PT-2026-120503

The Contest Gallery WordPress plugin before 34.0.1 does not reliably validate the visitor identity used to enforce its one-vote-per-entry restriction, trusting a client-supplied request header and an unbound client-generated token, which allows unauthenticated users to bypass the restriction and...

PT-2026-120536

Out-of-bounds reads in URL parsing and case-insensitive header lookup in Apache bRPC before version 1.18.0 on platforms where plain char is unsigned, such as ARM64, allow remote attackers to cause a process crash and denial of service by sending crafted input containing bytes with the high bit se...

PT-2026-120211

Trigger.dev through 4.7.6 contains a missing authentication vulnerability in the supervisor workload server that allows workloads to manipulate runs belonging to other deployments without ownership verification. Attackers with network access and a valid run/snapshot pair can call the attempts/sta...

PT-2026-120575

Chamilo LMS 2.0.0 pre-releases from 2.0.0-alpha.1 before 2.0.0-RC.3 contain a missing access control vulnerability in GradebookController that allows unauthenticated users to modify gradebook certificates. Attackers can request the set default certificate endpoint with any course id and document ...

PT-2026-120589

Trudesk through 1.2.11 contains a path traversal and authorization bypass vulnerability in accountsController.uploadImage that allows authenticated users to overwrite other users' avatars via form-supplied id and username fields. Attackers can supply a username like /../../../x to bypass the...

PT-2026-120708

Name of the Vulnerable Software and Affected Versions Cisco Expressway Series affected versions not specified Description Incorrect permission assignments were identified within the software, which may lead to security risks. This issue is categorized under CWE-732, which refers to the use of...

PT-2026-120848

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.4.4 Splunk Enterprise versions prior to 10.2.8 Splunk Enterprise versions prior to 10.0.11 Description An unauthenticated user can send repeated requests to the Edge Processor package download endpoint in...

PT-2026-120706

Name of the Vulnerable Software and Affected Versions Cisco Expressway Series affected versions not specified Description An issue exists involving uncaught exceptions, which are errors that occur during program execution that the software fails to handle, leading to potential instability or...

PT-2026-120703

Name of the Vulnerable Software and Affected Versions Cisco Expressway Series affected versions not specified Description An issue involving out-of-bounds writes was identified during an internal security review. Out-of-bounds writes occur when a program writes data past the end of the intended...

PT-2026-120705

Name of the Vulnerable Software and Affected Versions Cisco Expressway Series affected versions not specified Description Issues concerning null pointers were identified during an internal security review. A null pointer is a reference that points to nothing, which can lead to application crashes...

PT-2026-120707

Name of the Vulnerable Software and Affected Versions Cisco Expressway Series affected versions not specified Description An internal security review identified issues related to code injections. This flaw allows the injection of malicious code into the system, which is categorized under CWE-94...

PT-2026-120850

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.4.4 Splunk Enterprise versions prior to 10.2.8 Splunk Enterprise versions prior to 10.0.11 Splunk Enterprise versions prior to 9.4.16 Splunk Secure Gateway versions prior to 3.10.12 Splunk Secure Gateway...

PT-2026-120155

Vyper from 0.1.0b4 before 0.3.0 contains a memory corruption vulnerability caused by an incorrect stack tip pointer when internal function calls appear inside tuples or nested calls. Contracts using such calls as tuple elements, call arguments, or builtin arguments like concat or ecrecover can...

PT-2026-120841

A security vulnerability has been detected in itsourcecode Online Cake Ordering System 1.0. Affected is an unknown function of the file /transactionsave.php. Such manipulation of the argument del leads to sql injection. The attack can be launched remotely. The exploit has been disclosed publicly...

PT-2026-120636

In the Linux kernel, the following vulnerability has been resolved: bpf: Infer zext dst based on static register liveness analysis As reported in the thread 1, the verifier's 32-bit operations zero extension logic is broken. This logic is responsible for correct semantics of 32-bit operations on...

PT-2026-120777

The kernel helper z waitq head kernel/include/wait q.h reads the head of a thread wait queue, but on SMP systems it was called from several places without holding the scheduler spinlock sched spinlock that serializes wait-queue mutation. The consequential call site is z timer expiration handler i...

PT-2026-120748

Name of the Vulnerable Software and Affected Versions YOOtheme Pro versions prior to 5.0.53 Description An issue exists that allows an unauthenticated attacker to achieve remote code execution through the image handler. Recommendations Update to version 5.0.53...

