PT-2026-69510

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the drm/amdgpu/sdma4.4.2 component where the use of the BUG ON function can cause the kernel to crash unnecessarily in certain cases. The BUG ON function is a kernel...

PT-2026-69556

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in libceph where ceph x create authorizer caches the iov base and iov len of the authorizer buffer within the ceph auth handshake structure. When ceph x update authorizer...

PT-2026-69863

Name of the Vulnerable Software and Affected Versions Discourse versions prior to 2026.1.6 Discourse versions prior to 2026.5.2 Discourse versions prior to 2026.6.1 Discourse versions prior to 2026.7.0 Description An unauthenticated user can retrieve restricted tag names and descriptions through...

PT-2026-69944

Name of the Vulnerable Software and Affected Versions Dokploy versions prior to 0.29.13 Description Dokploy, a self-hostable Platform as a Service PaaS, contains a flaw that allows an authenticated user to execute arbitrary commands on a local or SSH-connected target server. This occurs because t...

PT-2026-69869

Name of the Vulnerable Software and Affected Versions Discourse versions prior to 2026.1.6 Discourse versions prior to 2026.5.2 Discourse versions prior to 2026.6.1 Discourse versions prior to 2026.7.0 Description The discourse-local-dates plugin renders crafted local-date format data as HTML. Th...

PT-2026-69369

Name of the Vulnerable Software and Affected Versions FoodBoxBooker versions prior to 1.0.8 Description An issue exists where the plugin fails to verify if the user account being updated belongs to the user initiating the request. This allows authenticated users with Subscriber-level access or...

PT-2026-69534

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the ptp s390 component of the Precision Time Protocol PTP implementation. The system fails to perform a necessary facility check, which should ensure that the physical...

PT-2026-69425

Name of the Vulnerable Software and Affected Versions Fabrik versions prior to 4.6.9 Description An unauthenticated attacker can execute arbitrary code by leveraging the ajax calc feature within the calc plugin. Recommendations Update to version 4.6.9 or later. As a temporary workaround, restrict...

PT-2026-69987

Name of the Vulnerable Software and Affected Versions Rocket.Chat versions prior to 7.10.14 Rocket.Chat versions prior to 8.0.8 Rocket.Chat versions prior to 8.1.7 Rocket.Chat versions prior to 8.2.7 Rocket.Chat versions prior to 8.3.7 Rocket.Chat versions prior to 8.4.5 Rocket.Chat versions prio...

PT-2026-69986

Name of the Vulnerable Software and Affected Versions AnythingLLM versions 1.0.0 through 1.15.0 Description The unauthenticated account-recovery flow in the server/utils/PasswordRecovery/index.js file uses the recoverAccount function to deduplicate recoveryCodes values before they are trimmed. Th...

PT-2026-69978

Name of the Vulnerable Software and Affected Versions ERPNext versions prior to 15.112.0 ERPNext versions prior to 16.22.0 Description Authenticated users with limited privileges can modify protected data beyond their assigned roles because certain functions omit required write permission checks...

PT-2026-69976

Name of the Vulnerable Software and Affected Versions ERPNext versions prior to 15.109.0 ERPNext versions prior to 16.20.0 Description An authenticated low-privilege user can perform SQL injection to extract sensitive information. This occurs because the get tax template function in...

PT-2026-69885

Name of the Vulnerable Software and Affected Versions use-reducer-async affected versions not specified Description Malicious commits were introduced into the default branch of the repository, which executed remote attacker-controlled code on developer workstations during the npm install process...

PT-2026-69540

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the af iucv component. The system queues not-yet-received message notifications on iucv-message q, which hold raw pointers to the connection's iucv path...

PT-2026-69868

Name of the Vulnerable Software and Affected Versions Discourse versions prior to 2026.1.7 Description An authenticated user can submit specially formed URLs to bypass the Onebox allowlist, which allows the embedding of malicious content within a site. Onebox is a feature that expands URLs into...

PT-2026-69328

Name of the Vulnerable Software and Affected Versions SourceCodester Simple Doctors Appointment System version 1.0 Description A SQL injection flaw exists that allows remote attackers to manipulate the ID argument. This issue occurs within an unknown function in the '/admin/ajax.php?action=set...

