PT-2026-121424

draw.io Desktop is the official Electron build of draw.io. Prior to 31.4.4, draw.io Desktop is vulnerable to arbitrary local-file disclosure through the Electron main process's read-side IPC handlers. The readFile, getFileDrafts, getBkpFile, fileStat, isFileWritable, checkFileExists, and watchFil...

PT-2026-121312

Missing Authorization vulnerability in yoomoney ЮKassa для WooCommerce yookassa allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ЮKassa для WooCommerce: from n/a through 2.17.3...

PT-2026-120936

Traefik 2.11.x before 2.11.58 and 3.x before 3.7.14 contains a race condition in NTLM and Kerberos Negotiate backend authentication, where the per-connection sticky round tripper slot is read and written without synchronization. Remote attackers can send concurrent HTTP/2 or HTTP/3 requests over...

PT-2026-121430

EDK2 contains a vulnerability in BIOS where a user may cause “Out-of-bounds Write”, Classic Buffer Overflow, and “Incorrect Calculation of Buffer Size” by remote access. Successful exploitation of this vulnerability can lead to arbitrary code execution. It could also impact Confidentiality,...

PT-2026-121555

Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 contains an arbitrary file write vulnerability that allows malicious migration sources to write host files by planting symlinks in transferred volumes. Attackers can craft rsync or btrfs receive streams with a symlink such as rootfs...

PT-2026-121390

A vulnerability was detected in subhajitkhan online-clinic-management-system up to e9ee77a8827a1446220fa07ee693dc4d9a29a578. This issue affects some unknown processing of the file patappointtime.php of the component Booking Handler. The manipulation results in enforcement of behavioral workflow. ...

PT-2026-121651

No description provided...

PT-2026-121527

Mistune before 3.3.0 contains an inefficient algorithmic complexity vulnerability in parse link text that allows remote attackers to cause denial of service through unbalanced square brackets. Attackers can submit markdown containing long runs of unmatched brackets to mistune.html, triggering...

PT-2026-121529

Mistune from 3.0.0 before 3.3.0 contains an algorithmic complexity denial of service vulnerability in the parse link text function in src/mistune/helpers.py. Attackers can submit markdown with deeply nested square brackets triggering quadratic parsing time, exhausting server CPU with small crafte...

PT-2026-121532

Mistune before 3.3.0 contains an algorithmic complexity vulnerability in the inline link parser that allows unauthenticated attackers to exhaust CPU by submitting long runs of unmatched '' characters. Attackers can send small markdown payloads that trigger ON^2 parse link text and parse link labe...

PT-2026-121658

Name of the Vulnerable Software and Affected Versions Amazon Strands Agents SDK for Python versions prior to 1.43.0 Amazon Strands Agents SDK for TypeScript versions prior to 1.5.0 Description The A2A server component fails to properly isolate conversation state between callers. An authenticated...

PT-2026-121662

Authlib is a Python library which builds OAuth and OpenID Connect servers. From 1.3.1 until 1.9.0, OctKey.import key checks asymmetric-key markers only at byte zero while Authlib's PEM loaders accept leading whitespace, comments, or a byte-order mark. In deployments that use the documented mixed...

PT-2026-121663

Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.1, Authlib's OctKey.import key and HMAC signing and verification path accept zero-length key material. If an application's secret lookup can return an empty string or empty bytes, a remote attacker can compute...

PT-2026-121675

Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.0, the default RFC 7523 JWTBearerGrant.get audiences returns an empty list, causing JWTBearerGrant.verify claims to require only that an aud claim exists without matching the current authorization server. An...

PT-2026-121676

Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.0, OpenIDImplicitGrant.validate authorization request checks the client-controlled raw request.payload.scope for openid after the parent grant has filtered allowed scopes into request.scope. A registered clien...

PT-2026-121677

Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.0, Authlib's RFC 9101 JWTAuthenticationRequest passes the unauthenticated, client-controlled request uri parameter to the abstract get request object hook before applying a destination or registration policy;...

