PT-2026-65884

Dify AI Workflow oauth redirect url Open Redirect Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Dify. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a...

PT-2026-65861

Name of the Vulnerable Software and Affected Versions Agent Development Kit affected versions not specified Description An issue allows for continuation forgery in tool confirmations. An attacker capable of manipulating or injecting events into the session history can execute unauthorized tools b...

PT-2026-65681

The WowStore – Store Builder & Product Blocks for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'currentPostId' Block Attribute in all versions up to, and including, 4.4.24 due to insufficient input sanitization and output escaping. This makes it possible for...

PT-2026-65885

Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 14.0 through 19.0.4 GitLab CE/EE versions 19.1 through 19.1.2 GitLab CE/EE versions 19.2 through 19.2.0 Description Improper sanitization of user-controlled input in the pagination page rendering mechanism allows a remote...

PT-2026-65720

Apache Traffic Server copies the client Host header into a fixed-size stack buffer without a bound during redirect handling, so an over-long Host header overflows the stack when redirect following is enabled. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through...

PT-2026-65955

GStreamer PNG File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. User interaction is required to exploit this vulnerability in that the target must visit a...

PT-2026-65934

Name of the Vulnerable Software and Affected Versions Kenwood DNR1007XR affected versions not specified Description A flaw in the firmware update process allows a physically present attacker to execute arbitrary code with root privileges without requiring authentication. The issue occurs when the...

PT-2026-65717

Regular Expression without Anchors vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 10.0.X through 10.1.3, from 9.0.X through 9.2.14. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fixes the issue...

PT-2026-65730

Apache Traffic Server forwards HTTP/2 origin trailers to HTTP/1 clients without proper chunked framing when converting HTTP/2 to HTTP/1. This issue affects Apache Traffic Server: from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue...

PT-2026-65822

veraPDF validation provides PDF/A and PDF/UA validation, feature reporting, and metadata repair. From 1.17.35 until 1.30.2 and 1.31.71, veraPDF-validation contains an XML External Entity XXE vulnerability in validation-model/src/main/java/org/verapdf/gf/model/impl/pd/GFPDAcroForm.java in the...

PT-2026-65785

Joomla Extension - balbooa.com - Privilege Escalation in Gridbox 2.20.2 - The registration method allows users provided usergroup IDs, allowing unauthenticated actors to register new accounts with administrative permissions...

PT-2026-65937

Name of the Vulnerable Software and Affected Versions Kenwood DNR1007XR affected versions not specified Description A local privilege escalation flaw exists in the udhcpd service. The issue is caused by incorrect permission assignment on a resource used by the service. An attacker who has already...

PT-2026-65842

A flaw was found in Quay. A user configured in GLOBAL READONLY SUPER USERS is able to view robot account tokens for repositories they are not a member of, allowing an attacker with read-only superuser privileges to impersonate any robot account...

PT-2026-65963

GIMP SGI File Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a...

PT-2026-65742

Kyuubi Engine UI proxy accepts a host and port from the request path and proxies HTTP requests to that destination. A remote requester with network access to the proxy can cause the Kyuubi server to send HTTP requests to arbitrary reachable hosts, resulting in SSRF or open-proxy behavior. This...

PT-2026-65946

Sony XAV-9500ES AVRCP Br Response Parser Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Sony XAV-9500ES devices. An attacker must first obtain the ability to pair a malicio...

PT-2026-65769

The Meta Box AIO plugin for WordPress is vulnerable to Missing Authorization via the template redirect dispatcher in the MB Frontend Submission extension in versions up to, and including, 3.8.0. This is due to the handle request function routing the mbfs delete action without any capability or...

PT-2026-65924

kishan0725 Hospital Management System 4.0 is vulnerable to SQL Injection in /doctor/edit-patient.php?editid=1...

PT-2026-65826

Kong Operator's embedded Kong Kubernetes Ingress Controller KIC allows a user with namespace-scoped Secret creation privileges to cause a cluster-wide ingress configuration denial of service. The embedded KIC collects CA-certificate Secrets across all watched namespaces using a label selector...

PT-2026-65772

The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Name Field Nested password Member in all versions up to, and including, 6.2.7 due to insufficient input sanitization and output escaping...

PT-2026-65892

Name of the Vulnerable Software and Affected Versions Flyto2 Core versions prior to 2.26.6 Description The llm.chat function reads provider keys, such as OPENAI API KEY and ANTHROPIC API KEY, from the environment and transmits them within the Authorization: Bearer header to a base url controlled ...

PT-2026-65908

Jinher OA C6 contains an XML External Entity XXE injection vulnerability in the /c6/JHSoft.Web.HrmAttendance/sp manager getUserlist.aspx/GetXmlHttp endpoint. An unauthenticated remote attacker can send a crafted XML payload to read arbitrary files from the server via an out-of-band attack...

PT-2026-65932

Name of the Vulnerable Software and Affected Versions NoMachine affected versions not specified Description Remote authenticated attackers can execute arbitrary code on the system via the web service, which typically listens on TCP port 4000. The issue occurs because the service fails to properly...

PT-2026-65936

Name of the Vulnerable Software and Affected Versions Kenwood DNR1007XR affected versions not specified Description An out-of-bounds write exists in the tchdr bytestream read function. This issue occurs because the software fails to properly validate user-supplied data, allowing a write operation...

