202315 matches found
PT-2026-65866
The TL-WR940N v6 router contains a vulnerability in its RTSP connection tracking module that can lead to a stack-based buffer overflow. The issue occurs when a LAN client initiates a connection to a malicious RTSP server controlled by an attacker. A specially crafted RTSP message may trigger...
PT-2026-65773
An out-of-bounds write vulnerability was found in the BFD library's DLX ELF backend bfd/elf32-dlx.c in GNU binutils. The dlx rtype to howto function maps ELF relocation types to internal howto structures but fails to perform adequate bounds checking on attacker-controlled relocation type values v...
PT-2026-65840
Name of the Vulnerable Software and Affected Versions undici versions 7.0.0 through 7.28.x undici versions 8.0.0 through 8.8.x Description The cache interceptor mishandles malformed Cache-Control private directives when used in shared mode. A degenerate qualified private directive, such as privat...
PT-2026-65930
TrendAI Vision One Incorrect Privilege Assignment Privilege Escalation Vulnerability...
PT-2026-65800
Name of the Vulnerable Software and Affected Versions Gridbox versions prior to 2.20.2 Description An issue exists in the resetPassword method that allows unauthenticated actors to reset the password of any user, enabling them to log in and perform actions as those users, with the exception of...
PT-2026-65736
Apache Traffic Server drops the per-stream buffer cap when dechunking HTTP/2 or HTTP/3 responses, letting a slow client exhaust server memory. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrad...
PT-2026-65737
Apache Traffic Server reuses multiplexed HTTP/2 origin connections without verifying the server certificate covers the new request hostname. This issue affects Apache Traffic Server: from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1....
PT-2026-65753
Apache Traffic Server leaks memory when handling HostDB SRV records. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue...
PT-2026-65695
The Easy Appointments WordPress plugin through 3.12.26 does not verify that the appointment targeted by its customer-data update action belongs to the current user; the action only checks a shared nonce that any authenticated user can obtain from their own appointment's edit form. A...
PT-2026-65768
Apache Traffic Server updates the HTTP/2 HPACK dynamic table before confirming the header block encoded successfully, so an encode failure leaves the encoder out of sync with the peer decoder and corrupts subsequent header blocks on the connection. This issue affects Apache Traffic Server: from...
PT-2026-65901
Linuxfabrik monitoring-plugins provides Python monitoring plugins for Icinga, Nagios, and related monitoring systems. In version 6.0.0, the logfile check legacy database migration moved a predictable path from /tmp with os.rename and allowed a local user controlling the plugin account to place a...
PT-2026-65781
The WPC Badge Management for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'text' attribute of the wpcbm best seller shortcode in all versions up to, and including, 3.1.6 due to insufficient input sanitization and output escaping on user supplied attributes...
PT-2026-65848
In the Linux kernel, the following vulnerability has been resolved: s390/pkey: Check length in pkey pckmo handler implementation Explicitly check the length of the target buffer in the pkey pckmo implementation of the key to protkey handler function. The handler function fails, if the generated...
PT-2026-65775
The MasterStudy LMS WordPress Plugin – for Online Courses and Education plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.7.14. This is due to the stm lms delete cover function lacking ownership validation on the file id parameter befor...
PT-2026-65915
undici does not validate the type property of a duck-typed blob-like request body before using it as the Content-Type header on the HTTP/1.1 dispatcher. In undici before 6.28.0, from 7.0.0 up to before 7.29.0, and from 8.0.0 up to before 8.9.0, an application that passes a hand-rolled blob-like...
PT-2026-65889
Name of the Vulnerable Software and Affected Versions mcp versions prior to 0.23.0 Description The MCP::Server::Transports::StdioTransport and MCP::Client::Stdio components in the mcp gem use the IOgets function without a byte limit. This allows a peer that sends data without a newline character ...
PT-2026-65690
The wp-media-folder-addon WordPress plugin through 4.1.6 does not validate a user-supplied parameter before using it in a file read operation in two AJAX actions available to unauthenticated users, leading to Arbitrary File Disclosure and Server-Side Request Forgery on sites where a cloud storage...
PT-2026-65962
GIMP TIF File Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a...
PT-2026-65870
V through 0.5.2, fixed in commit 85859f0, contains a server-side request forgery SSRF bypass vulnerability that allows attackers to circumvent host-based allowlists by exploiting a parser differential between net.urllib and net.http. Attackers can craft a URL containing a backslash in the authori...
PT-2026-65860
Name of the Vulnerable Software and Affected Versions Devolutions Password Manager versions prior to 2026.2.1.1 Description Improper certificate validation in the Devolutions Server connection handling allows an adjacent-network attacker to intercept and modify sensitive information by using a...
PT-2026-65733
Apache Traffic Server mis-parses ports in URLs and userinfo, allowing port-based access-control bypass. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fi...
PT-2026-65713
A business logic vulnerability in Koollab LMS allowed an authenticated learner to set their lesson completion status to completed via the SCORM commit endpoint without viewing the lesson material, compromising training and completion records...
PT-2026-65845
SQL Injection vulnerability in ClickHouse Server Versions = 26.3.9.8 allows a remote attacker to execute arbitrary code via the create dictionaries function...
PT-2026-65881
Name of the Vulnerable Software and Affected Versions consul-mcp-server versions 0.1.0 through 0.1.3 Description The software does not restrict how the Consul backend address is supplied, which allows a connected client to override the configured Consul address using a request header. A malicious...
PT-2026-65916
VaahCMS versions 2.0.0 through 2.3.4 contain a malicious obfuscated JavaScript payload embedded in the Blade template responsible for rendering security OTP emails, allowing remote attackers to execute unauthorized code in any browser that renders the affected email template with JavaScript...
