396022 matches found
PT-2026-94442
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the arm64 architecture regarding the Memory Tagging Extension MTE store-only tag check mode. When a user opts into this mode, the SCTLR EL1.TCSO0 bit is set. Because...
PT-2026-94276
Name of the Vulnerable Software and Affected Versions PublishPress Series versions prior to 3.1.4 Description An SQL Injection issue exists that allows an administrator to execute malicious SQL queries. SQL Injection is a technique where an attacker inserts malicious SQL code into a query,...
PT-2026-94831
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the RDMA/nldev component where the nested attribute RDMA NLDEV ATTR STAT HWCOUNTERS is not properly validated. The top-level policy only validates the container and...
PT-2026-94146
Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description Memory corruption occurs when processing the escape handling flow due to insufficient user buffer sizes. This issue requires local access to be exploited and can...
PT-2026-94776
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the tegra241 cmdqv probe function where the error IRQ is requested before the cmdqv-vintfs array is allocated and cmdqv-num vintfs is set. If a CMDQV remains enabled...
PT-2026-94351
Name of the Vulnerable Software and Affected Versions Dell OpenManage Server Administrator versions prior to 11.1.0.3 Description An unauthenticated attacker with remote access can exploit a Server-Side Request Forgery SSRF flaw. SSRF is a vulnerability that allows an attacker to induce the...
PT-2026-94204
Name of the Vulnerable Software and Affected Versions Nuevector affected versions not specified Description Users authenticated through SAML or OpenID Connect OIDC may experience a session mix-up where one user receives another user's authenticated session. This occurs when multiple Single Sign-O...
PT-2026-94614
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description In zoned file systems, the btrfs delayed refs rsv refill function returns -EAGAIN when the sum of over-committed metadata and zone unusable bytes exceeds the usable size in a metadata...
PT-2026-94777
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the iommu/tegra241-cmdqv component where the error interrupt service routine ISR is not properly synchronized with VINTF initialization and deinitialization. The...
PT-2026-94739
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the dmirror fault function, which is invoked by dmirror read and dmirror write retry loops when a device page table entry is missing. If the mirrored mm memory...
PT-2026-94645
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the drm/sun4i component where the sun4i crtc init function returns NULL instead of an error pointer when layer initialization fails. Because the caller function sun4i...
PT-2026-94275
Shop manager SQL Injection in WP-Lister Lite for eBay = 3.8.11 versions...
PT-2026-94991
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the synopsys dw-dp component of the drm/bridge. The DisplayPort AUX channel is initialized and registered during the dw dp bind function but is not subsequently...
PT-2026-94616
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An error handling issue exists in the sd probe function within the SCSI subsystem. When sd large pool create fails after device add&sdkp-disk dev has already succeeded, the system fails ...
PT-2026-94577
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the nvme-apple driver where the admin queue, allocated via blk mq alloc queue, is not properly destroyed during removal. When the controller fails to initialize and is...
PT-2026-94567
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the RDMA/cxgb4 component where the per-device debugfs tree, created by c4iw alloc via setup debugfs, is not properly removed during registration failure. Specifically,...
PT-2026-94962
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An out-of-bounds access issue exists in the rtw89 ppdu str function within the wifi rtw89 module. The problem is caused by an incorrect comparison operator where a should be = to properl...
PT-2026-94847
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A double-free issue exists in the mtdswap component. In the mtdswap add mtd function, if a debugfs setup failure occurs after the successful registration of a blktrans device, the mbd de...
PT-2026-94468
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the gic acpi parse iaffid function where a MADT GICC entry may not correspond to a logical CPU recognized by the kernel. This causes the cpu variable to be initialized...
PT-2026-94336
Name of the Vulnerable Software and Affected Versions InternLM LMDeploy versions prior to 0.17.1 Description A reachable assertion issue exists in the DistServe decode migration loop. An unauthenticated attacker can terminate the inference engine by submitting a migration request containing an...
PT-2026-94586
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A self-deadlock occurs in the isp4sd pwron and init function. The function acquires the ops mutex using a guard; however, if an initialization failure occurs, it jumps to an error path...
PT-2026-94547
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the mi enum attr function within the ntfs3 file system. The validation for start and end Virtual Cluster Numbers VCN for non-resident attributes is insufficient. When...
PT-2026-94150
Information Disclosure when a pointer is reused after being deallocated...
PT-2026-99526
TuxCare rebuilt drupal/commerce paybox to address 1 CVE. Fixed in 7.1.5-p1+tuxcare...
PT-2026-94156
Name of the Vulnerable Software and Affected Versions Multi Uploader for Gravity Forms versions prior to 1.2.0 Description Insufficient file type validation during chunked upload handling in the move file function allows unauthenticated attackers to upload arbitrary files to the server. This flaw...
PT-2026-95022
Name of the Vulnerable Software and Affected Versions Scoold versions prior to 1.69.0 Description Users with personal API tokens can retrieve replies from questions in private spaces they are not authorized to access. This occurs because the getPostReplies function in ApiController.java fails to...
PT-2026-94293
Name of the Vulnerable Software and Affected Versions ash authentication versions 0.6.0 through 4.14.9 ash authentication versions 5.0.0-rc.0 through 5.0.0-rc.13 Description Insufficient session expiration allows an attacker who obtains a victim's OAuth2 state value to replay the callback and sig...