PT-2026-65802

Joomla Extension - balbooa.com - Unauthenticated recursive directory deletion 2.20.2 - The generateNewApp method allows actors to recursively delete directories...

PT-2026-65704

A SQL injection and unsafe deserialisation vulnerability in Koollab LMS allowed an authenticated attacker to inject through the assessment overall answer endpoint, control data passed to unserialize, write a webshell to a publicly accessible location, and execute arbitrary code on the server...

PT-2026-65907

Name of the Vulnerable Software and Affected Versions undici versions prior to 6.28.0 undici versions 7.0.0 through 7.28.x undici versions 8.0.0 through 8.8.x Description The retry interceptor can deliver a response where the body length does not match the Content-Length header after a retry or...

PT-2026-65777

GNU Bison allows for an execution of an arbitrary program during HTML report generation due to improper handling of grammar-defined configuration variables. A grammar file can override the executable used for the XML‑to‑HTML transformation step via %define tool.xsltproc, which is accepted without...

PT-2026-65883

Integer wraparound in IVFFlat index build in pgvector before 0.8.6 allows a database user to write data out-of-bounds, which could lead to arbitrary code execution. Only 32-bit systems are affected...

PT-2026-66657

These are all security issues fixed in the ImageMagick-7.1.2.28-1.1 package on the GA media of openSUSE Tumbleweed...

PT-2026-65911

Name of the Vulnerable Software and Affected Versions OliveTin versions prior to 3000.17.0 Description An issue exists where the 'service/internal/api/api.go' endpoints 'StartActionAndWait' and 'StartActionByGetAndWait' return the full LogEntry output after execution without verifying the logs...

PT-2026-65896

Name of the Vulnerable Software and Affected Versions Flyto2 Core versions prior to 2.26.6 Description The image.download and related file-writing modules use a caller-controlled output dir instead of the validate path with env config function and its FLYTO SANDBOX DIR confinement. This allows...

PT-2026-65898

Name of the Vulnerable Software and Affected Versions mcp versions prior to 0.23.0 Description The MCP::Server::Transports::StreamableHTTPTransport component in the mcp gem fails to bind a session ID to a session owner. This allows an attacker who has obtained a stolen session ID to send tools/ca...

PT-2026-65782

The Booking System Trafft plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the bookingWebsiteUrl setting in all versions up to, and including, 1.0.17 due to a missing capability check on the set options AJAX action when the plugin is operating in agency mode. The...

PT-2026-65815

cJSON through 1.7.19 applies RFC 6902 JSON Patch operations non-atomically in apply patch in cJSON Utils.c. For a replace operation that is missing its value member, or a move operation whose destination path cannot be resolved, the existing target member is detached and deleted before the...

PT-2026-65780

Joomla Extension - aimy-extensions.com - RCE via PHP object injection in Aimy Captcha-Less Form Guard 18.0 - 20.0 - A forged clfgd field allows PHP objection injection and thereby remote code execution...

PT-2026-65798

Insufficient Verification of Data Authenticity vulnerability in Gleam allows an adversary in the middle to substitute forged Hex package contents during dependency resolution. During dependency resolution Gleam fetches package metadata from the signature-verified Hex repository, which covers each...

PT-2026-65723

Apache Traffic Server allows request smuggling if chunked messages are malformed. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue...

PT-2026-65748

Apache Traffic Server reads out of bounds while parsing DNS answers. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue...

PT-2026-65731

Apache Traffic Server can write out of bounds or overflow integers while parsing MIME and HTTP headers. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fi...

PT-2026-65750

The Apache Traffic Server certifier plugin generates certificates based on attacker-controlled client SNI. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which...

PT-2026-65749

Apache Traffic Server can crash from null dereferences and dangling references in TLS and SNI handling. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fi...

PT-2026-65763

The Apache Traffic Server webp transform plugin can decode unsafely and serve mislabeled, cacheable responses. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4,...

PT-2026-65758

The Apache Traffic Server uri signing and url sig plugins can exhaust the stack or crash on attacker input. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, whic...

PT-2026-65929

TrendAI Vision One Service Gateway Logs Information Disclosure Vulnerability...

PT-2026-65887

Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 10.1.0 through 19.0.4 GitLab CE/EE versions 19.1 through 19.1.2 GitLab CE/EE versions 19.2 through 19.2.0 Description An issue in the internal request handling of GitLab Workhorse, the HTTP request handler for the GitLab...

PT-2026-65909

Name of the Vulnerable Software and Affected Versions OliveTin versions 3000.0.0 through 3000.16.0 Description The OAuth2 login handler in service/internal/auth/otoauth2/restapi auth oauth2.go stores per-login state in the registeredStates map for every request made to the /oauth/login endpoint...

PT-2026-65965

GIMP TIF File Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a...

PT-2026-65702

A post-authentication SQL injection vulnerability in Koollab LMS allowed an authenticated attacker to use an error-based SQL oracle via the face-to-face runs update endpoint to read the entire application database and obtain valid JWT tokens for account takeover...

PT-2026-65823

veraPDF PDF parser is a PDF parser for veraPDF. Prior to 1.30.2 and 1.31.23, veraPDF-parser contains a denial-of-service vulnerability in veraPDF-parser/src/main/java/org/verapdf/pd/font/cmap/CMapParser.java and veraPDF-parser/src/main/java/org/verapdf/parser/postscript/PSOperator.java, where a...