PT-2026-66489

When Calico's shared debug server is enabled disabled by default, the Calico kube-controllers and Goldmane components bind their Go pprof debug listener to 0.0.0.0 without authentication. Any pod with network reachability to the listener can retrieve the process heap, goroutine stacks including...

PT-2026-66434

Name of the Vulnerable Software and Affected Versions Phoenix Contact CHARX SEC-3150 affected versions not specified Description A privilege escalation issue exists in the init-script for user-applications. This flaw allows a low-privileged local user to execute arbitrary commands with root...

PT-2026-66572

Juggle through 1.6.0 contains a remote code execution vulnerability that allows unauthenticated remote attackers to execute arbitrary OS commands by connecting to the exposed H2 database web console using default shipped credentials. Attackers can access the unprotected /h2-console endpoint,...

PT-2026-66537

Name of the Vulnerable Software and Affected Versions IBM Verify Identity Access versions 11.0 through 11.0.2 IBM Security Verify Access versions 10.0 through 10.0.9.1 IBM Verify Identity Access Container versions 11.0 through 11.0.2 IBM Security Verify Access Container versions 10.0 through...

PT-2026-66268

Uninitialized Use in GPU in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. Chromium security severity: Low...

PT-2026-66100

Inappropriate implementation in Extensions in Google Chrome prior to 151.0.7922.72 allowed an attacker who convinced a user to install a malicious extension to leak cross-origin data via a crafted Chrome Extension. Chromium security severity: Medium...

PT-2026-66272

Insufficient policy enforcement in WebView in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. Chromium security severity: Low...

PT-2026-66055

Insufficient validation of untrusted input in WebView in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. Chromium security severity: Medium...

PT-2026-66625

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description The MMS server connection handler contains a flaw in the processing of BER-encoded request data. When an MMS confirmed request PDU Protocol Data Unit containing ...

PT-2026-66309

Insufficient validation of untrusted input in WebAuthn in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted PDF file. Chromium security severity: Low...

PT-2026-66544

Name of the Vulnerable Software and Affected Versions Leantime version 3.6.2 Description An authenticated attacker can perform server-side request forgery SSRF and local file inclusion LFI by providing unsanitized filenames to the file get contents function within the Blueprints::import method...

PT-2026-66469

CentreStack before 17.4 contains a SQL injection vulnerability in GladDBFiles.SearchEx and SearchExUnder that allows authenticated attackers to execute arbitrary SQL statements by supplying a crafted x-glad-filter request header through the jsondir API endpoint. Attackers can exploit unsanitized...

PT-2026-69523

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An off-by-one error exists in the openvswitch module within the queue gso packets and queue userspace packet functions. The issue occurs because OVS ACTION ATTR TRUNC stores a delta from...

PT-2026-66104

Uninitialized Use in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. Chromium security severity: Medium...

PT-2026-66121

Side-channel information leakage in GPU in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. Chromium security severity: Medium...

PT-2026-66600

Name of the Vulnerable Software and Affected Versions Wolf CMS versions prior to 0.8.3.2 Description An issue in the FileManagerController allows authenticated attackers with the file manager mkfile capability to achieve remote code execution. This is possible due to missing file extension...

PT-2026-66536

Name of the Vulnerable Software and Affected Versions IBM Langflow OSS versions 1.0.0 through 1.8.4 Description Broken access control issues in the file handling API allow unauthorized access to user files, breaking tenant isolation in multi-user deployments. The endpoint '/api/v1/files/images/fl...

PT-2026-66593

GoAccess is a real-time web log analyzer and interactive viewer that runs in a terminal in nix systems or through the browser. Prior to version 1.11, the built-in WebSocket server narrows a 64-bit extended frame length into the signed 32-bit WSFrame.payloadlen field before enforcing the maximum...

PT-2026-66300

Inappropriate implementation in Blink in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. Chromium security severity: Low...

PT-2026-66138

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 151.0.7922.72 Description An inappropriate implementation in the WebAppInstalls component allows a remote attacker to perform UI spoofing by using a crafted HTML page. Recommendations Update Google Chrome to...

PT-2026-66332

Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofing via a crafted HTML page. Chromium security severity: Low...

PT-2026-66378

The Easy Appointments WordPress plugin through 3.12.26 does not perform a per-request capability or nonce check on one of its customer-listing handlers, allowing authenticated users with contributor-level access to read every stored customer's personal information...

PT-2026-66471

The SSH service on BSH ELP Electronic Platform modules contains a platform-specific vulnerability due to an improperly secured default configuration. An insecure, non-revocable SSH public key is included in the firmware's authorized keys file for the root user. An attacker in possession of the...

PT-2026-66503

Name of the Vulnerable Software and Affected Versions Apache Zeppelin versions 0.6.0 through 0.12.0 Description An LDAP injection issue exists where the ActiveDirectoryGroupRealm constructs LDAP search filters without escaping user-controlled input. This allows an authenticated attacker to inject...

