414787 matches found
PT-2026-120475
The TI WooCommerce Wishlist WordPress plugin before 2.13.0 does not enforce the same owner-only access control on its REST API that it applies on the front-end, allowing unauthenticated users to read the metadata and item contents of private wishlists...
PT-2026-120888
Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 10.1 through 19.3.5 GitLab CE/EE versions 19.4 through 19.4.2 GitLab CE/EE versions 19.5 through 19.5.0 Description An issue exists when OmniAuth SAML and LDAP auto-linking are both enabled. An authenticated user can take...
PT-2026-120773
The user-mode verifier for the peci transfer system call, z vrfy peci transfer in drivers/peci/peci handlers.c, checked only the device object permission and copied the caller-supplied struct peci msg with k usermode from copy. That copy validates the outer structure only; the buf pointers and le...
PT-2026-120844
A weakness has been identified in oretnom23 php-travel-agency-system. This issue affects some unknown processing of the file admin/update.php. This manipulation of the argument action/full name/visa no/hiden/title/description/page id/user causes sql injection. The attack may be initiated remotely...
PT-2026-120825
A vulnerability was determined in itsourcecode Online Cake Ordering System 1.0. The affected element is an unknown function of the file /orderdetail.php. Executing a manipulation of the argument ID can lead to sql injection. The attack may be performed from remote. The exploit has been publicly...
PT-2026-120838
Name of the Vulnerable Software and Affected Versions Laravel versions 12.45.0 through 12.67.0 Laravel version 13.26.0 and earlier Description A crafted relationship inclusion on a read-only endpoint can trigger a destructive database operation on a related table instead of retrieving data. This...
PT-2026-120742
gin-vue-admin through 2.9.2 contains a path traversal vulnerability that allows authenticated administrators to recursively delete arbitrary directories by supplying traversal sequences in the pluginName parameter. Attackers can send a crafted POST request to /autoCode/removePlugin with '../'...
PT-2026-120815
Name of the Vulnerable Software and Affected Versions itsourcecode Online Cake Ordering System version 1.0 Description A remote SQL injection is possible due to improper handling of the ID argument within the '/deleteproduct.php' endpoint. SQL injection is a technique where an attacker inserts...
PT-2026-120738
A vulnerability was identified in ProjectWorlds Advanced Library Management System 1.0. The affected element is the function mysqli query of the file individual report search.php. Such manipulation of the argument roll number leads to sql injection. The attack may be launched remotely. The exploi...
PT-2026-120783
A vulnerability was detected in HarnessRouter up to 0.31.10. This affects an unknown function of the file gateway/app.py of the component Identity Mode. Performing a manipulation of the argument X-Harness-Org/X-Harness-Member results in improper authorization. The attack is possible to be carried...
PT-2026-120644
A vulnerability was identified in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. This affects the function Login of the file admin class.php. The manipulation of the argument username/password leads to sql injection. Remote exploitation of the attack is...
PT-2026-120659
Lagoon is an application delivery platform for Kubernetes. Versions prior to 2.33.1 have a vulnerability in the ssh service in Lagoon core that would allow an attacker to execute arbitrary code which could lead to, among other things, elevated administrative permissions. It is mitigated by the fa...
PT-2026-120472
The WholesaleX WordPress plugin before 3.0.9 does not check that a stored account confirmation code is set before comparing it with the one supplied in a request, allowing unauthenticated users to activate pending accounts and bypass the administrator approval required before login...
PT-2026-120801
Name of the Vulnerable Software and Affected Versions Jupyter Server versions 2.0.0 through 2.6.0 Description An authorization bypass exists when GatewayClient.url is enabled, causing the KernelWebsocketHandler to be replaced by WebSocketChannelsHandler. While this handler authenticates the user,...
PT-2026-120802
Name of the Vulnerable Software and Affected Versions Django REST framework versions 3.6.4 through 3.18.1 Description The JSONParser.parse function in rest framework/parsers.py uses the client-supplied Content-Type charset value with codecs.getreader. This allows the use of byte-transform codecs,...
PT-2026-120731
Name of the Vulnerable Software and Affected Versions Astro versions prior to 7.3.2 Description The JSX and MDX rendering pipeline in the astro:jsx renderer treats string children of script and style elements as trusted HTML. It fails to distinguish between compiler-generated literal content and...
PT-2026-120732
Name of the Vulnerable Software and Affected Versions stream-json versions 2.0.0 through 3.6.9 Description FlexAssembler compiles string and regular-expression path filters into matchers that join the full key stack on every container start. Due to unbounded object or array nesting, a document...
