PT-2026-99121

Name of the Vulnerable Software and Affected Versions Mediawiki - TemplateSandbox Extension versions prior to 1.46.1 Mediawiki - TemplateSandbox Extension version 1.45.5 Mediawiki - TemplateSandbox Extension version 1.43.10 Description Improper neutralization of input during web page generation...

PT-2026-99092

X-SpringBoot through 6.0 returns login verification codes in HTTP responses from unauthenticated endpoints GET /sys/mobile/code and GET /sys/email/code without sending them to account owners. Attackers can request codes using known mobile numbers or email addresses, read them from responses, and...

PT-2026-99011

Parse Server versions = 9.0.0 before 9.10.0 and = 8.2.2 before 8.6.86 return GraphQL validation error messages that name required custom input fields even when public introspection is disabled graphQLPublicIntrospection: false, the default. A client holding only the public application id — with n...

PT-2026-98897

🚨 CVE-2026-18312 Readwise Reader for Android constructs URLs in its WebView using attacker-controlled metadata without proper encoding or escaping. The application interpolates untrusted values directly into URL strings and inserts them into the DOM via innerHTML. Because the interpolation occurs...

PT-2026-98898

🚨 CVE-2026-18320 Readwise Reader for Android uses a sanitize-html configuration that permits all attributes on SVG and PATH elements due to a wildcard attribute rule. This configuration fails to remove script-capable attributes such as event handlers e.g., 'onload', 'onerror'. An attacker could...

PT-2026-99111

Name of the Vulnerable Software and Affected Versions MediaFlow Proxy versions prior to 2.5.0 Description An issue exists in the '/proxy' endpoint where missing and incomplete destination validation of the d query parameter allows for server-side request forgery SSRF. This occurs when a server is...

PT-2026-98810

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the drm/gud component where the driver fails to validate if GUD ROTATION 0 is present in the supported rotations bitmask. When the drm plane create rotation property...

PT-2026-98532

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the s390 crypto implementation where temporary buffers used with AES CTR and GCM algorithms are not properly scrubbed. In the ctr aes crypt function, a buffer used for...

PT-2026-98662

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfnetlink log: cope with concurrent instance destruction Instances are refcounted. However, only memory release happens on the 1 - 0 transition; the unlink from hashes can occur with any refcount. Uncooperative userspa...

PT-2026-98884

Name of the Vulnerable Software and Affected Versions InvoicePlane versions prior to 1.7.2 Description InvoicePlane fails to validate Cross-Site Request Forgery CSRF tokens in several delete methods. Specifically, the ensure valid post request function is omitted from Payments::delete,...

PT-2026-98999

Circles' remote-instance signature verification fetches the attacker-supplied keyId URL before trust in the remote instance is established, and explicitly allows local/private addresses for this request, bypassing Nextcloud's core SSRF protections. The public, unauthenticated endpoints POST...

PT-2026-98683

In the Linux kernel, the following vulnerability has been resolved: pds core: fix cmd regs access racing BAR unmap on reset pdsc reset prepare and pdsc reset done's pdsc map bars error path clear/iounmap cmd regs without devcmd lock, and pdsc legacy firmware update's download loop derefs cmd regs...

PT-2026-98880

Name of the Vulnerable Software and Affected Versions InvoicePlane versions prior to 1.7.2 Description The Invoices::generate xml function appends a database-derived xml id to the XMLconfigs helper directory and includes the resulting PHP path without proper validation of the identifier. A...

PT-2026-98694

In the Linux kernel, the following vulnerability has been resolved: nexthop: Initialize extack in remove nh grp entry remove nh grp entry prints the extack message when a listener fails to replace the reduced nexthop group. However, extack is not initialized and listeners are not required to set ...

PT-2026-98986

GitLab has remediated an issue in GitLab EE affecting all versions from 17.1 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that, under certain conditions, an authenticated user with Owner or Maintainer permissions could have silently disabled protected environment deployment approval...

PT-2026-99006

OpenBao is an open source identity-based secrets management system. Prior to 2.5.5, an authenticated OpenBao caller with write access to transit/keys/ could terminate the server process by setting derived to true while the type parameter selected rsa-, ecdsa-, or ed25519. The Transit policy...