PT-2026-121413

Name of the Vulnerable Software and Affected Versions opentelemetry-api versions 1.0.0 through 1.45.0 Description The TraceState.from header function in opentelemetry/trace/span.py, which is accessed via TraceContextTextMapPropagator.extract, uses a regular expression to parse inbound W3C...

PT-2026-121400

Name of the Vulnerable Software and Affected Versions multer versions 2.0.0 through 2.4.9 Description A race condition exists in the multipart parser when configured with an asynchronous fileFilter function. If a request is aborted while an asynchronous fileFilter is still pending, the callback m...

PT-2026-121528

Mistune from 3.0.0 before 3.3.0 contains an algorithmic complexity vulnerability in the inline link parser's parse link text function that allows unauthenticated attackers to exhaust CPU with unbalanced brackets. Attackers can submit Markdown containing many unbalanced '' or '!' characters, forci...

PT-2026-121530

Mistune before 3.3.0 contains a cross-site scripting vulnerability in the Include directive that emits included .html, .xhtml, or .htm file content as raw block html tokens. Attackers who can plant an HTML file readable by the renderer can reference it via an include directive, combined with path...

PT-2026-121533

Mistune before 3.3.0 contains a path traversal vulnerability in the RST include directive that allows attackers to read arbitrary files by supplying relative or absolute paths. Attackers can submit markdown containing include directives referencing ../ sequences or absolute paths to embed sensiti...

PT-2026-121534

Mistune before 3.3.0 contains a path traversal vulnerability in the opt-in Include directive that allows attackers to read local files by supplying relative or absolute include paths. Attackers who submit Markdown rendered via Markdown.read can disclose files such as /etc/passwd and inject...

PT-2026-121264

The FluentCart A New Era of eCommerce WordPress plugin before 2.2.0 does not verify that a stored customer address selected during checkout belongs to the requester, allowing unauthenticated attackers to attach any customer's stored address to an order they place and read it back, disclosing...

PT-2026-121318

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in nicdark ND Shortcodes For Visual Composer nd-shortcodes allows Stored XSS.This issue affects ND Shortcodes For Visual Composer: from n/a through 7.8...

PT-2026-121423

dnspython is a DNS toolkit for Python. Prior to 2.9.0, dns.name.from wire parser follows attacker-controlled DNS compression pointer chains without a hop limit. A malicious DNS wire-format message can force excessive pointer traversal during name decompression, causing high CPU use, application...

PT-2026-121510

MessagePack is the serializer implementation for Python msgpack.org. Prior to 1.2.3, the msgpack-python C extension msgpack. cmsgpack leaks a decoded map value when deserialization rejects a key with strict map key=True the default. Repeated malformed inputs can cause unbounded process memory...

PT-2026-121666

A flaw was found in libslirp. When handling ICMP echo requests, the reply length is not updated to match the actual data received from the host. Under specific conditions where the normal ICMP socket is unavailable, this length mismatch causes the host's real IP address to be leaked to the guest ...

PT-2026-121649

No description provided...

PT-2026-121632

No description provided...

PT-2026-121428

A missing authorization check allows anyone having access to a "link without login" for a DataApp to list and potentially access jobs of other users created by the same link in KNIME Business Hub prior to 1.19.0. As workaround remove all "links without login" to DataApps...

PT-2026-121397

In Z-Wave SDK 8.1.1 and earlier for 700/800 series devices and 6.85.02 and earlier for 500 series devices, missing checks in the ZWAVE CMD NODES EXIST handler can result in nodes being removed from the network. These messages must come from a device that has already joined the network...

PT-2026-121278

Out-of-bounds read and write in the Count-Min sketch deserialization of Apache DataSketches C++ repo: datasketches-cpp. count min sketch::deserialize did not include the preamble in its input size check, so a truncated sketch could cause a read of up to 16 bytes past the end of the input. In...

PT-2026-121294

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Codepeople Contact Form Email contact-form-to-email allows Stored XSS.This issue affects Contact Form Email: from n/a through 1.3.68...

