PT-2026-120592

Improper validation of array index vulnerability in Velneo vServer. This issue affects vServer: from 36.0 before 36.6 and from 37.0 before 37.2...

PT-2026-120869

As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by...

PT-2026-120590

PHPOffice PHPPresentation through 1.2.0 contains an insecure deserialization vulnerability that allows attackers to instantiate arbitrary PHP objects by supplying a crafted presentation file. Attackers can upload a ZIP containing PhpPresentation.xml that IOFactory::load passes to unserialize,...

PT-2026-120247

Deserialization of untrusted data in Mandiant FLARE floss releases before 3.2.0 allows arbitrary code execution when a crafted .viv or .exe.viv workspace is passed to the floss utility...

PT-2026-120186

Name of the Vulnerable Software and Affected Versions SvelteKit @sveltejs/kit versions prior to 3.0.0 Description An open redirect issue exists in enhanced form actions use:enhance on routes that accept paths starting with a double slash. Attackers can create action paths beginning with // that...

PT-2026-120878

GitLab has remediated an issue in GitLab EE affecting all versions from 19.2 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, when an instance administrator locked a group's Duo availability, an authenticated user with group Owner permissions could have re-enabled AI-backed data...

PT-2026-120230

adm-zip before 0.6.1 contains an inconsistent entry resolution vulnerability that allows attackers to bypass content validation by supplying ZIP archives with duplicate entry names. Attackers can craft archives where getEntry returns the last duplicate while extractAllTo writes the first, causing...

PT-2026-120595

A BIND resolver that is configured with both a "redirect" zone and "qname-minimization strict" may abort with an assertion failure while processing the redirect. This issue affects BIND 9 versions 9.16.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.16.8-S1 through 9.18.50-S1...

PT-2026-120480

The Formidable Forms WordPress plugin before 7.0 does not verify the identity of the caller before recording the timestamp it uses to rate limit payment gateway verification requests, allowing unauthenticated attackers to consume the daily allowance and cause legitimate verification attempts to b...

PT-2026-120779

The MCTP-over-I2C+GPIO target binding in subsys/pmci/mctp/mctp i2c gpio target.c emulates a small pseudo-register file, where the bus controller first writes a register number and then writes or reads payload bytes. The selected register b-reg addr and the data-phase flag b-rxtx were never cleare...

PT-2026-120861

In Splunk SOAR versions below 8.7.0, a user that holds a role with the install apps capability could store attacker-controlled content that Splunk SOAR displays in app documentation by installing an app. If another user who holds a role with permission to view apps opens the app documentation,...

PT-2026-120450

The Booking Package WordPress plugin before 1.7.31 does not perform any authorization or validity check before resetting its premium subscription state, allowing unauthenticated attackers to disable the Booking Package WordPress plugin before 1.7.31's paid features...

PT-2026-120581

Trudesk through 1.2.11 contains an authorization bypass vulnerability that allows authenticated users to post content attributed to other users by supplying user-controlled owner IDs. Attackers can set ownerId or owner in postComment, postInternalNote, and ticket create requests to forge...

PT-2026-120591

PHPOffice PHPPresentation 1.2.0 contains a cross-site scripting vulnerability in the HTML writer that allows attackers who supply presentation content to inject script into generated HTML. Attackers can craft a PPTX with malicious text runs, hyperlink relationship targets, or shape descr attribut...

PT-2026-120235

uv before 0.11.15 contains a path traversal vulnerability that allows malicious wheels to write files outside the scripts directory via crafted console scripts or gui scripts entry point names. Attackers who induce users to install a malicious wheel can place executables in PATH directories,...

PT-2026-120446

The Appointment Booking Plugin WordPress plugin before 5.7.5 does not verify that an authenticated agent-level user is assigned to a customer before returning or searching that customer's record, allowing any agent to read and enumerate the personal information of every customer on the site,...

PT-2026-120830

Name of the Vulnerable Software and Affected Versions Net::LibSSH versions prior to 0.004 Description Net::LibSSH for Perl allows authentication to an unverified server because the connect function fails to verify the host key against the known hosts file. The function reports success immediately...

PT-2026-120774

The device multiplexer pseudo-driver in drivers/misc/devmux/devmux.c exposes two system calls, devmux select get and devmux select set. When CONFIG USERSPACE is enabled, their user-mode verifiers z vrfy devmux select get and z vrfy devmux select set forwarded directly to the kernel implementation...