PT-2026-98823

An issue in the VMware datastore driver of OpenStack glance store. When an authenticated attacker provides a maliciously crafted image location URI pointing to an external server, the retry request function fails to validate the destination host before attaching sensitive authentication headers...

PT-2026-98474

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the f2fs filesystem within the free segment range function. The system temporarily reduces MAIN SECSsbi by secs to limit block allocation to a safe area while Garbage...

PT-2026-98599

In the Linux kernel, the following vulnerability has been resolved: tracing: Set the trace clock before registering the histogram trigger hist register trigger puts the trigger on the global named triggers list in cmd ops-init, and only then sets the trace clock: if data-cmd ops-init ret = data-c...

PT-2026-98706

In the Linux kernel, the following vulnerability has been resolved: bpf: Don't infer non-NULL from a pointer with an unbounded offset reg not null decides that a register holds a non-NULL value by looking at its type alone. For pointer types that allow arithmetic the type only guarantees a non-NU...

PT-2026-98362

Name of the Vulnerable Software and Affected Versions Automation Web Platform – Notifications and OTP for WooCommerce, Advanced Country Code plugin for WordPress versions prior to 4.8.7 Description An issue exists due to missing permission enforcement on the publicly accessible REST route POST...

PT-2026-98412

Name of the Vulnerable Software and Affected Versions StockAgile affected versions not specified Description Stored Cross-Site Scripting XSS occurs in the API and management panel. The issue exists on the server side within the REST endpoint '/inventory/configuration/variants', where malicious...

PT-2026-98496

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A reference count leak occurs in the SMB client when the cifs sb tlink function fails. This issue specifically affects configurations using the -o multiuser option. In these scenarios, t...

PT-2026-99701

CVE-2026-53990 - Rejected reason: This CVE ID has been rejected or CVE ID :CVE-2026-53990 Published : Sept. 25, 2026, 8:17 p.m. | 1 hour, 8 minutes ago Description :Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. Severity: 0.0 | NA Visit the link for mo...

PT-2026-98543

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A race condition exists in the idpf driver where Tx/Rx DIM works are not drained before the memory they reside in is freed. The tx dim and rx dim works are embedded in the idpf q vector...

PT-2026-99075

Name of the Vulnerable Software and Affected Versions GLPI versions 11.0.6 through 11.0.7 Description An authenticated technician can store active markup in supplier website fields. This leads to stored cross-site scripting XSS, where any user viewing the affected item's suppliers list triggers t...

PT-2026-98695

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix subbuf resize races with trace pipe raw readers Concurrent subbuffer resizes may crash trace pipe raw readers or leak uninitialized memory to userspace due to stale size values. Modify ring buffer alloc read page to...

PT-2026-98490

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the XFS file system where unit conversions in the per binval computation are performed incorrectly. Specifically, the second parameter of the xfs buf inval log space...

PT-2026-99003

OpenBao is an open source identity-based secrets management system. Prior to 2.5.5, OpenBao used EscapeLDAPValue, an RFC 4514 distinguished-name escaping function, where RFC 4515 LDAP search-filter escaping was required in sdk/helper/ldaputil/client.go GetUserDN. With the LDAP authentication...

PT-2026-98468

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the scsi qla2xxx driver where the qla nvme xmt ls rsp function fails to remove uctx from the fcport-unsol ctx head list before freeing it with kfree during an LS rejec...

PT-2026-98952

Name of the Vulnerable Software and Affected Versions Bludit CMS versions prior to 3.22.1 Description Authenticated users with the Author role can modify privileged page fields reserved for administrators by injecting reserved parameters into a content save request. This occurs because the...

PT-2026-98552

In the Linux kernel, the following vulnerability has been resolved: net: mpls: clear inner protocol when the last label is popped skb mpls push records the pre-encapsulation network header once, gated on !skb-inner protocol. skb mpls pop never clears that record, so it outlives the encapsulation ...

PT-2026-99008

Parse Server is affected by a stored cross-site scripting XSS vulnerability in versions = 9.0.0, 9.10.0 and = 8.6.83. When an uploaded file's extension is not recognized by the mime package, Parse Server preserves the client-supplied Content-Type. A malformed Content-Type that is not a valid...

PT-2026-98338

Name of the Vulnerable Software and Affected Versions ningzichun student-management-system versions up to 98760f5711cf6dc8b4adca53a9e207ca49b02ebf Description A flaw exists in the example lite.sql file that allows a remote attacker to execute a manipulation leading to the use of default...