PT-2026-69480

Name of the Vulnerable Software and Affected Versions Jenkins Project Jenkins versions prior to LTS 2.555.3 Description An incomplete patch allows an authenticated remote attacker with Item/Configure permission to read arbitrary files on the Jenkins controller filesystem. The issue exists because...

PT-2026-69882

Name of the Vulnerable Software and Affected Versions Dokploy versions prior to 0.29.9 Description An issue exists where the application fails to verify if the destination.organizationId matches the ctx.session.activeOrganizationId when processing requests. This allows an authenticated member wit...

PT-2026-69528

Name of the Vulnerable Software and Affected Versions Linux kernel version 7.1.0-rc1 Description An issue exists in the ice parser profile init function where the system fails to validate the ptype value provided through VIRTCHNL. Because the set bit operation uses a bitmap with a maximum size of...

PT-2026-69936

Name of the Vulnerable Software and Affected Versions Dokploy versions prior to 0.28.9 Description Dokploy is a free, self-hostable Platform as a Service PaaS. An authenticated user with permissions to create or update file mounts for a service can inject shell metacharacters into the filePath...

PT-2026-69925

Name of the Vulnerable Software and Affected Versions TBEA TLogger version 2.1.0.0B0.0.0.0 Description A hard-coded or default root account credential allows an unauthenticated remote attacker to gain root-level access to the device through the exposed SSH service. The root password can be...

PT-2026-69519

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the construction of standalone TCP responses using TCP-AO TCP Authentication Option options. The functions tcp v4 send ack and tcp v6 send response create responses...

PT-2026-69909

Name of the Vulnerable Software and Affected Versions Dokploy versions prior to 0.29.13 Description Dokploy is a self-hostable Platform as a Service PaaS. A shell injection flaw exists in the apps/dokploy/server/api/routers/destination.ts file where the destination.testConnection mutation...

PT-2026-69544

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the pep get sb function. The problem occurs because pep get sb does not account for the possibility that pskb may pull might relocate the socket buffer s...

PT-2026-69943

Name of the Vulnerable Software and Affected Versions Dokploy versions prior to 0.29.13 Description Dokploy is a self-hostable Platform as a Service PaaS that allows an authenticated low-privilege member to execute arbitrary commands on the control-plane host. The issue occurs because the...

PT-2026-69875

Name of the Vulnerable Software and Affected Versions Pega Platform versions 8.5.0 through 25.1.2 Description Improper validation of cryptographic signatures may allow an attacker to bypass security controls. Recommendations At the moment, there is no information about a newer version that contai...

PT-2026-69514

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the drm/amdgpu/gfx12.1 component where the use of the BUG ON function can cause the kernel to crash unnecessarily in certain cases. The BUG ON function is a kernel...

PT-2026-69893

Name of the Vulnerable Software and Affected Versions GIMP affected versions not specified Description A flaw exists in the file format plugins, specifically those handling PSD and PAA files. A remote attacker can exploit this by tricking a user into opening a specially crafted image file, which...

PT-2026-69964

Name of the Vulnerable Software and Affected Versions Feast affected versions not specified Description Improper deserialization of user-defined functions UDFs stored in the registry, which are serialized using the dill library, allows for arbitrary code execution. In default configurations, a...

PT-2026-69961

Name of the Vulnerable Software and Affected Versions Feast affected versions not specified feast-operator affected versions not specified Description Feast and feast-operator use a default configuration of "no auth", which means no security manager is installed. This allows unauthenticated and...

PT-2026-69509

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the drm/amdgpu/sdma7.1 component where the use of the BUG ON function can cause the kernel to crash unnecessarily in certain cases. The BUG ON function is a kernel...

PT-2026-69635

Name of the Vulnerable Software and Affected Versions Linux kernel versions 6.19 through 7.1.3 Description An issue exists in the drm/amd/display component on DCE8-class ASICs. When assigning a stream encoder for a second DisplayPort MST stream, the function dce100 find first free match stream en...

PT-2026-69512

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the drm/amdgpu/gfx9.4.3 component where the use of the BUG ON function can cause the kernel to crash unnecessarily in certain cases. The fix involves replacing BUG ON...

PT-2026-69649

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the drm/amdgpu/sdma5.0 component where the use of the BUG ON function can cause the kernel to crash unnecessarily in certain cases. The fix involves replacing BUG ON...

