424722 matches found
PT-2026-131673
TuxCare rebuilt @angular/platform-browser-dynamic to address 15 CVEs. Fixed in 4.4.7-tuxcare.8...
PT-2026-132662
TuxCare rebuilt @babel/plugin-transform-sticky-regex to address 1 CVE. Fixed in 7.16.7-tuxcare.3...
PT-2026-132663
TuxCare rebuilt com.fasterxml.jackson.core:jackson-core to address 2 CVEs. Fixed in 2.6.0-tuxcare.1...
PT-2026-132601
TuxCare rebuilt @react-router/remix-routes-option-adapter to address 1 CVE. Fixed in 7.5.1-tuxcare.9...
PT-2026-131677
TuxCare rebuilt @angular/platform-browser-dynamic to address 16 CVEs. Fixed in 16.2.7-tuxcare.2...
PT-2026-132681
TuxCare rebuilt com.fasterxml.jackson.core:jackson-core to address 2 CVEs. Fixed in 2.15.3-tuxcare.1...
PT-2026-131227
TuxCare rebuilt @angular/platform-server to address 1 CVE. Fixed in 9.1.13-tuxcare.16...
PT-2026-132692
TuxCare rebuilt com.fasterxml.jackson.core:jackson-core to address 1 CVE. Fixed in 2.11.1-tuxcare.1...
PT-2026-131676
TuxCare rebuilt @angular/platform-browser-dynamic to address 2 CVEs. Fixed in 6.0.1-tuxcare.5...
PT-2026-132665
TuxCare rebuilt @storybook/addon-viewport to address 1 CVE. Fixed in 7.0.7-tuxcare.1...
PT-2026-132679
TuxCare rebuilt com.fasterxml.jackson.core:jackson-core to address 2 CVEs. Fixed in 2.8.11-tuxcare.1...
PT-2026-132621
TuxCare rebuilt @babel/runtime-corejs2 to address 1 CVE. Fixed in 7.23.9-tuxcare.3...
PT-2026-130902
TuxCare rebuilt @angular/platform-browser to address 1 CVE. Fixed in 15.2.2-tuxcare.7...
PT-2026-132666
TuxCare rebuilt org.springframework.data:spring-data-keyvalue to address 1 CVE. Fixed in 3.3.12-tuxcare.3...
PT-2026-131674
TuxCare rebuilt @angular/platform-browser-dynamic to address 17 CVEs. Fixed in 18.2.12-tuxcare.2...
PT-2026-132661
TuxCare rebuilt @babel/plugin-transform-sticky-regex to address 2 CVEs. Fixed in 7.16.7-tuxcare.2...
PT-2026-132603
TuxCare rebuilt @react-router/remix-routes-option-adapter to address 1 CVE. Fixed in 7.18.1-tuxcare.1...
PT-2026-132688
TuxCare rebuilt com.fasterxml.jackson.core:jackson-core to address 1 CVE. Fixed in 2.18.5-tuxcare.1...
PT-2026-131851
TuxCare rebuilt @angular/service-worker to address 1 CVE. Fixed in 19.2.18-tuxcare.3...
PT-2026-131232
TuxCare rebuilt @angular/platform-server to address 1 CVE. Fixed in 10.1.0-tuxcare.8...
PT-2026-132667
TuxCare rebuilt @react-router/serve to address 2 CVEs. Fixed in 7.5.1-tuxcare.1...
PT-2026-117471
Crawl4AI from 0.8.7 through 0.9.5 contains a server-side request forgery vulnerability in the Docker API server that allows unauthenticated attackers to bypass destination checks via URL userinfo parsing differences. Attackers can set fetch ssl certificate=true with crafted userinfo URLs so...
PT-2026-117202
A vulnerability has been found in diem-project diem up to 116974edfb9a5b8bd69cb13586dc62bcdbb485ad. Affected by this vulnerability is the function html of the file dmAdminPlugin/web/js/dmAdminCtrl.js of the component Version Check Service. The manipulation leads to cross site scripting. Remote...
PT-2026-131997
TuxCare rebuilt @angular/service-worker to address 1 CVE. Fixed in 7.2.1-tuxcare.2...
PT-2026-117517
Slims Senayan Library Management Systems 9 Bulian 9.8.0 allows cross-site request forgery CSRF against admin/modules/circulation/loan history maintenance.php because the action=run GET parameter performs privileged, destructive operations with no CSRF token or POST confirmation, leading to data...
PT-2026-117334
A vulnerability has been found in GlitterWare Passy up to 1.10.1. The affected element is the function MyHttpOverrides in the library lib/main.dart of the component TLS Handler. Such manipulation leads to improper certificate validation. The attack may be launched remotely. This attack is...
PT-2026-117624
Craft CMS from 5.0.0 before 5.11.0 contains a remote code execution vulnerability that allows authenticated Control Panel users to escape the Twig sandbox by passing uncleansed criteria to getNext, getPrev, or getOwners. Attackers can inject Yii "as" or "on" config keys to attach malicious event...
PT-2026-117241
Name of the Vulnerable Software and Affected Versions BDM Digital Payment Gateway WordPress plugin versions prior to 1.3.13 Description The plugin fails to verify credentials on its public payment-status update route and treats unset credentials as valid. This allows unauthenticated attackers to...
