PT-2026-98690

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A flaw exists in the mv88e6xxx get rxnfc function within the net: dsa: mv88e6xxx module. The function uses rxnfc-rule cnt as a write index when dumping the policy IDR, which overwrites t...

PT-2026-98396

Name of the Vulnerable Software and Affected Versions Optima Express IDX versions prior to 8.7.6 Description An issue allows unauthenticated attackers to escalate the privileges of a pre-registered account to the Author role. This occurs because the provisionBlogCredentials function in...

PT-2026-98384

Name of the Vulnerable Software and Affected Versions SSL Zen — SSL Certificate Installer & HTTPS Redirects versions prior to 4.7.43 Description The plugin is subject to Directory Traversal, a flaw that allows an attacker to access files and directories that are stored outside the web root folder...

PT-2026-98991

JupyterLab versions =4.6.0,=4.6.1 and =4.5.9 contain an allowlist/blocklist enforcement gap in PyPIExtensionManager.install. A missing 'await' caused the is install allowed coroutine to never execute, so the extension allowlist/blocklist check was not enforced for direct callers of install. The...

PT-2026-99007

Parse Server before 4.10.0 was affected by a supply chain incident in which incorrect version tags were pushed to the official repository pointing to an unreviewed personal fork of a contributor with write access. No releases were published with these tags; a project was exposed only if it define...

PT-2026-99070

Name of the Vulnerable Software and Affected Versions GLPI versions 0.70 through 10.0.25 GLPI versions 11.0.0 through 11.0.7 Description A technician can manipulate the authtype value via the API to modify the authentication method of another user. In environments utilizing SSO logins or the lega...

PT-2026-98874

Name of the Vulnerable Software and Affected Versions Input Leap versions prior to 3.0.4 Description When the non-default --enable-drag-drop option is active on Windows or macOS, the software mishandles the distinction between forward slashes / and backslashes . This flaw allows directory travers...

PT-2026-98530

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the s390 crypto implementation where temporary buffers used with the PAES algorithm are not properly scrubbed. In the ctr paes do crypt function, a buffer used to...

PT-2026-98769

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: fix out-of-bounds write in l2cap ecred connect l2cap chan connect tries to ensure there are no more than L2CAP ECRED CONN SCID MAX pending ECRED channels, so they fit in the same L2CAP ECRED CONN REQ that l2cap...

PT-2026-98580

In the Linux kernel, the following vulnerability has been resolved: accel/ivpu: Validate firmware log buffer metadata The tracing log headers parsed by fw log print buffer reside in DMA-shared BOs that the NPU firmware can write to. fw log from bo validated log-header size and log-size, but fw lo...

PT-2026-98712

In the Linux kernel, the following vulnerability has been resolved: bpf: zero extend the result of an arena 32-bit cmpxchg bpf convert ctx accesses rewrites an atomic on an arena pointer from BPF STX | BPF ATOMIC to BPF STX | BPF PROBE ATOMIC, and it runs before bpf opt subreg zext lo32 rnd hi32...

PT-2026-98852

Name of the Vulnerable Software and Affected Versions Open-Web-Analytics versions prior to 1.8.2 Description A flaw in the Remote Event Queue Endpoint component allows remote attackers to trigger deserialization by manipulating the Event::loadFromArray function within the queue.php file...

PT-2026-98403

Name of the Vulnerable Software and Affected Versions Apache Qpid Broker-J versions prior to 10.1.1 Description A pre-authentication attacker can exploit the way type size and count are handled to trigger excessive memory allocation, which may result in a denial of service. Recommendations Upgrad...

PT-2026-98714

In the Linux kernel, the following vulnerability has been resolved: net: bcmasp: fix tx spb ring full checking same slot cnt times The loop initialised next index from intf-tx spb index on every iteration, so incr ring always produced the same result and only one slot was ever tested. Move the...

PT-2026-98873

Name of the Vulnerable Software and Affected Versions langchain4j versions prior to 1.5.3-beta11 langchain4j versions prior to 1.11.10-beta19 langchain4j versions prior to 1.18.1-beta28 Description A flaw in the LangChain4j-agentic component allows for remote deserialization. The issue resides in...

PT-2026-98839

Name of the Vulnerable Software and Affected Versions kitty versions 0.47.0 through 0.48.x Description Improper link resolution in the drag source staging path of the drag and drop protocol allows a program writing to the terminal to create files and directories outside the staging directory. Thi...

