PT-2026-121676

Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.0, OpenIDImplicitGrant.validate authorization request checks the client-controlled raw request.payload.scope for openid after the parent grant has filtered allowed scopes into request.scope. A registered clien...

PT-2026-121677

Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.0, Authlib's RFC 9101 JWTAuthenticationRequest passes the unauthenticated, client-controlled request uri parameter to the abstract get request object hook before applying a destination or registration policy;...

PT-2026-121413

Name of the Vulnerable Software and Affected Versions opentelemetry-api versions 1.0.0 through 1.45.0 Description The TraceState.from header function in opentelemetry/trace/span.py, which is accessed via TraceContextTextMapPropagator.extract, uses a regular expression to parse inbound W3C...

PT-2026-121528

Mistune from 3.0.0 before 3.3.0 contains an algorithmic complexity vulnerability in the inline link parser's parse link text function that allows unauthenticated attackers to exhaust CPU with unbalanced brackets. Attackers can submit Markdown containing many unbalanced '' or '!' characters, forci...

PT-2026-121533

Mistune before 3.3.0 contains a path traversal vulnerability in the RST include directive that allows attackers to read arbitrary files by supplying relative or absolute paths. Attackers can submit markdown containing include directives referencing ../ sequences or absolute paths to embed sensiti...

PT-2026-121318

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in nicdark ND Shortcodes For Visual Composer nd-shortcodes allows Stored XSS.This issue affects ND Shortcodes For Visual Composer: from n/a through 7.8...

PT-2026-121423

dnspython is a DNS toolkit for Python. Prior to 2.9.0, dns.name.from wire parser follows attacker-controlled DNS compression pointer chains without a hop limit. A malicious DNS wire-format message can force excessive pointer traversal during name decompression, causing high CPU use, application...

PT-2026-121510

MessagePack is the serializer implementation for Python msgpack.org. Prior to 1.2.3, the msgpack-python C extension msgpack. cmsgpack leaks a decoded map value when deserialization rejects a key with strict map key=True the default. Repeated malformed inputs can cause unbounded process memory...

PT-2026-121649

No description provided...

PT-2026-121632

No description provided...

PT-2026-121428

A missing authorization check allows anyone having access to a "link without login" for a DataApp to list and potentially access jobs of other users created by the same link in KNIME Business Hub prior to 1.19.0. As workaround remove all "links without login" to DataApps...

PT-2026-121397

In Z-Wave SDK 8.1.1 and earlier for 700/800 series devices and 6.85.02 and earlier for 500 series devices, missing checks in the ZWAVE CMD NODES EXIST handler can result in nodes being removed from the network. These messages must come from a device that has already joined the network...

PT-2026-121278

Out-of-bounds read and write in the Count-Min sketch deserialization of Apache DataSketches C++ repo: datasketches-cpp. count min sketch::deserialize did not include the preamble in its input size check, so a truncated sketch could cause a read of up to 16 bytes past the end of the input. In...

PT-2026-121294

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Codepeople Contact Form Email contact-form-to-email allows Stored XSS.This issue affects Contact Form Email: from n/a through 1.3.68...

PT-2026-121578

CFITSIO through 4.7.0 contains an out-of-bounds write vulnerability in ffgcls2 in getcols.c that trusts attacker-controlled heap descriptor lengths for variable-length string columns. Attackers can supply a crafted FITS file that overflows a fixed 28,800-byte stack buffer and the caller's string...

PT-2026-121576

Ghidra before 12.2 contains a resource allocation without limits vulnerability in FileSystemIndexHelper used by TarFileSystem and ZipFileSystem, which store unbounded archive entries. Attackers can persuade a user to open or batch-import a crafted TAR or ZIP archive with excessive entries to...

PT-2026-121737

NoMachine nxwebrunner Heap-based Buffer Overflow Remote Code Execution Vulnerability...