PT-2026-69344

Name of the Vulnerable Software and Affected Versions Autopay WordPress plugin versions prior to 5.0.1 Description An issue exists where the software fails to perform capability or nonce checks before saving a styling option from a public request. Additionally, the saved value is not escaped when...

PT-2026-69842

Name of the Vulnerable Software and Affected Versions Python affected versions not specified Description Attacker-controlled CSV samples can trigger super-linear regular-expression work during dialect sniffing, leading to significant CPU consumption when applications pass unbounded input to the...

PT-2026-69267

Name of the Vulnerable Software and Affected Versions Nexter Blocks versions prior to 5.0.2 Description Insufficient access control in a REST endpoint allows users with the Contributor role or higher to save arbitrary global CSS. This stored CSS is rendered site-wide on the front end, which can...

PT-2026-69312

Name of the Vulnerable Software and Affected Versions PV-Bhat gemsuite-mcp version 1.0.0 Description A path traversal issue exists within the gemini search/gemini reason/gemini process/gemini analyze component, specifically in the src/handlers/unified-gemini.ts file. A local attacker can exploit...

PT-2026-69297

Name of the Vulnerable Software and Affected Versions MingSoft MCMS versions prior to 3.0.7 Description A remote information disclosure issue exists within the ms-mdiy component. The flaw is located in an unknown function of the '/mdiy/form/data/list' endpoint, allowing a remote attacker to...

PT-2026-69278

Name of the Vulnerable Software and Affected Versions adenot mcp-google-search versions prior to 0.3.2 Description A server-side request forgery SSRF issue exists within the read webpage component in the src/index.ts file. This occurs when the url argument is manipulated, allowing for local...

PT-2026-69256

Name of the Vulnerable Software and Affected Versions NellyW8 MCP4EDA version 1.0.0 Description Command injection is possible within the run openlane/view waveform component. This occurs when the design name/vcd file argument is manipulated. Local access is required to execute this attack...

PT-2026-69259

Name of the Vulnerable Software and Affected Versions Jane-xiaoer skill-vision-control versions prior to 1.3.1 Description A path traversal issue exists in the getSkillVersionsDir function within the src/svc/utils/config.ts file. This occurs when the skillName argument is manipulated, allowing an...

PT-2026-69283

Name of the Vulnerable Software and Affected Versions code-projects Task Management System version 1.0 Description An improper authentication issue exists within the Login component in the /index.php file. A remote attacker can bypass authentication by manipulating the Password argument...

PT-2026-69305

Name of the Vulnerable Software and Affected Versions lmammino oidc-authorizer versions prior to 0.4.1 Description The Lambda Authorizer component contains an issue where raw Authorization header values and complete bearer tokens or JWTs are logged on authentication failure paths, potentially...

PT-2026-69318

Name of the Vulnerable Software and Affected Versions PhialsBasement KoboldCPP-MCP-Server version 1.0.0 Description A server-side request forgery SSRF issue exists within the BaseConfigSchema component in the src/index.ts file. The flaw occurs in the makeRequest function, where manipulation of th...

PT-2026-69321

Name of the Vulnerable Software and Affected Versions Uasoft Badaso version 3.0.0-alpha Description A permission issue exists within the File API component, specifically affecting the ApiRequest::class function in the src/Routes/api.php file. This flaw allows a remote attacker to manipulate the...

PT-2026-69292

Name of the Vulnerable Software and Affected Versions dresende node-sql-query versions 0.1.25 through 0.1.28 Description A SQL injection issue exists in the Request Parameter Handler component within the lib/Select.js library. The flaw is located in the SelectQuery.from and SelectQuery.build...

PT-2026-69251

Name of the Vulnerable Software and Affected Versions aktsmm skill-ninja-mcp-server version 0.1.0 Description Local manipulation of the workspacePath argument in the getInstalledSkills, installSkill, updateAgentsMd, and uninstallSkill functions within the src/installer.ts file allows for path...

PT-2026-69266

Name of the Vulnerable Software and Affected Versions Create WordPress plugin versions prior to 2.5.4 Description An authorization check is missing before returning content over a REST API route. As a side effect, this route publishes the requested content, which allows unauthenticated attackers ...

PT-2026-69268

Name of the Vulnerable Software and Affected Versions WP Photo Album Plus versions prior to 9.2.07.002 Description The plugin fails to perform capability or nonce checks on a public REST endpoint action. This allows unauthenticated users to delete generated album export ZIP archives stored by the...