PT-2026-66427

A privilege escalation vulnerability in the system configuration allows a low-privileged local user to execute arbitrary commands as root, resulting in full system compromise...

PT-2026-66553

Name of the Vulnerable Software and Affected Versions IBM Engineering Requirements Management DOORS and DOORS Web Access versions 9.7.2.1 through 9.7.2.11 IBM Engineering Requirements Management DOORS and DOORS Web Access versions 9.6.1.1 through 9.6.1.13 Description Failure to limit connection...

PT-2026-66400

The Ultimate Addons for WPBakery Page Builder WordPress plugin before 3.21.4 does not perform a capability or nonce check before deleting a site's custom-uploaded icon font packs, allowing unauthenticated attackers to permanently delete all of a site's custom icon fonts with a single request...

PT-2026-66168

Name of the Vulnerable Software and Affected Versions Google Chrome on iOS versions prior to 151.0.7922.72 Description An inappropriate implementation in the browser allows a remote attacker to spoof the contents of the Omnibox the URL address bar by sending malicious network traffic...

PT-2026-66080

Insufficient validation of untrusted input in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to inject arbitrary scripts or HTML UXSS via malicious network traffic. Chromium security severity: Medium...

PT-2026-66349

A format string vulnerability was found in the Internal Backup on the ADM. The vulnerability occurs because user-controlled task input may be included in an error response and processed through an unsafe format string operation. An authenticated attacker can exploit this issue to disclose memory...

PT-2026-66392

The Bit Form WordPress plugin before 3.1.2 does not enforce a form's active/published status on its public form-submission handlers, allowing unauthenticated users to submit entries to, and fire the configured workflows such as email notifications of forms the site owner has deactivated or...

PT-2026-66447

The IRIS web application in version 2.4.26 and possibly others does not protect its MFA validation against brute-force attacks...

PT-2026-66399

The RegistrationMagic WordPress plugin before 6.0.9.4 does not perform authorization, ownership or nonce checks on a front-end submission-editing action, allowing unauthenticated attackers to overwrite other users' form submissions and the profile fields of the associated non-administrator...

PT-2026-66360

A path traversal vulnerability was found in the IHM Log handling of ADM. The vulnerability occurs because user-controlled disk serial input is not sufficiently validated before being used to construct the path of an IHM log database file. An authenticated attacker can exploit this issue to cause...

PT-2026-66437

Due to improper neutralization of special elements, an unauthenticated remote attacker is able to inject a command into the system configuration which is subsequently executed as root...

PT-2026-66487

Name of the Vulnerable Software and Affected Versions IBM App Connect Enterprise versions 13.0.1.0 through 13.0.7.2 IBM App Connect Enterprise versions 12.0.1.0 through 12.0.12.27 Description A remote attacker can perform directory traversal on the system. By sending a specially crafted URL reque...

PT-2026-66459

Name of the Vulnerable Software and Affected Versions koku-metrics-operator affected versions not specified Description A flaw in the CostManagementMetricsConfig custom resource allows a user with edit permissions to specify an arbitrary upload URL. When the authentication.type is set to token th...

PT-2026-66579

code-projects Blood System 1.0 is vulnerable to Cross Site Scripting XSS in /don.php via the city field...

PT-2026-66479

IBM Tivoli System Automation Application Manager 4.1 and IBM WebSphere Application Server is affected by cross-site scripting in the Administrative Console...

PT-2026-66089

Name of the Vulnerable Software and Affected Versions Google Chrome on Mac versions prior to 151.0.7922.72 Description An out of bounds read in the Media component allows a remote attacker who has already compromised the renderer process to potentially achieve a sandbox escape. This is triggered...

PT-2026-66063

Inappropriate implementation in File Input in Google Chrome on Linux prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. Chromium security severity: Medium...

PT-2026-66068

Insufficient validation of untrusted input in Extensions in Google Chrome prior to 151.0.7922.72 allowed an attacker who convinced a user to install a malicious extension to potentially perform a sandbox escape via a crafted Chrome Extension. Chromium security severity: Medium...

PT-2026-66087

Insufficient validation of untrusted input in WebSockets in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. Chromium security severity: Medium...

PT-2026-66060

Insufficient validation of untrusted input in WebView in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. Chromium security severity: Medium...

PT-2026-66090

Uninitialized Use in Skia in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. Chromium security severity: Medium...

PT-2026-66077

Heap buffer overflow in Dawn in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. Chromium security severity: Medium...

PT-2026-66081

Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. Chromium security severity: Medium...

PT-2026-66016

Type Confusion in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. Chromium security severity: High...

PT-2026-66049

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 151.0.7922.72 Description Side-channel information leakage in the Autofill feature allows a remote attacker to leak cross-origin data. This occurs when a user is convinced to perform specific UI gestures while...

PT-2026-66030

Race in Downloads in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. Chromium security severity: High...