PT-2026-120761
The Pulsar Packages Management Service can be configured to store packages on the local filesystem of the broker by using the filesystem storage provider. Package names consist of a type, tenant, namespace, name and version. Authorization of package operations is based only on the tenant and...
PT-2026-120448
The Ettrick Escape Room Booking WordPress plugin before 1.3.1 does not verify a booking's payment status against the payment provider before marking it paid and confirmed, allowing unauthenticated attackers to mark bookings as paid without paying...
PT-2026-120445
The Payment Gateway for Idram WordPress plugin before 2.1.6 does not verify the authenticity of incoming payment notifications, because the merchant credentials used to compute their checksum are empty by default, allowing unauthenticated attackers to forge a valid payment confirmation and mark...
PT-2026-120756
The Pulsar Functions worker REST API provides two endpoints that return the catalog of Pulsar IO connectors installed on the functions worker: the worker connectors endpoint /admin/v2/worker/connectors and the deprecated functions connectors endpoint /admin/v2/functions/connectors and...
PT-2026-120447
The Falang multilanguage for WordPress plugin before 1.4.6 does not perform a capability check when saving term translations, and exposes a valid nonce to any logged-in user through an unprotected handler, allowing users with Subscriber-level access and above to store content that is later output...
PT-2026-120757
Apache Pulsar shadow topics PIP-180 are topics that read the stored messages of a source topic from that topic's managed ledger. The source topic is selected by setting the reserved topic property PULSAR.SHADOW SOURCE. The admin REST API accepts this property when creating a non-partitioned or...
PT-2026-120453
The Uncanny Toolkit for LearnDash WordPress plugin before 3.8.2 does not validate the origin of a password-reset request, allowing an unauthenticated attacker to set the password of a user who is partway through a password reset to an attacker-chosen value through a forged request, resulting in...
PT-2026-120288
A flaw has been found in itsourcecode Online Cake Ordering System 1.0. Affected by this vulnerability is an unknown functionality of the file /deletecustomer.php. This manipulation of the argument ID causes sql injection. The attack is possible to be carried out remotely. The exploit has been...
PT-2026-120438
A security vulnerability has been detected in DT42 BerryNet up to 3.10.2. The affected element is the function DLModelManager.get model meta of the file berrynet/dlmodelmgr.py of the component Model Package Metadata Handler. The manipulation of the argument label leads to path traversal. The atta...
PT-2026-120213
Trigger.dev before 4.5.6 self-hosted Docker Compose deployments using the default secrets from hosting/docker/.env.example allow authentication bypass because the hardcoded MAGIC LINK SECRET lets anyone forge valid magic link tokens. Unauthenticated attackers can log in as any email address, then...
PT-2026-120203
Trigger.dev before 4.5.6 contains an authorization bypass vulnerability in createDeploymentBackgroundWorkerV4 that resolves a WorkerDeployment by friendlyId alone, without environment, project, or organization scoping. Attackers holding only their own environment API key can POST to the deploymen...
PT-2026-120178
vLLM after 0.24.0 and before 0.31.0 contains a memory exhaustion vulnerability in MOSS-Audio model serving that caches a processor for every distinct request-controlled mm processor kwargs value in an unbounded dictionary. Unauthenticated attackers can send distinct or oversized mel config values...
PT-2026-120187
Name of the Vulnerable Software and Affected Versions SvelteKit @sveltejs/kit versions prior to 3.0.0 Description Prerendered pages are subject to cross-site scripting XSS because a cache-control header value defined via the setHeaders function is inserted into a tag without proper escaping. An...
PT-2026-120193
Trigger.dev 4.5.0 before 4.6.2 contains an improper authorization vulnerability in the PUT snapshot-url session endpoint that allows public session token holders to obtain presigned S3 write URLs. End users can overwrite their own session's durable chat snapshot to forge the agent's conversation...
PT-2026-120686
Name of the Vulnerable Software and Affected Versions Snort 3 affected versions not specified Description An issue exists involving incorrect calculations, categorized under Common Weakness Enumeration CWE Base CWE-682. Recommendations At the moment, there is no information about a newer version...
PT-2026-120202
Trigger.dev before 4.5.2 contains a blind server-side request forgery vulnerability that allows authenticated tenants to make the webapp server send POST requests to internal hosts by setting an unvalidated webhook alert channel URL. Attackers can point the webhook at internal services or cloud...
PT-2026-120579
Trudesk through 1.2.11 contains an authorization bypass vulnerability that allows authenticated users to read tickets outside their groups via GET /api/v1/tickets/:uid. Attackers can enumerate sequential ticket uids to read every ticket's subject, issue, comments, owner and assignee, because the...
