200724 matches found
PT-2026-67572
A vulnerability was detected in GL.iNet GL-MT3000 up to 4.4.5. The affected element is the function nas-web.add user of the file /cgi-bin/glc of the component nas-web RPC Wrapper. Performing a manipulation results in command injection. The attack can be initiated remotely. The exploit is now publ...
PT-2026-67806
Name of the Vulnerable Software and Affected Versions Flowise versions prior to 3.1.3 Description The CSVAgent component interpolates a segment of the csvFile data URI directly into a Python source-code template executed by Pyodide. Because Pyodide is loaded with a default JavaScript bridge to...
PT-2026-67789
Name of the Vulnerable Software and Affected Versions Amazon Bedrock AgentCore affected versions not specified Description Insufficient input validation in the AgentCore harness may allow an authenticated remote user to execute configured tools. This is achieved by using crafted content blocks in...
PT-2026-67640
A code injection vulnerability exists in the LINE Android app prior to version 26.7.2. The profile rendering component does not adequately validate or sandbox externally supplied script content embedded in profile templates. As a result, an attacker who is able to place crafted content in a profi...
PT-2026-67669
In the Linux kernel, the following vulnerability has been resolved: KVM: nVMX: Hide shadow VMCS right after VMCLEAR free nested frees the shadow VMCS while vmcs01 still points to it. But because it is asynchronous with respect to loaded vmcs clear, the vCPU might migrate before the pointer is...
PT-2026-67642
A flaw was found in popt, a command-line option parsing library. An off-by-one error in the poptStuffArgs function, when repeatedly called by a host application or through deep alias nesting, can lead to corruption of internal program data. This corruption could potentially enable a local attacke...
PT-2026-67863
Name of the Vulnerable Software and Affected Versions Ghost versions 5.26.0 through 6.54.0 Description The Universal Import feature in Ghost Admin fails to properly sanitize imported content, which leads to Cross-Site Scripting XSS within post content. XSS is a security flaw where malicious scrip...
PT-2026-67884
Name of the Vulnerable Software and Affected Versions Ghost versions 0.10.0 through 6.54.0 Description A Server-Side Request Forgery SSRF exists in the Ghost Admin image fetching feature. This allows any user with staff-level privileges to execute blind HTTP GET requests against internal hosts...
PT-2026-67570
Time-of-check time-of-use TOCTOU vulnerability combined with missing input validation in Caliptra Core ROM UpdateResetFlow::run in subsystem mode allows a compromised local attacker to silently bypass secure boot by supplying an AXI staging address that is not validated against the strap-configur...
PT-2026-67674
The product firmware contains an embedded, static RSA private key utilized by the Lighttpd web server for TLS termination. Exposure of this private key allows malicious actors to breach the confidentiality and integrity of HTTPS communications, enabling traffic decryption and server spoofing...
PT-2026-67670
In the Linux kernel, the following vulnerability has been resolved: rhashtable: clear stale iter-p on table restart rhashtable walk start check has two restart paths when resuming a walk. When iter-walker.tbl is valid, it re-validates iter-p against the table and sets iter-p = NULL if the object ...
PT-2026-67681
Observable response discrepancy vulnerability in Bilin Software and Informatics Consultancy Inc. HUMANIST Digital Human Resources allows Account Footprinting. This issue affects HUMANIST Digital Human Resources: from 26.0 before 26.1...
PT-2026-67638
A vulnerability was determined in diaowen DWSurvey up to 6.14.0. The affected element is an unknown function of the file /api/dwsurvey/app/survey/up-survey-status.do of the component Survey Status Handler. This manipulation causes improper authorization. The attack may be initiated remotely. The...
PT-2026-67659
The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.16.11 does not sanitise and escape some of its Podcast Episode settings, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks even when the unfiltered html capability is...
