PT-2026-101617

Security vulnerability affects the postgresql17 package. This issue is resolved in later releases. See references for vulnerability details...

PT-2026-101053

Security vulnerability affects the patch package. This issue is resolved in later releases. See references for vulnerability details...

PT-2026-101816

Security vulnerability affects the python3 package. This issue is resolved in later releases. See references for vulnerability details...

PT-2026-99822

Multiple security vulnerabilities affect the consul-k8s-fips package. gRPC-Go is the Go language implementation of gRPC. See references for individual vulnerability details...

PT-2026-101074

Security vulnerability affects the thingsboard package. This issue is resolved in later releases. See references for vulnerability details...

PT-2026-100474

Security vulnerability affects the nodejs package. This issue is resolved in later releases. See references for vulnerability details...

PT-2026-94361

Mattermost Desktop App versions =6.2 6.2.2.0 fails to validate the IPC sender in the leaveCall handler which allows a malicious or compromised Mattermost server or a user with script access to a connected server view to disconnect an active call belonging to a different connected server via the...

PT-2026-94285

Name of the Vulnerable Software and Affected Versions ash authentication versions 0.2.0 through 4.14.9 ash authentication versions 5.0.0-rc.0 through 5.0.0-rc.13 Description Improper verification of cryptographic signatures in AshAuthentication allows a caller of the token revocation action to...

PT-2026-94521

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A slab-use-after-free issue exists in the smbdirect component of the Linux kernel. The function smbdirect connection destroy qp uses ib destroy cq to tear down completion queues CQs...

PT-2026-94492

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A NULL pointer dereference occurs in the dpll device ops function during a teardown race condition. This happens when the last owner of a dpll device unregisters while another driver sti...

PT-2026-94443

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A flaw exists in the fuse implementation where the fuse uring cmd function fails to refuse IORING OP URING CMD requests if the connection was not enabled due to a missing FUSE OVER IO...

PT-2026-94559

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the BPF subsystem on s390 architecture where a Read-Modify-Write RMW atomic operation on an arena pointer fails to clear the destination register during a fault over a...

PT-2026-94806

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description Buffer overreads occur in the ath6kl wifi driver within WMI event handlers. The system reads from the event buffer without verifying if the message size is sufficient to hold the expecte...

PT-2026-94761

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.2.0-rc4 Description An issue exists in the IB/isert component where the system fails to compare the actual bytes received in the login buffer against the length declared in the login Protocol Data Unit PDU Basi...

PT-2026-94592

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the IOMMU DMA subsystem where concurrent access to the msi page list can lead to data corruption. In VFIO type1 legacy containers, newly attached groups may be merged...

PT-2026-94699

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the mt7996 driver where the system fails to stop the attachment of wed hif2 for the secondary PCIe function if the primary WED attach fails. This results in an...

PT-2026-94222

Name of the Vulnerable Software and Affected Versions Dell OpenManage Server Administrator versions prior to 11.1.0.3 Description An incorrect authorization issue allows a low privileged attacker with remote access to bypass protection mechanisms. Recommendations Update Dell OpenManage Server...

PT-2026-99486

SQUID-2026:9...

PT-2026-99582

TuxCare rebuilt mongoose to address 1 CVE. Fixed in 6.12.2-tuxcare.5...

PT-2026-95093

Name of the Vulnerable Software and Affected Versions rhwp versions prior to 0.7.15 rhwp Chrome and Firefox extension versions prior to 0.2.4 Description Service workers in the browser extensions do not validate message senders, URL schemes, or destination addresses before performing privileged...

PT-2026-94281

Contributor Broken Access Control in Simple Membership = 4.8.2 versions...

PT-2026-99519

TuxCare rebuilt 2 packages to address 1 CVE. Fixed in 1.17.3-tuxcare.1...

PT-2026-94190

Name of the Vulnerable Software and Affected Versions NitroSense affected versions not specified PredatorSense affected versions not specified Description The Acer System Monitoring component, used in NitroSense and PredatorSense, contains a flaw where a WebSocket service is configured to listen ...

PT-2026-95142

Name of the Vulnerable Software and Affected Versions Vvveb versions prior to 1.0.8.5 Description The oEmbedProxy handler in admin/controller/editor/editor.php accepts an attacker-controlled url parameter and passes it to getUrl. The validateUrl function in system/functions.php only checks the...

PT-2026-94255

Unauthenticated Broken Authentication in EduAdmin Booking = 5.4.2 versions...

PT-2026-94238

Name of the Vulnerable Software and Affected Versions WWBN AVideo through commit e01e41ecc Description A broken access control flaw exists in the 'objects/userVerifyEmail.php' endpoint. The script disables login requirements via the $global'ignoreUserMustBeLoggedIn' variable and accepts the users...

PT-2026-94265

Contributor Cross Site Scripting XSS in PropertyHive = 2.2.6 versions...

PT-2026-94302

Name of the Vulnerable Software and Affected Versions google-protobuf affected versions not specified Description The software contains an unbounded recursion issue when parsing unknown protobuf group fields. An attacker can send a crafted payload consisting of deeply nested START GROUP wire byte...

