT-2026-121954
In the Linux kernel, the following vulnerability has been resolved: namespace: handle mount locking for automounts correctly If mounts are propagated across user namespaces, attach recursive mnt locks every copy of the source mount to protect overmounts from vanishing and revealing the underlying...
PT-2026-122241
The app/process-api-response-headers action accepts fake Craft API response headers from any authenticated control panel user. A non-admin user with only accessCp can place newline characters in X-Craft-Plugin-Licenses. Craft passes this value to its .env writer without removing the newlines. Thi...
PT-2026-122244
Name of the Vulnerable Software and Affected Versions Postiz affected versions not specified Description Postiz allows signed-in users to request the backend to execute functions on connected channels without restricting which functions can be called. This allows users to trigger internal helper...
PT-2026-122436
Impact An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires cross-reference streams with repeated malformed cross-reference streams. Patches This has been fixed in pypdf==6.21.2. Workarounds If you cannot upgrade yet, consider applying the changes fr...
PT-2026-122918
These are all security issues fixed in the libopenscap33-1.4.6-1.1 package on the GA media of openSUSE Tumbleweed...
PT-2026-121830
The Advanced Custom Fields: Extended and Advanced Custom Fields: Extended PRO WordPress plugins from 0.9.2.4 to 0.9.2.7 do not consistently disable shortcode processing in the confirmation message of their front-end forms, allowing unauthenticated visitors to have arbitrary shortcodes executed...
PT-2026-122924
These are all security issues fixed in the tomcat10-10.1.61-1.1 package on the GA media of openSUSE Tumbleweed...
PT-2026-122455
Several issues have been discovered in the Marshal module: ANT-2026-K7NTK0FT Stale obj counter across unmarshal calls enables null/freed intern obj table indexing ANT-2026-2NJYQWEX Custom block size wraparound in CODE CUSTOM LEN allocation ANT-2026-PJC00M7X Unmarshaler accepts forged Closure tag...
PT-2026-122150
A flaw in Node.js Permission Model filesystem enforcement can grant access to paths that do not match a wildcard --allow-fs-read or --allow-fs-write rule. When the requested path is shorter than the prefix of a wildcard grant, the radix tree lookup stops comparing early and treats the path as a...
PT-2026-121887
Name of the Vulnerable Software and Affected Versions PHP affected versions not specified Description An issue exists that could allow remote code execution. This occurs in applications with a specific configuration where the session serialize handler is changed to php binary or php serialize, th...
PT-2026-122901
These are all security issues fixed in the brotli-1.2.1-1.1 package on the GA media of openSUSE Tumbleweed...
PT-2026-122120
GFI Archiver before 15.14 contains a stored cross-site scripting vulnerability in the MailInsights scheduled report configuration that allows authenticated attackers to inject arbitrary web script or HTML via the report name parameter to /Archiver/MailInsights.aspx. The injected payload is stored...
PT-2026-122208
A security flaw has been discovered in Tenda F6 12.02.01.73. This impacts an unknown function of the component Web Management Interface. Performing a manipulation results in cross-site request forgery. The attack may be initiated remotely. The exploit has been released to the public and may be us...
PT-2026-120954
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a CSS scoping bypass in HTML messages. rcube utils::mod css styles did not treat an at-rule prologue such as @layer a; as a selector boundary, and did not handle selectors beginning with ::, so selectors following an at-rule we...
PT-2026-120957
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability. rcmail sendmail stripped newline characters only from the Subject and Organization headers, leaving other header values taken from request parameters unsanitized, so a remote authenticated...
PT-2026-121424
draw.io Desktop is the official Electron build of draw.io. Prior to 31.4.4, draw.io Desktop is vulnerable to arbitrary local-file disclosure through the Electron main process's read-side IPC handlers. The readFile, getFileDrafts, getBkpFile, fileStat, isFileWritable, checkFileExists, and watchFil...
PT-2026-121336
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in ACF Extended ACF Extended acf-extended allows Stored XSS.This issue affects ACF Extended: from n/a through 0.9.2.7...
PT-2026-121262
NT OneAPP developed by NewType Infortech has an Authentication Bypass vulnerability. Unauthenticated local attackers can bypass the App PIN lock mechanism via a Deep Link, thereby accessing protected resources of a logged-in user...