PT-2026-118003
Mercury runs a JupyterLab server with anonymous access by default mercury app/ main .py sets --IdentityProvider.token='' when no --token/MERCURY TOKEN is given; when tokenless it also sets --ServerApp.disable check xsrf=True. It relies on a blocklist mercury app/block handler.py BLOCKED PATTERNS:...
PT-2026-120338
Affected versions include emSign ECC Root CA - G3, which can allow certificate paths through distrusted emSign intermediates. Affected versions may accept certificate paths containing distrusted emSign intermediate public keys. The private keys corresponding to these intermediates are now well...
PT-2026-117410
SGLang through 0.5.22 contains a denial of service vulnerability that allows API clients to abort other users' in-flight generation requests by supplying a short client-controlled rid. Attackers can submit streaming /generate requests with single hex character rids and disconnect, triggering...
PT-2026-117671
Name of the Vulnerable Software and Affected Versions Pillow versions 12.0.0 through 12.x Description The Image.merge function can dereference a null image8 plane because validation skips the first input band. This allows a 32-bit integer or floating-point image backed by image32 storage to be...
PT-2026-117675
Name of the Vulnerable Software and Affected Versions Pillow versions 10.0.0 through 12.9.9 Description During FreeType rendering with an active stroker, the library may free an invalid glyph pointer. This occurs when the FT Load Glyph function fails, leading the cleanup process to call FT Done...
PT-2026-117646
Name of the Vulnerable Software and Affected Versions Pillow versions 5.1.0 through 12.11.0 Description The PdfParser.get value function can recurse without a limit when reading nested PDF objects. This occurs when the parser follows attacker-controlled arrays and dictionaries while an existing P...
PT-2026-117661
Name of the Vulnerable Software and Affected Versions MLflow versions prior to 3.17.2 Description The FileStore tracking backend contains a path traversal issue. Unauthenticated attackers can control filesystem paths by submitting a crafted trace ID containing traversal sequences to the 'POST...
PT-2026-117676
Name of the Vulnerable Software and Affected Versions Pillow versions 5.1.0 through 12.11.0 Description When saving many frames with save all enabled, the library takes quadratic time to reserve PDF object identifiers. This occurs because the PdfParser.next object id function repeatedly rebuilds...
PT-2026-117657
Name of the Vulnerable Software and Affected Versions Pillow versions 8.1.0 through 12.11.0 Description An issue exists where the library can allocate an APNG disposal background at the full canvas size before the decompression-bomb check is applied. A specially crafted APNG file containing a sma...
PT-2026-117687
Name of the Vulnerable Software and Affected Versions Pillow versions prior to 13.0.0 Description The XBM header parser in the Python imaging library is susceptible to a regular-expression denial of service. When the Image.open function is called on a specially crafted XBM file, the XbmImagePlugi...
PT-2026-117617
Name of the Vulnerable Software and Affected Versions Wuxi Wubang Security Software Wubang Five-in-One Safety Production Management Information System versions prior to 3.6 Description An unauthenticated SQL injection exists in the /ws.asmx endpoint. The issue occurs when the sql argument is...
PT-2026-117673
Name of the Vulnerable Software and Affected Versions Pillow versions 9.2.0 through 12.11.0 Description When saving a GIF with a long comment, the library performs quadratic copying. The get global header function repeatedly copies portions of comment data while assembling the global header, whic...
PT-2026-117684
Name of the Vulnerable Software and Affected Versions Pillow versions 5.3.0 through 12.11.0 Description Pillow can return uninitialized memory as pixels when libtiff performs a short decode of JPEG-compressed or Group 4 fax TIFF data. This occurs because the decodeStrip and decodeTile buffers may...
PT-2026-117653
Name of the Vulnerable Software and Affected Versions Pillow versions prior to 13.0.0 Description Rank-based filters in the Pillow Python imaging library can dereference invalid image storage when processing a zero-size image. The ImagingExpand function allocates a non-empty output but faults...
PT-2026-117655
Name of the Vulnerable Software and Affected Versions Pillow versions prior to 13.0.0 Description A flaw exists in the Python imaging library where the ImageMorph.MorphOp.apply function can access memory before a row buffer when processing images with a width of zero. This occurs because the PPM...
PT-2026-117677
Name of the Vulnerable Software and Affected Versions Pillow versions 5.1.0 through 12.9.9 Description Pillow can exhaust system resources when parsing an existing PDF during an append operation. The PdfParser follows page-tree child references without tracking cycles or duplications and follows...
PT-2026-117683
Name of the Vulnerable Software and Affected Versions Pillow versions prior to 13.0.0 Description The TIFF encoder in Pillow can perform an out-of-bounds read when processing images with retained TIFF metadata where the plane size is inconsistent with BitsPerSample. An attacker can provide a...
PT-2026-117660
Name of the Vulnerable Software and Affected Versions Pillow versions prior to 13.0.0 Description A double free of image memory can occur when the ImagingScaleAffine function encounters a selective allocation failure. This happens during the fast path processing of Transform.EXTENT or pure...
PT-2026-117685
Name of the Vulnerable Software and Affected Versions Pillow versions 9.1.0 through 12.x Description Pillow can disclose uninitialized stack memory when the Image.quantize function uses an empty palette. This occurs because the ImagingPaletteCacheUpdate function leaves a local cache array...
PT-2026-117432
Krayin CRM 2.2.5 before 2.2.7 contains a server-side request forgery filter bypass that allows users with webhook permissions to reach internal addresses via DNS rebinding. Attackers can return a public address during WebhookService::isSafeEndpoint validation and an internal address when Guzzle...