PT-2026-94181

Name of the Vulnerable Software and Affected Versions Motors WordPress plugin versions prior to 1.4.121 Description An authorization bypass exists that allows unauthenticated attackers to access non-published car listings, including those in draft, pending, and private status. By providing a...

PT-2026-99520

TuxCare rebuilt drupal/shs to address 1 CVE. Fixed in 7.1.10-p1+tuxcare...

PT-2026-94291

Name of the Vulnerable Software and Affected Versions Dell OpenManage Server Administrator versions prior to 11.1.0.3 Description An Improper Privilege Management issue exists where a low privileged attacker with remote access could potentially exploit the flaw. This could lead to unauthorized...

PT-2026-95133

Name of the Vulnerable Software and Affected Versions The Motors – Car Dealership & Classified Listings Plugin versions prior to 1.4.121 Description Missing authorization checks in the mvl ajax dealer load cars function allow unauthenticated attackers to gain unauthorized access to data. This fla...

PT-2026-95011

Name of the Vulnerable Software and Affected Versions mport versions prior to 2.7.8 Description The mport verify package function in libmport/verify.c may continue execution after MD5File or SHA256 File fails. This allows the system to compare an expected checksum against stale data remaining in...

PT-2026-99576

TuxCare rebuilt aiohttp to address 1 CVE. Fixed in 3.8.4.post10+tuxcare...

PT-2026-102782

vLLM through 0.29.0 fails to properly clean up decode-side metadata for rejected inference requests in prefill/decode disaggregated deployments. Remote attackers can submit requests with max tokens=0 to exhaust decode-worker memory without bound until the worker restarts...

PT-2026-94141

Name of the Vulnerable Software and Affected Versions The product name cannot be determined. affected versions not specified Description Memory corruption occurs during data processing operations when large offset and length values are used, causing them to exceed buffer limits during data copy...

PT-2026-95160

Name of the Vulnerable Software and Affected Versions WeGIA versions prior to 3.8.5 Description An unauthenticated GET endpoint at 'web/html/socio/sistema/controller/deletar socios.php' validates the chave parameter against a hardcoded chave correta value found in the public source repository. A...

PT-2026-94226

Name of the Vulnerable Software and Affected Versions Snowflake CLI versions prior to 3.27.0 Description Improper input validation allows unsanitized user-controlled values to be interpolated into SQL strings executed as multi-statement queries. An attacker can execute arbitrary SQL statements...

PT-2026-94344

Name of the Vulnerable Software and Affected Versions Vendure versions prior to 3.6.5 Description An unauthenticated Regular Expression Denial of Service ReDoS exists in the public Shop GraphQL API. The issue occurs when the StringOperators.regex filter is used, as the raw pattern is passed to a...

PT-2026-94390

Name of the Vulnerable Software and Affected Versions pgAdmin 4 versions 6.2 through 9.17 Description An authentication bypass exists when the 'webserver' source is enabled in AUTHENTICATION SOURCES. The WebserverAuthentication.get user function reads the config.WEBSERVER REMOTE USER from the...

PT-2026-94924

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the lg-laptop platform driver for x86 architectures regarding LED resource handling. The event notification callback may attempt to access kbd backlight even if it was...

PT-2026-94607

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the btrfs qgroup component where the qgroup free reserved data function performs an incorrect length calculation. The function rounds down the start position and round...

PT-2026-95086

Name of the Vulnerable Software and Affected Versions Datadog PHP Tracer versions prior to 1.19.2 Description The ddtrace deserialize baggage function in ext/distributed tracing headers.c fails to enforce the DD TRACE BAGGAGE MAX ITEMS or DD TRACE BAGGAGE MAX BYTES limits when parsing incoming W3...

PT-2026-94959

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the hwrng registerrng function. When the function attempts to set the rng to current rng and fails, it returns an error without removing the rng from the...

PT-2026-95094

Name of the Vulnerable Software and Affected Versions OmniBlocks versions prior to June 6, 2026 Description The .github/workflows/disc.yml workflow triggers on issues opened and edited events. When an issue is classified as off-topic, it invokes the createDiscussion mutation. Because the system...

PT-2026-94175

Name of the Vulnerable Software and Affected Versions Event Booking Manager for WooCommerce versions prior to 5.3.8 Description The plugin fails to perform ownership or authorization checks before rendering booking confirmation details. This allows unauthenticated attackers to retrieve personal...

PT-2026-94917

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the ffs dmabuf transfer function within the USB gadget f fs module. In error paths related to endpoint-disabled ESHUTDOWN and request-allocation failure ENOMEM, the...

PT-2026-94915

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A stack overflow exists in the ljca enumerate gpio function. The function reads the bank num variable from a device and uses it to control a loop that writes data into the valid pin arra...

PT-2026-94447

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description Unprivileged users can pin kernel memory outside of memory control group memcg charging. This occurs because allocations in the tc classifier change paths—including filter objects, per-C...

PT-2026-94998

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A deadlock can occur during device registration in the I3C master component. The function i3c master register new i3c devs registers new devices while holding the i3c bus normaluse lock ...