414787 matches found
PT-2026-121629
No description provided...
PT-2026-121630
No description provided...
PT-2026-121649
No description provided...
PT-2026-121509
@0x Osprey I'm waiting for the CVE-2026-999999 "buffer overflow in CVE number in cyber monitoring tool" 😆...
PT-2026-121489
Missing authentication for critical function vulnerability in ABB Ability Edgenius. This issue affects Ability Edgenius: through 3.2.3.0...
PT-2026-121428
A missing authorization check allows anyone having access to a "link without login" for a DataApp to list and potentially access jobs of other users created by the same link in KNIME Business Hub prior to 1.19.0. As workaround remove all "links without login" to DataApps...
PT-2026-121592
No description provided...
PT-2026-121571
Wasmtime before 24.0.12, 25.0.0 before 36.0.13, 37.0.0 before 46.0.2, and 47.0.0 before 47.0.3 contains a type confusion vulnerability because several Store APIs fail to validate that objects belong to the Store's Engine. Embedders mixing objects between Engines via Instance::new,...
PT-2026-121427
Incorrect authorization checks in Amazon Athena engine version 3 query processing could have allowed an authenticated user to read AWS account identifiers and SQL statement text query metadata from other AWS accounts. Query results, and data stored in Amazon S3 or other data sources, were not...
PT-2026-121606
No description provided...
PT-2026-121508
Missing security attributes on sensitive cookies in KNIME Business Hub before version 1.19.0 allow an unauthenticated remote attacker to compromise user sessions if other security issues such as a cross-site scripting vulnerability or a man-in-the-middle attack are present. A workaround is not...
PT-2026-121633
No description provided...
PT-2026-121432
CloudPirates Open Source Helm Charts is a collection of Helm charts. Prior to commit 271d415, pull request target workflow is vulnerable to cache poisoning and OIDC token theft. A pull request target workflow checks out fork code using github.event.pull request.head.sha or .head.ref. This gives...
PT-2026-121333
Name of the Vulnerable Software and Affected Versions webpack-dev-server versions prior to 5.2.7 webpack-dev-server version 6.0.0 Description When a proxy entry is configured to forward WebSockets, the server forwards non-HMR Hot Module Replacement WebSocket upgrade requests to the proxy target...
PT-2026-121362
mem0 0.1.117 before 1.0.8 contains an sql injection vulnerability in mem0/vector stores/databricks.py that allows attackers to inject SQL by influencing stored memory content. Attackers can supply crafted memory text, metadata, or message names that reach unescaped insert and update string...
PT-2026-121278
Out-of-bounds read and write in the Count-Min sketch deserialization of Apache DataSketches C++ repo: datasketches-cpp. count min sketch::deserialize did not include the preamble in its input size check, so a truncated sketch could cause a read of up to 16 bytes past the end of the input. In...
PT-2026-121589
Name of the Vulnerable Software and Affected Versions AOS-8 affected versions not specified Description An issue in the affected interface allows an unauthenticated remote attacker to bypass authentication controls and execute arbitrary commands as root on the underlying operating system,...
PT-2026-121518
The MongoDB C Driver does not reject replacement documents whose top-level field names begin with a dollar sign in FindOneAndReplace, unlike other replace operations. An application that builds such a document from user-supplied field names can have the server apply update operators instead of a...
PT-2026-121601
No description provided...
PT-2026-121610
No description provided...
PT-2026-121576
Ghidra before 12.2 contains a resource allocation without limits vulnerability in FileSystemIndexHelper used by TarFileSystem and ZipFileSystem, which store unbounded archive entries. Attackers can persuade a user to open or batch-import a crafted TAR or ZIP archive with excessive entries to...
PT-2026-121538
Name of the Vulnerable Software and Affected Versions OpenBao versions prior to 2.6.3 Description An information disclosure issue exists where attackers can leak sensitive data into audit logs by sending malformed plugin parameters. By submitting requests with malformed TypeKVPair or TypeHeader...
PT-2026-121539
Name of the Vulnerable Software and Affected Versions OpenBao versions prior to 2.6.4 OpenBao versions 2.7.x prior to 2.7.1 Description A flaw exists in the rate limit quota subsystem where role resolution fails for requests containing form-encoded bodies or forwarded certificates. This failure...
PT-2026-121545
Name of the Vulnerable Software and Affected Versions OpenBao versions 2.3.0 through 2.6.2 Description An incorrect authorization issue exists in the ACL policy cache. This allows tokens to reference policies from arbitrary namespaces through the use of specially crafted policy names. Consequentl...
PT-2026-121546
Name of the Vulnerable Software and Affected Versions OpenBao versions 2.3.0 through 2.6.2 Description An improper authorization issue exists where privileged child-namespace tokens can modify plugin registrations. This occurs because the endpoint '/v1/sys/plugins/catalog/' is not restricted to t...
PT-2026-121537
Name of the Vulnerable Software and Affected Versions OpenBao versions prior to 2.6.4 OpenBao versions 2.7.x prior to 2.7.1 Description Failure to write response audit entries occurs for the unauthenticated 'sys/generate-root', 'sys/rekey', and 'sys/rekey-recovery-key' endpoints when request audi...