PT-2026-67664
The REST API Log WordPress plugin before 1.7.1 does not bind the token protecting its log download feature to the log entry being requested, nor does it check the capability of the requester, allowing unauthenticated users in possession of any such token to download the logged REST API requests a...
PT-2026-67874
Name of the Vulnerable Software and Affected Versions Ghost versions prior to 6.54.1 Description Staff-level users can leak the hashed passwords of other staff members through the Ghost Admin API. This could allow an attacker to perform an offline password-guessing attack to potentially take over...
PT-2026-67887
Name of the Vulnerable Software and Affected Versions Ghost versions 2.2.0 through 6.54.0 Description Ghost Admin fails to invalidate existing sessions during the login process, which could enable session fixation attacks. Session fixation is a method where an attacker provides a valid session...
PT-2026-67676
The background service of ABP or AES runs as NT AUTHORITYSYSTEM and implements a file-based inter-process communication IPC mechanism protected by AES encryption. Because the encryption key file is readable by standard users and protected using DPAPI. Any authenticated local user can recover the...
PT-2026-67678
Unrestricted upload of file with dangerous type vulnerability in Bilin Software and Informatics Consultancy Inc. HUMANIST Digital Human Resources allows Upload a Web Shell to a Web Server. This issue affects HUMANIST Digital Human Resources: from 26.0 before 26.1...
PT-2026-67662
The Simple Google Calendar Outlook Events Widget WordPress plugin before 3.1.0 does not validate a user-supplied URL before performing a server-side request, allowing unauthenticated attackers to perform Server-Side Request Forgery attacks and, in some cases, read the response of the internal...
PT-2026-67631
A path traversal flaw was found in WildFly's domain mode implementation. The LocalFileRepository.getFile and getConfigurationFile methods in wildfly-core/deployment-repository do not validate that the resolved file path remains within the configured repository or configuration root directories. A...
PT-2026-67650
The Database for Contact Form 7, WPforms, Elementor forms WordPress plugin before 1.5.5 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL Injection exploitable by users granted a specific capability which is limited to administrators by default...
PT-2026-67741
Name of the Vulnerable Software and Affected Versions WLAN Firmware affected versions not specified Description A buffer over-read occurs when processing a short target wake time channel usage response frame that has an insufficient packet size, leading to a transient Denial of Service DOS. A...
PT-2026-67886
Name of the Vulnerable Software and Affected Versions Ghost versions 0.10.0 through 6.54.0 Description A path traversal issue in custom themes allows a staff user to write files outside of the uploads directory. This occurs due to improper theme storage name handling in LocalStorageBase, which...
PT-2026-67649
The Paid Membership Subscriptions WordPress plugin before 3.0.8 does not verify that the subscription being modified through its change-subscription checkout belongs to the current user, allowing any authenticated user with Subscriber-level access and above to take over another member's...
PT-2026-67667
The Create Block WordPress plugin before 2.10.0 does not correctly escape user-supplied text before writing it into a generated PHP pattern file, allowing a multisite subsite administrator who holds the capability gating this action but is denied the capability that normally gates PHP file editin...
PT-2026-67680
Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Bilin Software and Informatics Consultancy Inc. HUMANIST Digital Human Resources allows Path Traversal. This issue affects HUMANIST Digital Human Resources: from 26.0 before 26.1...
PT-2026-67641
A flaw was found in the backchannel logout endpoint of the keycloak-services component, which is part of the Red Hat Build of Keycloak. This component handles authentication and session management for applications. The issue occurs when an OIDC identity provider is configured to skip signature...
PT-2026-67713
Name of the Vulnerable Software and Affected Versions stunnel affected versions not specified Description A stack-based out-of-bounds read occurs in the s vlog function when processing oversized log messages using vsnprintf. A remote attacker with network access can provide protocol inputs that...
PT-2026-67672
In the Linux kernel, the following vulnerability has been resolved: Input: ims-pcu - fix heap-buffer-overflow in ims pcu process data The ims pcu process data processes incoming URB data byte by byte. However, it fails to check if the read pos index exceeds IMS PCU BUF SIZE. If a malicious USB...