PT-2026-120473

The WholesaleX WordPress plugin before 3.0.9 does not protect or remove the user-import file it keeps in a publicly accessible location under a predictable name, allowing unauthenticated users to download the most recently imported user data, including any account passwords and customer contact a...

PT-2026-120157

Vyper from 0.1.0b10 before 0.2.3 generates incorrect code for a return statement inside a for loop in an internal function called two or more internal calls deep, producing an invalid jump destination stack underflow. Affected contracts revert such calls unnecessarily, which in limited...

PT-2026-120449

The Booking Package WordPress plugin before 1.7.31 does not generate booking cancellation tokens using a secure source of randomness, deriving them instead from values it exposes publicly, so an unauthenticated attacker can reconstruct an arbitrary booking's token, disclose that booking's persona...

PT-2026-120846

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.4.4 Splunk Enterprise versions prior to 10.2.8 Splunk Enterprise versions prior to 10.0.11 Splunk Enterprise versions prior to 9.4.16 Description An unauthenticated user can cause Splunk Web to stop...

PT-2026-120245

Best Practice Software Bp Premier before 1.14.1.1128 uses a hardcoded Microsoft SQL Server administrative password that is shared across all installations and cannot be changed without breaking the application. Attackers with network access to the database instance can authenticate as sysadmin,...

PT-2026-120694

Name of the Vulnerable Software and Affected Versions Cisco Emergency Responder affected versions not specified Cisco Prime Collaboration Deployment affected versions not specified Cisco Unified Communications Manager Unified CM affected versions not specified Cisco Unified Communications Manager...

PT-2026-120206

Trigger.dev before 4.5.2 contains a blind server-side request forgery vulnerability that allows authenticated project members to make the server send requests by setting unvalidated alert-channel webhook URLs. Attackers can create alert channels pointing to loopback, internal, or cloud metadata...

PT-2026-120791

Name of the Vulnerable Software and Affected Versions Apache Traffic Server versions 8.0.0 through 8.1.11 Apache Traffic Server versions 9.0.0 through 9.2.15 Apache Traffic Server versions 10.0.0 through 10.1.4 Apache Traffic Server version 10.2.0 Description Apache Traffic Server allows the...

PT-2026-120799

A flaw was found in OpenSCAP. When decomposing a Source DataStream SDS file, the application does not properly validate relative file path attributes, leading to a path traversal vulnerability. An attacker can exploit this flaw by tricking a user or automated system into decomposing a crafted...

PT-2026-120676

Impact For hid and usb permission checks made from an iframe, session.setPermissionCheckHandler was given the top-level frame's origin and details instead of the requesting frame's. Apps that allow these permissions based on origin could grant an embedded frame access intended for the top-level...

PT-2026-120674

Name of the Vulnerable Software and Affected Versions Electron versions prior to 42.11.9 Electron versions prior to 43.7.6 Electron versions prior to 44.5.0 Electron versions prior to 45.0.0-alpha.13 Description Pointer lock permission requests originating from certain cross-origin iframes cause...

PT-2026-120677

Name of the Vulnerable Software and Affected Versions Electron versions prior to 42.11.3 Electron versions prior to 43.7.0 Electron versions prior to 44.3.0 Electron versions prior to 45.0.0-alpha.5 Description Requests to open external protocol URLs can be attributed to a document other than the...

PT-2026-120806

Name of the Vulnerable Software and Affected Versions nbconvert versions 5.4.0 through 7.17.1 Description The ExtractOutputPreprocessor in nbconvert/preprocessors/extractoutput.py fails to properly limit the result of joining the cell output metadata filename to the output files dir. This allows ...

PT-2026-120701

Name of the Vulnerable Software and Affected Versions Cisco Unified Communications Manager affected versions not specified Cisco Unified Communications Manager Session Management Edition affected versions not specified Description An issue exists where improper input validation for specific HTTP...

PT-2026-120488

In OpenStack Cinder through 29.0.0, cross-project information disclosure can occur in the Messages API. A non-admin user with the project-scoped 'member' or 'reader' role making the Block Storage API v3.3 "List messages" call finds the non-expired user messages for other projects included in the...

PT-2026-120516

NLnet Labs Unbound, 1.22.0 up to and including version 1.26.1, contains a DNS-over-QUIC DoQ lifetime bug reachable by a remote DoQ client under multi-threaded operation. A client-triggered QUIC path migration can enter stream/connection cleanup while a mesh reply still retains a pointer to the Do...