PT-2026-121541
Name of the Vulnerable Software and Affected Versions OpenBao versions prior to 2.6.3 Description An ACL bypass occurs when explicit deny rules based on forbidden identity metadata templates within wildcard grants are silently dropped. This allows attackers with identity metadata containing...
PT-2026-121542
Name of the Vulnerable Software and Affected Versions OpenBao versions prior to 2.6.4 OpenBao versions 2.7.x prior to 2.7.1 Description The AppRole authentication method fails to verify the expiration of the Secret ID during use. This allows an attacker possessing an expired Secret ID that has no...
PT-2026-121544
Name of the Vulnerable Software and Affected Versions OpenBao versions prior to 2.6.3 Description A missing authorization check allows attackers to stop Agent and Proxy services by omitting the X-Vault-Header. When the require request header setting is enabled, attackers can utilize server-side...
PT-2026-121268
The PixelYourSite WordPress plugin before 11.4.3, PixelYourSite Pro WordPress plugin before 12.6.8 do not sanitise and escape a cookie value before printing it into the page output, which, on a site running a full-page cache, allows unauthenticated attackers to store a Cross-Site Scripting payloa...
PT-2026-121515
The MongoDB C Driver's BSON library contains an uncontrolled resource consumption weakness in its deserialization handling of one BSON value type. An application that deserializes untrusted content with the library retains data derived from that content for the lifetime of the process, with no...
PT-2026-121406
CleanShot X for macOS insecurely deserializes untrusted data embedded in a .cleanshot project file editable screenshot annotations. Exploitation requires an attacker to craft a malicious .cleanshot file, deliver it to the target, and have the target open it; the payload then executes automaticall...
PT-2026-121501
An issue was discovered in localstack 4.9.2 allowing attackers to execute arbitrary code via crafted content hosted on a web-accessable URL and when passed said URL in the the templateURL to the localstack/cloudformation/deploy endpoint, the hosted content can get executed in the context of the...
PT-2026-122450
These are all security issues fixed in the gotosocial-0.22.3-1.1 package on the GA media of openSUSE Tumbleweed...
PT-2026-121582
Crawl4AI 0.7.0 before 0.9.5 contains an inefficient regular expression complexity vulnerability in the Docker API server that allows authenticated API clients to supply unbounded regular expressions in /crawl request bodies. Attackers can submit catastrophic-backtracking patterns via...
PT-2026-121600
No description provided...
PT-2026-121682
The system control service on affected Kiloview E3 NDI encoder firmware fails to sanitize the hostname parameter accepted by its device naming endpoint, passing it unquoted into a shell command. An authenticated web user with access to this function can embed characters to execute arbitrary...
PT-2026-121566
wasmtime-wasi-http in Wasmtime before 36.0.16, 37.0.0 before 48.0.3, and 49.0.0 before 49.0.1 does not enforce the wasi:io/streams check-write allowance for WASIp2 outgoing HTTP bodies, so oversized writes succeed instead of trapping. A malicious guest can pass large buffers to write on...
PT-2026-121596
No description provided...
PT-2026-121559
Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 contains an unbounded memory allocation in the wasmtime-wasi WASIp2 write-zeroes method of SinkOutputStream, the default stream used when stdout/stderr are not configured. A malicious WebAssembly guest can request huge...
PT-2026-121415
An excessive resource allocation issue in the remote workflow editing capabilities of KNIME Business Hub prior to version 1.19.0 allows a authenticated attack to exhaust resources on the server side. This leads to intermittent unavailability of workflow execution functionality. A workaround is no...
PT-2026-121410
Insufficient protection of sensitive information in the user list endpoint in Devolutions Server 2026.3.10.0 and earlier allows an authenticated attacker with delegated user view permissions to obtain the MFA secrets of all users via the user list API response...
PT-2026-121341
Sickbeard through build-507 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through the pattern parameter of /config/postProcessing/testNaming. Attackers can craft GET requests with malicious SVG onload payloads that the testNaming...
PT-2026-121319
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in hupe13 Extensions for Leaflet Map extensions-leaflet-map allows Stored XSS.This issue affects Extensions for Leaflet Map: from n/a through 6.0...
PT-2026-121383
A cPanel PHP update fixes PHP2Shell flaws CVE-2026-109618 and CVE-2026-109619, while WP Toolkit 6.11.5 patches CVE-2026-107663. cPanel PHP2Shell WPToolkit CVE2026109618 CVE2026109619 CVE2026107663 WebHosting CyberSecurity https://t.co/ikmFgnMsGV...
PT-2026-121688
@MarkusEicher70 MacMarkus, as you are asking, here a stupid question The list below looks complete, but something is missing! For sure! CVSS=9.2 October 21st 2026 1. PHP Engine vulerability – "PHP2Shell" CVE-2026-109618 and CVE-2026-109619 Patched Versions: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35...
PT-2026-122452
These are all security issues fixed in the matomo-5.14.2-1.1 package on the GA media of openSUSE Tumbleweed...
PT-2026-121643
No description provided...
PT-2026-121425
Better Auth is an authentication and authorization library for TypeScript. From 1.4.0-beta.18 until 1.7.7, deployments that enable Magic Link with storeToken set to plain, or with storeToken set to hashed and the global verification.storeIdentifier setting also set to hashed, enable a built-in...