PT-2026-98829

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the ACPI platform implementation where the use of the acpi get first physical node function within acpi platform fill resource and acpi create platform device is unsaf...

PT-2026-98405

Name of the Vulnerable Software and Affected Versions Apache Qpid Broker-J versions prior to 10.1.1 Description A pre-authentication attacker can use type nesting to trigger a StackOverflowError, which may result in a denial of service. A StackOverflowError occurs when the application's call stac...

PT-2026-98383

Name of the Vulnerable Software and Affected Versions SSL Zen plugin for WordPress versions prior to 4.7.43 Description Reflected Cross-Site Scripting occurs when unauthenticated attackers trick users into clicking specially crafted links to inject arbitrary web scripts. The issue exists because...

PT-2026-98365

Name of the Vulnerable Software and Affected Versions Fancy Product Designer versions prior to 6.5.3 Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting XSS, a technique where malicious scripts are permanently stor...

PT-2026-98664

In the Linux kernel, the following vulnerability has been resolved: hwmon: ltc4282 Make sure clk init data is fully initialized The clk init data structure contains several mutually-exclusive members for different methods to specify the possible parents of a clock, prompting drivers to initialize...

PT-2026-98778

In the Linux kernel, the following vulnerability has been resolved: ALSA: pcm: Serialize PCM mmap with buffer reallocation to fix page UAF snd pcm hw params and snd pcm hw free guard buffer reallocation with an mmap count check performed under the PCM stream lock, but the lock is released long...

PT-2026-98372

Name of the Vulnerable Software and Affected Versions HT Contact Form – Drag & Drop Form Builder for WordPress versions prior to 2.10.2 Description Insufficient input sanitization and output escaping in the form data Rich Text Field allow unauthenticated attackers to perform Stored DOM-Based...

PT-2026-98371

Name of the Vulnerable Software and Affected Versions Blog2Social: Social Media Auto Post & Scheduler versions prior to 9.1.1 Description An authorization bypass exists because the software fails to properly verify if a user is authorized to perform specific actions. Authenticated attackers with...

PT-2026-98518

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the rockchip vpu981 av1 dec set tile info function where the system divides context update tile id by tile info-tile cols. Because tile cols and tile rows are derived...

PT-2026-98958

Name of the Vulnerable Software and Affected Versions Zammad versions prior to 7.1.2 Description A security filter protecting the AI Agent configuration can be bypassed by entering specially crafted text into an AI Agent field. An administrator with permissions to create or edit AI Agents can...

PT-2026-99023

SeaweedFS before 4.30 reflects the callback query parameter verbatim into responses served with Content-Type application/javascript in the shared writeJson helper weed/server/common.go, with no callback-name validation, no X-Content-Type-Options: nosniff header, and no CORS allow-list. Every JSON...

PT-2026-98950

Name of the Vulnerable Software and Affected Versions Zammad version 7.0.2 Zammad version 7.1.0 Description Session management for websocket and long-polling connections is susceptible to a path traversal attack, which occurs when an application uses user-controllable input to construct a path to...

PT-2026-98619

In the Linux kernel, the following vulnerability has been resolved: net: mana: restore the XDP program pointer when pre-allocation fails mana xdp set publishes the new program into apc-bpf prog before it allocates anything, because mana pre alloc rxbufs sizes the buffers from it via mana get rxbu...

PT-2026-98931

Use After Free in the drag source path of the drag and drop protocol in kitty from 0.47.0 before 0.49.0 allows a program writing to the terminal to cause the terminal to read from and write to freed heap memory, because drag remote file data in kitty/dnd.c holds a DragRemoteItem pointer into an...

PT-2026-98732

In the Linux kernel, the following vulnerability has been resolved: net/rds: acquire the fastpath locks in rds conn shutdown rds conn shutdown quiesces the transmit and receive-refill paths by waiting for RDS IN XMIT and RDS RECV REFILL to be sampled clear, and then runs the transport shutdown an...

PT-2026-98410

Name of the Vulnerable Software and Affected Versions StockAgile affected versions not specified Description Stored Cross-Site Scripting XSS occurs in the API and management panel. The issue exists on the server side within the '/inventory/configuration/payment-methods' endpoint, where malicious...

PT-2026-99110

Zoraxy versions 3.2.3 through 3.3.4 fail to properly parse IPv6 addresses in the RemoteAddr field when setting forwarded headers. Unauthenticated attackers connecting over IPv6 can supply arbitrary X-Forwarded-For values to spoof their source IP and bypass authorization provider IP-based access...