PT-2026-120606

A NULL pointer dereference in the dasher insert timeline entry function /filters/dasher.c of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service DoS via supplying a crafted MP4 file...

PT-2026-120622

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in WPdreams Ajax Search Lite ajax-search-lite allows Blind SQL Injection.This issue affects Ajax Search Lite: from n/a through 4.14.6...

PT-2026-120223

Dulwich from 0.23.1 before 1.2.8 contains a path traversal vulnerability in CommitFilter. apply index filter that allows attackers to write files outside the working directory via symlinks persisting between commits. Attackers can craft a repository where an ancestor commit's symlink redirects a...

PT-2026-120467

The Redirection for Contact Form 7 WordPress plugin before 3.2.12 does not sanitise or escape submitted form data stored as lead entries before outputting it in the lead debug metabox, allowing unauthenticated attackers to store a malicious script that executes when a logged-in user views the ent...

PT-2026-120800

Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 7.0 through 18.11.13 GitLab CE/EE versions 19.0 through 19.0.10 GitLab CE/EE versions 19.1 through 19.1.9 GitLab CE/EE versions 19.2 through 19.2.9 GitLab CE/EE versions 19.3 through 19.3.6 GitLab CE/EE versions 19.4...

PT-2026-120635

A vulnerability was found in itsourcecode Sales-and-Inventory-System up to 0a3c45a78aaff3601b8cf9ce8ba82ff5c345caac. The affected element is an unknown function of the file /pages/cust searchfrm.php. Performing a manipulation of the argument ID results in sql injection. The attack may be initiate...

PT-2026-120751

The Apache Pulsar broker exposes a transaction administration REST API under /admin/v3/transactions. When authentication and authorization are enabled, most of the read endpoints of this API verify only that the request is authenticated and that the broker serves the requested topic or transactio...

PT-2026-120548

Name of the Vulnerable Software and Affected Versions Node.js versions 26.x Node.js versions 24.x Node.js versions 22.x Description A flaw in DNS resolution allows hostnames containing a NUL byte to be silently truncated by the dns.resolve functions and dns.reverse. This occurs because the name i...

PT-2026-122472

Уязвимость программной платформы на базе git для совместной работы над кодом GitLab связана с целочисленным переполнением. Эксплуатация уязвимости может позволить нарушителю, действующему удалённо, выполнить произвольный код...

PT-2026-120689

Name of the Vulnerable Software and Affected Versions Cisco Expressway Series affected versions not specified Description Insufficient authorization checks of HTTP requests during Mobile and Remote Access MRA provisioning allow an unauthenticated remote attacker to obtain sensitive information. A...

PT-2026-120723

Apache Pulsar's MultiRolesTokenAuthorizationProvider authorizes a client with all roles listed in a claim of its JSON Web Token JWT. The provider is intended for use with token authentication, which verifies the token before authorization. The provider did not verify the token itself: it parsed t...

PT-2026-120772

The Bluetooth Classic A2DP host stores a codec Information Element IE in struct bt a2dp codec ie, a one-byte len field plus a fixed 8-byte codec ie array. When an AVDTP peer sent a codec IE longer than 8 bytes, a2dp process config ind in subsys/bluetooth/host/classic/a2dp.c copied only the first ...

PT-2026-120810

toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, the toml.parse compiler's addTableArray function in lib/compiler.js rescans the complete assignedPaths and valueAssignments bookkeeping sets for every array-of-tables header. Distinct name paths are not pruned, so a document...

PT-2026-120746

Name of the Vulnerable Software and Affected Versions Apache Traffic Server versions 8.0.0 through 8.1.11 Apache Traffic Server versions 9.0.0 through 9.2.15 Apache Traffic Server versions 10.0.0 through 10.1.4 Apache Traffic Server version 10.2.0 Description When a client sends a POST request wi...

PT-2026-120685

Name of the Vulnerable Software and Affected Versions Cisco products affected versions not specified Description A flaw exists in the generic routing encapsulation GRE tunnel decapsulation feature of the Snort 3 Detection Engine. The issue stems from improper handling of nested GRE traffic, which...

PT-2026-120833

Name of the Vulnerable Software and Affected Versions Pillow versions 11.0.0 through 12.x Description Multi-frame loaders in this Python imaging library can retain an ImagingCore allocation created for a narrow frame mode. When a subsequent frame of the same dimensions changes the logical mode an...