PT-2026-120942

Grav from 2.0.0 before 2.2.5 contains an improper access control vulnerability in FlexDirectory::dynamicFlexField that allows page authors to call arbitrary Flex object methods via flex-@ directives in page frontmatter. When a user with page edit rights opens the page, directives calling...

PT-2026-121350

Kavita 0.5.2 before 0.5.4.1 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files by supplying '../' sequences in the filename parameter. Attackers can send GET requests to /api/image/cover-upload with filename values like ../appsettings.json to...

PT-2026-121411

Incorrect authorization in the Devolutions Gateway token generation in Devolutions Server 2026.3.10.0 and earlier allows an authenticated non-administrative attacker to bypass the Network Access Rules of a virtual gateway and reach denied hosts via wildcard additional destinations signed into the...

PT-2026-120950

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a cross-site scripting vulnerability in the password plugin. Error text returned by a password driver was concatenated into the message presented to the user without HTML escaping, so a backend able to influence that text, such...

PT-2026-121659

Memory allocation with excessive size value in the MQTT 3.1.1 compatibility adapter in AWS aws-c-mqtt before 0.16.2 might allow a remote actor to cause a denial of service of the client application. To remediate this issue, users should upgrade to aws-c-mqtt 0.16.2 or later, or to an AWS Common...

PT-2026-121682

The system control service on affected Kiloview E3 NDI encoder firmware fails to sanitize the hostname parameter accepted by its device naming endpoint, passing it unquoted into a shell command. An authenticated web user with access to this function can embed characters to execute arbitrary...

PT-2026-120940

Grav Login plugin from 3.6.0 before 3.9.13 contains a missing authorization vulnerability in the login.invite task that allows page authors to obtain super user accounts. Attackers can define an invitation form granting super access in page frontmatter, submit it unauthenticated, and register the...

PT-2026-121563

Wasmtime 46.0.0 before 48.0.4 and 49.0.0 before 49.0.2 contains a denial of service vulnerability in the wasmtime-wasi WASIp3 implementation that allows guests to abort the Unix host process. Guests with mutable preopened directory access can call set-times or set-times-at with negative seconds...

PT-2026-121335

A flaw was found in Goose. When the terminal integration feature is enabled, the application captures shell command history and sends it verbatim without sanitization to configured Large Language Model LLM provider endpoints during queries. If a user enters sensitive data—such as API tokens,...

PT-2026-120933

Traefik v3.7.0 before v3.7.14 contains an improper authentication vulnerability in the Kubernetes Ingress NGINX provider that merges client CAs when auth-tls-secret names collide after dot-to-dash normalization. Attackers holding certificates from another host's CA can access a host requiring its...

PT-2026-121377

Discourse 1.9.0.beta2 before 1.9.0.beta13 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through the email parameter of /email/unsubscribed. Attackers can craft GET requests with SVG onload payloads, which unsubscribed.html.erb...

PT-2026-120934

Traefik 2.11.0 before 2.11.58 and 3.0.0 before 3.7.14 contains an authentication bypass because a first request preauthenticated with an Authorization: Negotiate token authenticates a socket in the globally shared backend connection pool, which is never isolated. Unauthenticated attackers on...

PT-2026-121617

No description provided...

PT-2026-121505

Name of the Vulnerable Software and Affected Versions LiteLLM versions 1.87.0 through 1.100.3 LiteLLM versions 1.101.0 through 1.101.2 LiteLLM versions 1.102.0 through 1.102.1 LiteLLM versions 1.103.0 LiteLLM versions 1.104.0-rc.0 through 1.104.0-rc.1 Description LiteLLM reuses a single...

PT-2026-121502

A reflected cross-site scripting XSS vulnerability in localstack v4.9.2 allows attackers to execute arbitrary Javascript in the context of the user's browser via a crafted URL...

PT-2026-121483

SmileCDR HAPI FHIR does not properly handle highly compressed data, allowing an unauthenticated attacker to send compressed payloads that exhaust server heap or crash certain services when decompressed...