PT-2026-98818

Name of the Vulnerable Software and Affected Versions Linux kernel versions 6.8 and 6.18 LTS Description An issue exists in the drm/virtio component where the virtio-gpu driver fails to correctly use the DMA API for resource backing on Xen PV domains. In these domains, page addresses do not...

PT-2026-98640

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintel pcie: validate packet len before skb put data btintel pcie submit rx work reads packet len from rfh hdr without checking if it exceeds the RX buffer size. An oversized packet len can lead to an out-of-bounds re...

PT-2026-98895

Name of the Vulnerable Software and Affected Versions Rattadan Cosmowarp versions prior to 56c6147 Description The smart contract contains a logic error where a comparison is made against an unintended value of the current admin variable. Recommendations Update Rattadan Cosmowarp to version 56c61...

PT-2026-98555

In the Linux kernel, the following vulnerability has been resolved: net: bridge: use option bits for CFM/MRP frame handlers CFM and MRP register a global br frame type whose hlist node is linked into the per-bridge frame type list when the first MEP/MRP instance is created. Enabling the protocol ...

PT-2026-98754

In the Linux kernel, the following vulnerability has been resolved: btrfs: detach failed sprout device from transaction update list When creating the first metadata chunk for a sprout filesystem, create chunk adds the new device to the transaction dev update list through device-post commit list. ...

PT-2026-99060

Name of the Vulnerable Software and Affected Versions TDuck survey form versions prior to 6.0 Description Insufficient authorization checks exist within the FormThemeController write endpoints for global form themes and categories. This allows authenticated users without administrative privileges...

PT-2026-99125

Name of the Vulnerable Software and Affected Versions Mediawiki - UploadWizard Extension versions prior to 1.46.1 Mediawiki - UploadWizard Extension version 1.45.5 Mediawiki - UploadWizard Extension version 1.43.10 Description Improper neutralization of input during web page generation allows for...

PT-2026-99138

Name of the Vulnerable Software and Affected Versions Horilla versions prior to 2.0.0 Description An issue exists where the endpoint '/attendance/approve-validate-attendance-request/' modifies attendance validated, is validate request approved, approved by, and pending-request states via an HTTP...

PT-2026-98591

In the Linux kernel, the following vulnerability has been resolved: ufs: create the root dentry after loading cylinder metadata ufs fill super installed sb-s root before it loaded the cylinder group structures for a writable mount: sb-s root = d make rootinode; ... if !sb rdonlysb if !ufs read...

PT-2026-98785

In the Linux kernel, the following vulnerability has been resolved: sctp: fix soft lockup from unpadded ASCONF-ACK parameter iteration sctp verify asconf walks ASCONF-ACK parameters with sctp walk params, which advances by SCTP PAD4length, while the consumer sctp get asconf response iterates the...

PT-2026-98539

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A double-free issue exists in the ieee802154 module within the hwsim component. The hwsim update pib function performs an unserialized read-swap-free operation on phy-pib. While the...

PT-2026-98698

In the Linux kernel, the following vulnerability has been resolved: bpf: Cancel special fields when recycling rhtab elements rhtab map update existing and rhtab delete elem call bpf obj free fields when replacing or deleting a value. These map operations can run from BPF programs in NMI context,...

PT-2026-98579

In the Linux kernel, the following vulnerability has been resolved: accel/ivpu: Limit firmware log name prints to field size The name in struct vpu tracing buffer header is a fixed-size array populated by the NPU firmware. It is expected to be NUL-terminated, but nothing on the host side enforces...

PT-2026-98877

Name of the Vulnerable Software and Affected Versions InvoicePlane versions prior to 1.7.2 Description InvoicePlane stores and serves uploaded image attachments without stripping EXIF metadata Exchangeable Image File Format, a standard for storing metadata in image files. When an administrator...

PT-2026-98561

In the Linux kernel, the following vulnerability has been resolved: drm/rockchip: analogix dp: fix unchecked bound endpoint name length rockchip dp drm encoder enable uses sprintf to format a device tree path into a 32-byte stack buffer. Device tree paths are not limited to this size, so a...

PT-2026-98544

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A slab-use-after-free issue exists in the fbdev vfb component. The FBIOGETCMAP ioctl takes a shallow snapshot of info-cmap and performs a usercopy after releasing info-lock. However, vfb...

PT-2026-98506

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The in-kernel MPTCP path manager contains an asymmetry between removal paths that can leave a stale ADD ADDR announcement entry active when removing the id 0 endpoint. This occurs becaus...