PT-2026-120831

Name of the Vulnerable Software and Affected Versions Pillow versions prior to 13.0.0 Description In the Pillow Python imaging library, the MpoImageFile.seek and DcxImageFile.seek functions reparse subsequent MPO or DCX frames and update the self. size variable without re-executing the Image...

PT-2026-120805

Name of the Vulnerable Software and Affected Versions @sentry/nextjs versions 9.36.0 through 9.47.1 @sentry/nextjs versions 10.x through 10.75.1 @sentry/nextjs versions 11.0.0-rc.0 Description The webpack integration for @sentry/nextjs skips application middleware for every request path under a...

PT-2026-120195

Trigger.dev before 4.6.0 contains an improper authorization vulnerability in the GET /api/v1/projects/:projectRef/envvars endpoint, which returns the environment's root API key as TRIGGER SECRET KEY for staging, production, and preview environments. Attackers holding a restricted read:envvars key...

PT-2026-120649

Insertion of sensitive information into a log file in the SMTP server of Progressive Robot hMailServer 6.0.0 through 6.3.6 allows a local user who can read the server's log, or anyone given a copy of it, to obtain credentials. With SMTP logging enabled, the server hid the credential of an AUTH...

PT-2026-120208

Trigger.dev before 4.6.2 contains an authorization vulnerability that allows public-token holders with session write access to obtain environment-wide S2 stream credentials via session input initialization. Attackers can use the credential directly against the storage API to append, create, or tr...

PT-2026-120851

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.4.3 Splunk Enterprise versions prior to 10.2.8 Splunk Enterprise versions prior to 10.0.11 Splunk Enterprise versions prior to 9.4.16 Description A user with the edit manager xml capability can execute...

PT-2026-120455

The Backup and Staging by WP Time Capsule WordPress plugin before 1.22.28 does not perform capability or nonce checks on the handler that deploys a staging site to the live site, allowing any authenticated user with a Subscriber account on a WP Time Capsule staging site to overwrite the separate...

PT-2026-120697

Name of the Vulnerable Software and Affected Versions Cisco Emergency Responder affected versions not specified Cisco Prime Collaboration Deployment affected versions not specified Cisco Unified Communications Manager Unified CM affected versions not specified Cisco Unified Communications Manager...

PT-2026-122481

Уязвимость микропрограммного обеспечения шлюза Cisco Expressway связана с недостаточным контролем ресурса в период его существования. Эксплуатация уязвимости может позволить нарушителю оказать воздействие на конфиденциальность, целостность и доступность защищаемой информации...

PT-2026-120726

When package management is enabled, Pulsar Functions, Sources and Sinks can be registered or updated from a package stored in the Pulsar Packages Management Service by supplying a package URL. The Pulsar Functions worker authorized these requests only against the namespace in which the component...

PT-2026-120662

Name of the Vulnerable Software and Affected Versions pypdf versions prior to 6.21.0 Description An attacker can craft a PDF containing a content stream with numerous small operations. When the library parses such a file, it consumes excessive amounts of memory, leading to a denial of service...

PT-2026-120902

This module provides a user interface to select and configure icons, including a form element, a text format filter and several integrations. The module doesn't sufficiently validate icon settings provided by users before they are rendered...

PT-2026-120856

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.4.4 Splunk Enterprise versions prior to 10.2.8 Description A user without admin or power roles can derive the PostgreSQL sidecar database superuser password. This occurs because the PostgreSQL sidecar...

PT-2026-120786

Apache Traffic Server allows request smuggling via HEAD requests that carry Content-Length or Transfer-Encoding. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0. Users are recommended to upgrade to version 9.2.16,...

PT-2026-120605

A NULL pointer dereference in the StatSFVec2f function /scene manager/scene stats.c of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service DoS via supplying a crafted MPEG-4 file...

PT-2026-120607

An out-of-bounds read in gf odf ac4 cfg dsi v1 /odf/descriptors.c in GPAC Project/MP4Box before v26.07.0 allows attackers to cause a Denial of Service DoS via supplying a crafted AC4 file...

PT-2026-120627

A use-after-free in the gf filter packet destroy function /filter core/filter pck.c of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service DoS via supplying a crafted MPEG-2 file...