PT-2026-98817

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An out-of-bounds read issue exists in the resp worker function within the accel/qaic component. This occurs because the logic for handling DBC deactivation skipped the bounds checking co...

PT-2026-98674

In the Linux kernel, the following vulnerability has been resolved: net/sched: hhf: clamp quantum in change and init paths hhf change accepts any quantum from userspace, including 1. With a crafted size table qdisc pkt len reaches 2 GiB, so quantum=1 makes the deficit-refill loop spin 2^31 times...

PT-2026-98982

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.3 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that, under certain conditions, an authenticated user could have induced a targeted user to perform unintended state-changing HTTP requests due to improper...

PT-2026-99014

rclone versions = v1.72.0 and = v1.74.4 fixed in v1.75.0 contain multiple denial-of-service vulnerabilities in the archive backend's SquashFS parser, which relies on the github.com/diskfs/go-diskfs dependency. The parser fails to validate attacker-controlled superblock and metadata values before...

PT-2026-98789

In the Linux kernel, the following vulnerability has been resolved: smb/client: validate new EOF for insert range smb3 insert range does not check if the new file size i size + len is valid. This allows FALLOC FL INSERT RANGE to bypass RLIMIT FSIZE, exceed s maxbytes, or produce a size outside th...

PT-2026-98690

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A flaw exists in the mv88e6xxx get rxnfc function within the net: dsa: mv88e6xxx module. The function uses rxnfc-rule cnt as a write index when dumping the policy IDR, which overwrites t...

PT-2026-98396

Name of the Vulnerable Software and Affected Versions Optima Express IDX versions prior to 8.7.6 Description An issue allows unauthenticated attackers to escalate the privileges of a pre-registered account to the Author role. This occurs because the provisionBlogCredentials function in...

PT-2026-98384

Name of the Vulnerable Software and Affected Versions SSL Zen — SSL Certificate Installer & HTTPS Redirects versions prior to 4.7.43 Description The plugin is subject to Directory Traversal, a flaw that allows an attacker to access files and directories that are stored outside the web root folder...

PT-2026-98991

JupyterLab versions =4.6.0,=4.6.1 and =4.5.9 contain an allowlist/blocklist enforcement gap in PyPIExtensionManager.install. A missing 'await' caused the is install allowed coroutine to never execute, so the extension allowlist/blocklist check was not enforced for direct callers of install. The...

PT-2026-99007

Parse Server before 4.10.0 was affected by a supply chain incident in which incorrect version tags were pushed to the official repository pointing to an unreviewed personal fork of a contributor with write access. No releases were published with these tags; a project was exposed only if it define...

PT-2026-99070

Name of the Vulnerable Software and Affected Versions GLPI versions 0.70 through 10.0.25 GLPI versions 11.0.0 through 11.0.7 Description A technician can manipulate the authtype value via the API to modify the authentication method of another user. In environments utilizing SSO logins or the lega...

PT-2026-98874

Name of the Vulnerable Software and Affected Versions Input Leap versions prior to 3.0.4 Description When the non-default --enable-drag-drop option is active on Windows or macOS, the software mishandles the distinction between forward slashes / and backslashes . This flaw allows directory travers...

PT-2026-98530

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the s390 crypto implementation where temporary buffers used with the PAES algorithm are not properly scrubbed. In the ctr paes do crypt function, a buffer used to...

PT-2026-98769

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: fix out-of-bounds write in l2cap ecred connect l2cap chan connect tries to ensure there are no more than L2CAP ECRED CONN SCID MAX pending ECRED channels, so they fit in the same L2CAP ECRED CONN REQ that l2cap...

PT-2026-98580

In the Linux kernel, the following vulnerability has been resolved: accel/ivpu: Validate firmware log buffer metadata The tracing log headers parsed by fw log print buffer reside in DMA-shared BOs that the NPU firmware can write to. fw log from bo validated log-header size and log-size, but fw lo...

PT-2026-98712

In the Linux kernel, the following vulnerability has been resolved: bpf: zero extend the result of an arena 32-bit cmpxchg bpf convert ctx accesses rewrites an atomic on an arena pointer from BPF STX | BPF ATOMIC to BPF STX | BPF PROBE ATOMIC, and it runs before bpf opt subreg zext lo32 rnd hi32...