PT-2026-120642
Name of the Vulnerable Software and Affected Versions NTPsec ntpd versions 1.1.4 through 1.2.5 Description An out-of-bounds read occurs during the parsing of NTS extension fields. A remote attacker can cause the daemon to crash by providing an NTS Authenticator and Encrypted Extension Fields AEEF...
PT-2026-120639
Name of the Vulnerable Software and Affected Versions NTPsec ntpd versions 1.1.4 through 1.2.5 Description A reachable exit in the daemon allows a remote attacker to cause a termination of the service. This occurs when the system processes an NTS Network Time Security request containing an...
PT-2026-120641
Name of the Vulnerable Software and Affected Versions NTPsec ntpd versions prior to 1.2.6 Description An out-of-bounds read exists in the Motorola Oncore refclock driver. An attacker who controls the GPS receiver's serial data can cause the ntpd process to crash or disclose memory by sending a PP...
PT-2026-120246
Deserialization of untrusted data in Mandiant FLARE capa releases before 10.0.0 allows arbitrary code execution when a crafted .viv or .exe.viv workspace is passed to the capa utility...
PT-2026-120466
The AI Engine WordPress plugin before 3.8.6 does not check that the caller is allowed to edit the targeted object before updating its title and excerpt, allowing users with the Editor role and above to modify arbitrary posts of any type, including content they cannot otherwise edit such as...
PT-2026-120173
FreeRDP from 2.0.0 before 3.32.0 contains an improper certificate validation vulnerability in its proxy that accepts untrusted target TLS certificates when no verification module is configured. Network-positioned attackers can intercept the proxy's outbound connection and present a self-signed,...
PT-2026-120176
Name of the Vulnerable Software and Affected Versions vLLM versions prior to 0.31.0 Description The software uses a client-supplied multimodal uuid verbatim as a cache identity without performing consistency checks on cache hits. This allows unauthenticated attackers to desynchronize the P0/P1...
PT-2026-120171
FreeRDP before 3.32.1 contains a heap-based buffer overflow in the server-side rdpsnd channel because an integer wraparound in rdpsnd server select format DVI ADPCM block-alignment arithmetic bypasses validation. A malicious RDP client can send two SNDC FORMATS PDUs with an nBlockAlign too small...
PT-2026-120459
The HireZoot WordPress plugin before 4.1.1 does not sanitise and escape some of its stored data before outputting it in the admin dashboard, and additionally reverses the HTML-entity encoding that would otherwise neutralise it, allowing users with the Author role to perform Stored Cross-Site...
PT-2026-120766
šØ CVE-2026-111401 Cross-Site Request Forgery CSRF vulnerability in Tailored Media Tailored Tools tailored-tools allows Cross Site Request Forgery.This issue affects Tailored Tools: from n/a through 3.0.3. š@cveNotify...
PT-2026-120804
Name of the Vulnerable Software and Affected Versions Django REST framework versions prior to 3.18.2 Description An issue exists where DefaultContentNegotiation.get accept list in rest framework/negotiation.py accepts an unbounded number and aggregate size of Accept tokens. The select renderer...
PT-2026-120586
Trudesk through 1.2.11 contains a path traversal vulnerability that allows administrators to delete arbitrary files by supplying encoded traversal sequences to DELETE /api/v1/backup/:backup. Attackers can also pass unvalidated file values to POST /api/v1/backup/restore to restore archives from, o...
PT-2026-120226
Coraza from 3.0.4 before 3.8.1 contains a request body inspection bypass because request-body processor selection compares the entire Content-Type value exactly, so URL-encoded bodies whose Content-Type carries a media-type parameter are never parsed. Unauthenticated attackers can send...
PT-2026-120345
A weakness has been identified in Tenstorrent tt-metal up to 0.80.0. The affected element is the function load hf state dict filtered of the file models/tt transformers/tt/load checkpoints.py. This manipulation of the argument weight map causes path traversal. The attack may be initiated remotely...
PT-2026-120175
vLLM before 0.31.0 contains a cross-request mask leak in InputBatch.condense that allows remote attackers to constrain other clients' outputs by leaving stale allowed token ids rows. Attackers can submit concurrent constrained generate requests, including via unauthenticated /invocations, so...
PT-2026-120555
e107 CMS before 2.3.13 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious HTML by manipulating the author GET parameter in search.php, which is parsed with parse str and concatenated unescaped into a rendered input tag via the form...