PT-2026-121484

SmileCDR HAPI FHIR allows an untrusted bundle body to replace a partition identity previously established by a trusted source, and does not enforce storage partition entitlement by default. An attacker authorized for one tenant can read from or write to another tenant's partition...

PT-2026-121657

Motor.NET before 0.19.0 contains an uncaught exception vulnerability in JsonNetDeserializer.Deserialize that allows a remote attacker who can publish to a consumed queue or topic to crash the service permanently by sending structurally valid JSON that does not match the handler's expected type...

PT-2026-121370

Lotus through 0.10.2 contains an sql injection vulnerability that allows authenticated organization users to inject SQL by registering crafted subscription filter keys that bypass keyword-only validation. Attackers can create subscriptions using the malicious key, which is rendered as an unquoted...

PT-2026-120936

Traefik 2.11.x before 2.11.58 and 3.x before 3.7.14 contains a race condition in NTLM and Kerberos Negotiate backend authentication, where the per-connection sticky round tripper slot is read and written without synchronization. Remote attackers can send concurrent HTTP/2 or HTTP/3 requests over...

PT-2026-121291

A flaw was found in mod qos. When inspecting HTTP response bodies, improper boundary checking can cause the module to read memory outside allocated buffer boundaries. An unauthenticated remote attacker can exploit this vulnerability by triggering specifically crafted server responses, causing an...

PT-2026-121587

Name of the Vulnerable Software and Affected Versions AOS-8 affected versions not specified Description An unauthenticated remote attacker can perform SQL injection attacks against the affected interface of AOS-8. This flaw could lead to the execution of arbitrary commands on the underlying...

PT-2026-121624

No description provided...

PT-2026-121360

Bytebase before 3.16.0 contains an authorization bypass vulnerability in GetTaskRunLog, GetTaskRunSession and PreviewTaskRunRollback that allows authenticated users to access other projects' task runs by UID. Attackers with permission on one project can supply foreign task or task run UIDs to rea...

PT-2026-121295

Allocation of Resources Without Limits or Throttling vulnerability in esaml in dropbox esaml allows an unauthenticated attacker to exhaust the Erlang VM atom table and crash the node via unsigned LogoutResponse messages. esaml:status code map/1 in src/esaml.erl maps any StatusCode value it does n...

PT-2026-121592

No description provided...

PT-2026-121666

A flaw was found in libslirp. When handling ICMP echo requests, the reply length is not updated to match the actual data received from the host. Under specific conditions where the normal ICMP socket is unavailable, this length mismatch causes the host's real IP address to be leaked to the guest ...

PT-2026-121623

No description provided...

PT-2026-121400

Name of the Vulnerable Software and Affected Versions multer versions 2.0.0 through 2.4.9 Description A race condition exists in the multipart parser when configured with an asynchronous fileFilter function. If a request is aborted while an asynchronous fileFilter is still pending, the callback m...

PT-2026-121486

fpdf2 is a PDF creation library for Python. From 2.5.0 until 2.8.8, fpdf2's SVGObject.build xref passes nested SVG references to GraphicsContext.add item, whose default clone=True deep-copy behavior copies the complete referenced graphics tree during FPDF.image processing. Repeating references at...

PT-2026-121266

The HIPAA Forms WordPress plugin before 3.3.2 does not perform a capability check when handling a request that rebuilds its own custom user role, allowing a user who already holds that role to grant it administrator-level capabilities and escalate their privileges...

PT-2026-121265

The WP Ultimate Review WordPress plugin before 2.4.5 does not neutralise shortcodes in all of the review fields submitted through its public review form, which is available to unauthenticated visitors, allowing them to execute arbitrary shortcodes when the affected field is displayed, provided us...

PT-2026-121340

WooThemes Diarise through 1.5.9 contains a file read vulnerability that allows unauthenticated attackers to read arbitrary files through the calendar parameter of download.php. Attackers can send GET requests with file:// scheme paths to the calendar parameter to disclose sensitive files like...