PT-2026-121494
The Agent Zero Web UI before 1.15 does not correctly sanitize user-provided input in chat messages or file uploads. When Agent Zero reproduces content in the chat interface, any injected JavaScript is executed in the context of the victim’s authenticated Agent Zero Web UI session...
PT-2026-120931
Traefik v3.7.13 before v3.7.14 contains an access-control bypass in the Kubernetes Ingress NGINX provider, where the HTTP router generated for ssl-passthrough Ingresses on non-TLS entry points never applies the Ingress's access-control annotations. Unauthenticated attackers reaching the HTTP entr...
PT-2026-121539
OpenBao before 2.6.4 and 2.7.x before 2.7.1 contains a flaw in its rate limit quota subsystem where role resolution fails for requests with form-encoded bodies or forwarded certificates, so quota rules scoped to backend-specific roles are not enforced. Valid callers can repeatedly issue tokens...
PT-2026-120940
Grav Login plugin from 3.6.0 before 3.9.13 contains a missing authorization vulnerability in the login.invite task that allows page authors to obtain super user accounts. Attackers can define an invitation form granting super access in page frontmatter, submit it unauthenticated, and register the...
PT-2026-121493
Missing authorization in the unit resources download route in Canonical Juju 4.0 through 4.0.15 allows a controller-authenticated principal a unit agent, or a user with only login permission to read any application's charm resource in any model, including container-registry credentials, via a...
PT-2026-120944
Obot before 0.26.0 contains an authentication bypass vulnerability in the CLI login flow that allows unauthenticated attackers to steal API keys by choosing token request IDs. Attackers can create a token request via POST /api/token-request, send the login link to a signed-in user, and fetch the...
PT-2026-121406
CleanShot X for macOS insecurely deserializes untrusted data embedded in a .cleanshot project file editable screenshot annotations. Exploitation requires an attacker to craft a malicious .cleanshot file, deliver it to the target, and have the target open it; the payload then executes automaticall...
PT-2026-120935
Traefik from v3.7.0 before v3.7.14 contains an authentication bypass vulnerability in its Kubernetes Ingress-NGINX provider that forwards client-supplied Ssl-Client- headers on the plaintext HTTP router. When ssl-redirect is disabled alongside auth-tls-pass-certificate-to-upstream, unauthenticate...
PT-2026-121394
In EmberZNet 9.1.1 and earlier, a malformed Publish Billing Period command can result in a recursive function call that will never reach its end condition. These messages must come from a device that has already joined the network. Only devices supporting the Price Cluster are impacted...
PT-2026-121393
In EmberZNet 9.1.1 and earlier, a malformed Discover Attributes command can result in a loop with unreachable exit condition infinite loop. These messages must come from a device that has already joined the network. Only devices supporting manufacturer-specific clusters are impacted...
PT-2026-121376
Broadstreet Ad Widget plugin for WordPress 2.2.0 before 2.12.0 contains a local file inclusion vulnerability that allows authenticated users to execute attacker-chosen PHP files by passing unsanitized input to require in views/modal/index.php. Attackers can supply directory traversal sequences in...
PT-2026-121396
In EmberZNet 9.1.1 and earlier, a malformed GetGroupMembership message can result in an out-of-bounds write leading to a crash. A limited number of values can be written using this vulnerability, so no route to remote code execution was observed. These messages must come from a device that has...
PT-2026-121277
The WebP Express WordPress plugin before 0.25.16 does not escape values that its bundled HTML parser re-emits into element attributes when a non-default image delivery mode is enabled, allowing unauthenticated users to submit content that is stored and later executed as Cross-Site Scripting in th...
PT-2026-121316
A cleartext storage of sensitive information vulnerability in WatchGuard Endpoint Security's Full Disk Encryption feature for macOS allows a local, unprivileged user or process to obtain a managed computer's FileVault Personal Recovery Key by reading a persistently written diagnostic log file lef...
PT-2026-121654
No description provided...
PT-2026-121653
No description provided...
PT-2026-121652
No description provided...
PT-2026-121650
No description provided...