PT-2026-121578

CFITSIO through 4.7.0 contains an out-of-bounds write vulnerability in ffgcls2 in getcols.c that trusts attacker-controlled heap descriptor lengths for variable-length string columns. Attackers can supply a crafted FITS file that overflows a fixed 28,800-byte stack buffer and the caller's string...

PT-2026-121576

Ghidra before 12.2 contains a resource allocation without limits vulnerability in FileSystemIndexHelper used by TarFileSystem and ZipFileSystem, which store unbounded archive entries. Attackers can persuade a user to open or batch-import a crafted TAR or ZIP archive with excessive entries to...

PT-2026-121403

Name of the Vulnerable Software and Affected Versions body-parser versions prior to 1.20.9 body-parser versions 2.0.0 through 2.3.x Description An issue exists where a single request can crash an application using default options. When a request uses a Content-Encoding like gzip, the software pip...

PT-2026-121628

No description provided...

PT-2026-121737

NoMachine nxwebrunner Heap-based Buffer Overflow Remote Code Execution Vulnerability...

PT-2026-121388

An issue in Systrome Validation & Certification 1.0 allows an attacker to cause a denial of service via the t URL parameter in the qrcode auth.html component...

PT-2026-121581

Vikunja 2.2.0 before 2.7.1 contains an HTML injection vulnerability in CreateConversationalHeader in pkg/notifications/mail.go that interpolates display names and task and project titles raw into email anchors. Authenticated users can craft titles or display names that close the anchor and inject...

PT-2026-120942

Grav from 2.0.0 before 2.2.5 contains an improper access control vulnerability in FlexDirectory::dynamicFlexField that allows page authors to call arbitrary Flex object methods via flex-@ directives in page frontmatter. When a user with page edit rights opens the page, directives calling...

PT-2026-121350

Kavita 0.5.2 before 0.5.4.1 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files by supplying '../' sequences in the filename parameter. Attackers can send GET requests to /api/image/cover-upload with filename values like ../appsettings.json to...

PT-2026-121411

Incorrect authorization in the Devolutions Gateway token generation in Devolutions Server 2026.3.10.0 and earlier allows an authenticated non-administrative attacker to bypass the Network Access Rules of a virtual gateway and reach denied hosts via wildcard additional destinations signed into the...

PT-2026-120950

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a cross-site scripting vulnerability in the password plugin. Error text returned by a password driver was concatenated into the message presented to the user without HTML escaping, so a backend able to influence that text, such...

PT-2026-121659

Memory allocation with excessive size value in the MQTT 3.1.1 compatibility adapter in AWS aws-c-mqtt before 0.16.2 might allow a remote actor to cause a denial of service of the client application. To remediate this issue, users should upgrade to aws-c-mqtt 0.16.2 or later, or to an AWS Common...

PT-2026-121432

CloudPirates Open Source Helm Charts is a collection of Helm charts. Prior to commit 271d415, pull request target workflow is vulnerable to cache poisoning and OIDC token theft. A pull request target workflow checks out fork code using github.event.pull request.head.sha or .head.ref. This gives...

PT-2026-120965

HAProxy 3 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service persistent worker-thread CPU exhaustion via an HTTP/1.1 chunked request. Although the H1 multiplexer drains the request before closing the stream, the parser repeatedly re-processes the same bytes without...

PT-2026-121262

NT OneAPP developed by NewType Infortech has an Authentication Bypass vulnerability. Unauthenticated local attackers can bypass the App PIN lock mechanism via a Deep Link, thereby accessing protected resources of a logged-in user...

PT-2026-122454

These are all security issues fixed in the python313-Pillow-13.0.0-1.1 package on the GA media of openSUSE Tumbleweed...

PT-2026-121682

The system control service on affected Kiloview E3 NDI encoder firmware fails to sanitize the hostname parameter accepted by its device naming endpoint, passing it unquoted into a shell command. An authenticated web user with access to this function can embed characters to execute arbitrary...