PT-2026-120598

A recursive BIND server that receives a query with recursion desired RD=1 followed by a non-recursive query RD=0 may exit with an assertion failure, resulting in a denial of service. To be vulnerable, the BIND server must allow recursive queries and have at least two RPZ zones configured: one wit...

PT-2026-120801

Name of the Vulnerable Software and Affected Versions Jupyter Server versions 2.0.0 through 2.6.0 Description An authorization bypass exists when GatewayClient.url is enabled, causing the KernelWebsocketHandler to be replaced by WebSocketChannelsHandler. While this handler authenticates the user,...

PT-2026-120648

Cross-site request forgery in the REST API of Progressive Robot hMailServer 6.0.0 through 6.3.6 allows a remote attacker to make an authenticated user's browser perform a state-changing request. The REST API accepts HTTP Basic authentication and answers a browser with a Basic sign-in box; a brows...

PT-2026-120437

A weakness has been identified in projectworlds Advanced Library Management System 1.0. Impacted is the function mysqli query of the file report search.php. Executing a manipulation of the argument dateto/datefrom can lead to sql injection. The attack can be executed remotely. The exploit has bee...

PT-2026-120706

Name of the Vulnerable Software and Affected Versions Cisco Expressway Series affected versions not specified Description An issue exists involving uncaught exceptions, which are errors that occur during program execution that the software fails to handle, leading to potential instability or...

PT-2026-120705

Name of the Vulnerable Software and Affected Versions Cisco Expressway Series affected versions not specified Description Issues concerning null pointers were identified during an internal security review. A null pointer is a reference that points to nothing, which can lead to application crashes...

PT-2026-120703

Name of the Vulnerable Software and Affected Versions Cisco Expressway Series affected versions not specified Description An issue involving out-of-bounds writes was identified during an internal security review. Out-of-bounds writes occur when a program writes data past the end of the intended...

PT-2026-120443

The Synchrony Financing WordPress plugin before 1.1.2 does not properly authorise requests to one of its REST routes that modifies WooCommerce orders, allowing unauthenticated attackers to reassign any order to an account they control, tamper with its details, and read the associated customer's...

PT-2026-120625

A flaw has been found in itsourcecode Sales-and-Inventory-System up to 0a3c45a78aaff3601b8cf9ce8ba82ff5c345caac. This issue affects some unknown processing of the file /pages/cust edit.php. This manipulation of the argument ID causes sql injection. The attack can be initiated remotely. The exploi...

PT-2026-120512

Deserialization of Untrusted Data vulnerability in GS Plugins GS Pins for Pinterest gs-pinterest-portfolio allows Object Injection.This issue affects GS Pins for Pinterest: from n/a through 1.9.2...

PT-2026-120619

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in ThemeHunk ThemeHunk Customizer themehunk-customizer allows Reflected XSS.This issue affects ThemeHunk Customizer: from n/a through 2.8.7...

PT-2026-120740

A weakness has been identified in ProjectWorlds Advanced Library Management System 1.0. This affects the function mysqli query of the file returned book search.php of the component Search Form. Executing a manipulation of the argument datefrom/dateto can lead to sql injection. The attack can be...

PT-2026-120678

A vulnerability was detected in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. Affected by this issue is some unknown functionality of the file files.php of the component File Management. Performing a manipulation of the argument fid/id results in sql...

PT-2026-120610

WarehousePG WHPG 6.27.1 through 6.27.6 and 7.2.1 through 7.6.0 are affected by a missing authorization vulnerability CWE-862 in gp add coordinator standby. The function is named gp add master standby in WHPG 6, and WHPG 7 keeps that name as an alias. Unlike the other segment add and remove...

PT-2026-120557

Enforceable assertion in the streaming feature of Apache bRPC version 0 and unconditionally asserts CHECKbuf.IsEmpty on the frame payload. A feedback frame that carries an unexpected payload, or a feedback frame received on a stream where flow control is disabled cur buf size == 0, reaches these...

PT-2026-120156

Vyper before 0.2.6 contains a call stack corruption vulnerability that causes incorrect function outputs when complex types with non-base members are passed as arguments. Contracts passing multi-dimensional arrays or structs to internal or external functions receive corrupted values because the...