PT-2026-67488
ClearOS 7.9 contains an OS command injection vulnerability in the Log Viewer component that allows authenticated attackers to execute arbitrary commands by submitting unsanitized input through the filter parameter, which is interpolated directly into a shell command in File.php. Attackers can...
PT-2026-67465
osTicket v1.18.3 is vulnerable to Stored Cross-Site Scripting XSS via the email From-header display name. The value is extracted without sanitization in include/class.mailparse.php and stored raw in the poster field of ost thread entry. When an unauthenticated attacker sends a reply email to an...
PT-2026-67454
Dell Monitor driver, version 1.0.0.0, contains an Improper Link Resolution Before File Access 'Link Following' vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privileges...
PT-2026-67172
In TFA, there is a possible information disclosure due to a missing permission check. This could lead to local information disclosure if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11053160; Issue ID: MSV-8004...
PT-2026-67420
XML::Sig versions before 0.71 for Perl allow XPath injection in ID lookup. verify and get signed xml in lib/XML/Sig.pm build XPath expressions by concatenating the SignedInfo/Reference/@URI value read from the document being verified. The value is neither escaped nor checked against the NCName...
PT-2026-67502
A prompt injection vulnerability in the shell tool in Amazon Strands Agents Tools before 0.8.0 might allow remote actors to execute arbitrary operating system commands on the agent's host via a crafted prompt that sets the non interactive parameter to true, bypassing the human consent gate. To...
PT-2026-67554
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network...
PT-2026-67561
Time-of-check time-of-use toctou race condition in Microsoft Edge Chromium-based allows an unauthorized attacker to disclose information over a network...
PT-2026-67521
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.3, an out-of-bounds heap read could occur in the C response parser while building an error message for a malformed response. An attacker controlled server, or possibly an accidental response, could trigg...
PT-2026-67496
Name of the Vulnerable Software and Affected Versions Apache NiFi versions 2.0.0 through 2.10.0 Description Apache NiFi allows the creation, reading, and deletion of Assets associated with Parameter Contexts via the REST API. The framework authorizes asset deletion using the provided Parameter...
PT-2026-67549
Adobe Campaign Classic ACC is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker could exploit this vulnerability to gain elevated privileges. Exploitation of this issue does not require user interaction...
PT-2026-67117
The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.9 does not verify product ownership on its product-attribute REST write endpoints, allowing users with a Dokan vendor account to modify the product attributes and default attributes of any other vendor'...
PT-2026-67161
In display, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11019722; Issue ID: MSV-7759...
PT-2026-67113
The sm page duplicator WordPress plugin through 1.0.0 does not sanitise and escape a stored value before using it in a SQL statement when duplicating a page, allowing users with the Editor role and above to perform SQL Injection attacks...
PT-2026-67565
Origin validation error in Microsoft Edge Chromium-based allows an unauthorized attacker to disclose information over a network...
PT-2026-67558
Missing authorization in Microsoft Edge Chromium-based allows an unauthorized attacker to perform tampering locally...
PT-2026-67115
The Academy LMS WordPress plugin before 3.8.3 does not verify course enrollment or lesson publication status when returning a single lesson through its REST API, allowing users with a self-service student Subscriber-level account to disclose the content of arbitrary lessons, including lessons of...
PT-2026-67399
Telenia Software TVox 26.5.3 and prior 26.x versions, and 24.9.21 and prior 24.x versions, contain an authentication bypass vulnerability in set env.php where the redirectToLoginAdminIRequestHaveAccessToken function derives the current page name from PHP SELF and skips authentication when the val...
PT-2026-67043
The SoftMarket — Digital Marketplace WordPress plugin through 1.0.0 does not properly validate an authentication token in one branch of its email-verification flow, allowing unauthenticated attackers to obtain a valid session as any verified user by supplying only that user's ID...