PT-2026-65676
The Wholesale for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.0.5. This is due to the save requests meta function applying only sanitize text field to the user role set POST parameter before passing it directly to WP User::add rol...
PT-2026-65767
The FAB auth manager's Azure AD OAuth login defaulted verify signature=False when decoding the ID token, so an attacker able to present a forged or unsigned alg:none ID token to the OAuth callback could bypass authentication and log in as an arbitrary user, including one holding the Admin role...
PT-2026-65864
Name of the Vulnerable Software and Affected Versions Ruby on Rails affected versions not specified Description An issue exists in applications using Active Storage with Vips that allows unauthenticated attackers to read server files by uploading crafted images. This could lead to the exposure of...
PT-2026-65855
MathLive provides web components for math display and input. Prior to 0.110.0, MathLive fails to escape text-mode content in text and mbox commands in Box.toMarkup at src/core/box.ts, in xmlEscape, scanText, and text-mode output in src/formats/atom-to-math-ml.ts, and through convertLatexToMarkup,...
PT-2026-66340
Name of the Vulnerable Software and Affected Versions Disable Login Page versions . Description A security issue exists in the Disable Login Page project. The project is currently marked as unsupported, and the maintainer has not provided a fix for this issue. Recommendations At the moment, there...
PT-2026-65803
Joomla Extension - balbooa.com - Unauthenticated SQL injection in Gridbox 2.20.2 - Multiple SQLi vectors allow unauthenticated actors to inject SQL in queries...
PT-2026-65862
Name of the Vulnerable Software and Affected Versions BlackBerry QNX affected versions not specified Description Improper input validation in the decode function of the traceparser library allows an attacker to use a corrupted kernel trace event log .kev file to execute arbitrary code or cause a...
PT-2026-65956
GStreamer rtpsbcdepay Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on t...
PT-2026-65888
Name of the Vulnerable Software and Affected Versions mcp versions prior to 0.23.0 Description The MCP::Server::Transports::StreamableHTTPTransport component in the mcp gem fails to validate the HTTP Host or Origin request headers. This allows a malicious browser page to utilize DNS rebinding—a...
PT-2026-65806
Joomla Extension - balbooa.com - Payment bypass in Gridbox 2.20.2...
PT-2026-65835
AMMOS Instrument Toolkit AIT Deep Space Network DSN Interface before 2.2.2 contains a missing authentication vulnerability in the Space Link Extension SLE interface manager that allows unauthenticated network attackers to access seven unprotected API routes by sending direct HTTP requests with no...
PT-2026-65878
Name of the Vulnerable Software and Affected Versions GitLab EE versions 19.1 through 19.1.2 GitLab EE versions 19.2 through 19.2.0 Description An issue exists where an authenticated user could bypass tool governance policies configured by an administrator. This occurs due to improper authorizati...
PT-2026-65905
Sourcecodester Fantastic Blog CMS 1.0 is vulnerable to Cross Site Scripting XSS in pageEditMember.php via the address field...
PT-2026-65921
Sourcecodester CASAP Automated Enrollment System 1.0 is vulnerable to SQL Injection in update student.php via parameters fname and student class...
PT-2026-66869
CVE-2026-67188 - Rejected reason: This CVE ID has been rejected or CVE ID :CVE-2026-67188 Published : July 29, 2026, 4:17 p.m. | 42 minutes ago Description :Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. Severity: 0.0 | NA Visit the link for more...
PT-2026-65913
kishan0725 Hospital Management System 4.0 is vulnerale to SQL Injection in get doctor.php via the parameters doctor and specilizationid...
PT-2026-65774
The Klubraum Membership Request plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the kr mr store settings function in all versions up to, and including, 1.1.0. This makes it possible for unauthenticated attackers to update the plugin's...
PT-2026-65942
Sony XAV-9500ES prh l2 decode packet Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of Sony XAV-9500ES devices. An attacker must first obtain the ability to pair a malicious...
PT-2026-65885
Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 14.0 through 19.0.4 GitLab CE/EE versions 19.1 through 19.1.2 GitLab CE/EE versions 19.2 through 19.2.0 Description Improper sanitization of user-controlled input in the pagination page rendering mechanism allows a remote...
PT-2026-65815
cJSON through 1.7.19 applies RFC 6902 JSON Patch operations non-atomically in apply patch in cJSON Utils.c. For a replace operation that is missing its value member, or a move operation whose destination path cannot be resolved, the existing target member is detached and deleted before the...
PT-2026-65692
The PhotoSwipe WordPress plugin through 4.1.1.1 uses the title attribute of author-supplied link markup as a lightbox caption that is written into the page DOM without escaping. Because the title attribute survives the post-content sanitization applied to users who lack the unfiltered html...
PT-2026-65819
Name of the Vulnerable Software and Affected Versions Autodesk AutoCAD affected versions not specified Description An Out-of-Bounds Read occurs when the software reads data outside the intended boundary of a buffer. This issue is triggered when Autodesk AutoCAD parses a maliciously crafted DWG or...
PT-2026-65903
Linuxfabrik monitoring-plugins provides Python monitoring plugins for Icinga, Nagios, and related monitoring systems. In 6.0.0 and earlier, the redfish- plugins built request URLs by concatenating an operator-supplied base URL with response-supplied @odata.id links, allowing a malicious or...
PT-2026-65871
Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 10.6 through 19.0.4 GitLab CE/EE versions 19.1 through 19.1.2 GitLab CE/EE versions 19.2 through 19.2.0 Description An improper authorization check on merge request collaboration settings allows an authenticated user with...