PT-2026-99690
cosmian kyber is a fork of Argyle-Software/kyber that has seen no maintainer activity. It inherits the fork parent's broken AVX2 constant-time code, and the open fix pull request Cosmian/kyber6 has gone unanswered. Recommended alternatives: - aws-lc-rs - graviola...
PT-2026-95017
Name of the Vulnerable Software and Affected Versions mport versions prior to 2.7.8 Description In the MidnightBSD Package Manager, directory assets handled as ASSET DIR or ASSET DIR OWNER MODE in the libmport/bundle read install pkg.c file utilize path-based mport mkdirp, ownership, and permissi...
PT-2026-95015
Name of the Vulnerable Software and Affected Versions mport versions prior to 2.7.8 Description The MidnightBSD Package Manager contains an issue where the create sample file function in libmport/bundle read install pkg.c fails to constrain absolute source and destination paths from the sample-fi...
PT-2026-95006
Name of the Vulnerable Software and Affected Versions SigNoz versions 0.88.0 through 0.142.0 Description Authenticated attackers can execute arbitrary SQL queries and retrieve results in HTTP responses. This occurs because the trace-funnel analytics endpoints interpolate the service name and span...
PT-2026-94375
Name of the Vulnerable Software and Affected Versions RAGFlow versions prior to 0.27.3 Description Authenticated attackers can read arbitrary files by exploiting missing path validation. By providing absolute file paths in the file path parameter, users with valid access tokens can access any fil...
PT-2026-99580
TuxCare rebuilt drupal/webform multifile to address 1 CVE. Fixed in 7.1.6-p1+tuxcare...
PT-2026-94604
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A Use-After-Free UAF issue exists in the Bluetooth L2CAP implementation. The l2cap data member of hci conn is accessed without proper locking within the l2cap disconn ind function, which...
PT-2026-94299
Name of the Vulnerable Software and Affected Versions ash authentication versions 4.3.8 through 4.14.9 ash authentication versions 5.0.0-rc.0 through 5.0.0-rc.13 Description An authentication bypass allows unconfirmed users to obtain a session, bypassing mandatory email confirmation requirements...
PT-2026-94522
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A slab-out-of-bounds read exists in the ksmbd alloc user function. The issue occurs because the function uses the hash sz variable, provided by a mountd IPC login response, to determine...
PT-2026-95173
Name of the Vulnerable Software and Affected Versions Azure Logic Apps affected versions not specified Description Improper access control allows an unauthorized attacker to elevate privileges over a network. Recommendations At the moment, there is no information about a newer version that contai...
PT-2026-94504
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the ksmbd module where smb2 lock adds a ksmbd lock to the rollback list before the asynchronous work is allocated and registered. If these operations fail, the rollbac...
PT-2026-94648
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the Linux kernel where the bpf get task stack function fails to initialize the buf buffer on all return paths. This affects the bpf get task stack and bpf get task sta...
PT-2026-94694
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A memory leak occurs in the nl80211 color change function when it calls nl80211 parse beacon for the beacon next template. The process can allocate params.beacon next.mbssid ies and...
PT-2026-94427
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the octeontx2-af driver where the rvu mbox init function allocates a new ng rvu object on each call. When called separately for AF-PF mailboxes during probe and AF-VF...
PT-2026-94289
Name of the Vulnerable Software and Affected Versions ash authentication versions 3.10.5 through 4.14.9 ash authentication versions 5.0.0-rc.0 through 5.0.0-rc.13 Description Improper authentication allows an attacker with a sign-in token for one authenticated resource to be signed in as a user o...
PT-2026-95082
In MailData Email Archiving System v4.2 and earlier, a SQL injection vulnerability exists...
PT-2026-95089
Name of the Vulnerable Software and Affected Versions Wavelog versions 1.8 through 2.4.1 Description Wavelog exposes the endpoints '/install/ajax.php' and '/install/includes/interface assets/triggers.php' after installation without requiring an installation lock or permission check. Unsanitized...
PT-2026-99689
Root has patched GHSA-v3rj-xjv7-4jmq in the smol-toml package for Root:npm. Multiple fixed versions available...
PT-2026-94144
Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description A transient Denial of Service DoS occurs during the processing of authentication frames that contain invalid Fast Initial Link Setup FILS information element...
PT-2026-94225
Name of the Vulnerable Software and Affected Versions foreman ansible plugin affected versions not specified Description A flaw exists in the Ansible inventory API of the foreman ansible plugin. The controller utilizes an unscoped Host.where call to build host queries, which fails to enforce the...
PT-2026-99527
TuxCare rebuilt drupal/form builder to address 1 CVE. Fixed in 7.1.22-p1+tuxcare...
PT-2026-94154
Name of the Vulnerable Software and Affected Versions NitroSense affected versions not specified PredatorSense affected versions not specified Description The Acer Agent Service component fails to properly require authentication during the socket handshake process. This flaw allows an unauthorize...
PT-2026-99752
A context safety grant was inherited by a template binding that never earned it, so rebinding a name the view had marked safe left the mark attached to the new, attacker-controlled value. djust's context safety channel is keyed by name, not by value. Every bind copied the value and left the grant...