PT-2026-98912

Name of the Vulnerable Software and Affected Versions RabbitMQ versions 3.13.0 through 3.13.17 RabbitMQ versions 4.0.x through 4.0.22 RabbitMQ versions 4.1.x through 4.1.13 RabbitMQ versions 4.2.x through 4.2.8 RabbitMQ versions 4.3.x through 4.3.2 Description Stored Cross-Site Scripting XSS exis...

PT-2026-99107

Name of the Vulnerable Software and Affected Versions pgPointcloud versions prior to 1.2.6 Description An issue exists in the dimensional patch WKB Well-Known Binary deserialization process. Authenticated database users can exploit this by providing crafted pcpatch values with manipulated size...

PT-2026-98496

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A reference count leak occurs in the SMB client when the cifs sb tlink function fails. This issue specifically affects configurations using the -o multiuser option. In these scenarios, t...

PT-2026-98555

In the Linux kernel, the following vulnerability has been resolved: net: bridge: use option bits for CFM/MRP frame handlers CFM and MRP register a global br frame type whose hlist node is linked into the per-bridge frame type list when the first MEP/MRP instance is created. Enabling the protocol ...

PT-2026-98394

Name of the Vulnerable Software and Affected Versions User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor versions prior to 4.0.3 Description Insufficient input sanitization and output escaping allow authenticated attackers with subscriber-level access and...

PT-2026-98580

In the Linux kernel, the following vulnerability has been resolved: accel/ivpu: Validate firmware log buffer metadata The tracing log headers parsed by fw log print buffer reside in DMA-shared BOs that the NPU firmware can write to. fw log from bo validated log-header size and log-size, but fw lo...

PT-2026-98662

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfnetlink log: cope with concurrent instance destruction Instances are refcounted. However, only memory release happens on the 1 - 0 transition; the unlink from hashes can occur with any refcount. Uncooperative userspa...

PT-2026-99070

Name of the Vulnerable Software and Affected Versions GLPI versions 0.70 through 10.0.25 GLPI versions 11.0.0 through 11.0.7 Description A technician can manipulate the authtype value via the API to modify the authentication method of another user. In environments utilizing SSO logins or the lega...

PT-2026-98880

Name of the Vulnerable Software and Affected Versions InvoicePlane versions prior to 1.7.2 Description The Invoices::generate xml function appends a database-derived xml id to the XMLconfigs helper directory and includes the resulting PHP path without proper validation of the identifier. A...

PT-2026-99011

Parse Server versions = 9.0.0 before 9.10.0 and = 8.2.2 before 8.6.86 return GraphQL validation error messages that name required custom input fields even when public introspection is disabled graphQLPublicIntrospection: false, the default. A client holding only the public application id — with n...

PT-2026-98683

In the Linux kernel, the following vulnerability has been resolved: pds core: fix cmd regs access racing BAR unmap on reset pdsc reset prepare and pdsc reset done's pdsc map bars error path clear/iounmap cmd regs without devcmd lock, and pdsc legacy firmware update's download loop derefs cmd regs...

PT-2026-98899

Name of the Vulnerable Software and Affected Versions Zammad versions prior to 7.0.2 Description An issue with permission checks in the knowledge base management area allows users with limited read permissions to interact with items outside their assigned access scope due to incomplete data...

PT-2026-98421

Name of the Vulnerable Software and Affected Versions lazy html versions 0.1.0 through 0.1.12 Description An issue exists where improper neutralization of input during web page generation allows mutation Cross-site Scripting XSS. This occurs during a parse and serialize round-trip of...

PT-2026-98690

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A flaw exists in the mv88e6xxx get rxnfc function within the net: dsa: mv88e6xxx module. The function uses rxnfc-rule cnt as a write index when dumping the policy IDR, which overwrites t...

PT-2026-98384

Name of the Vulnerable Software and Affected Versions SSL Zen — SSL Certificate Installer & HTTPS Redirects versions prior to 4.7.43 Description The plugin is subject to Directory Traversal, a flaw that allows an attacker to access files and directories that are stored outside the web root folder...

PT-2026-99111

Name of the Vulnerable Software and Affected Versions MediaFlow Proxy versions prior to 2.5.0 Description An issue exists in the '/proxy' endpoint where missing and incomplete destination validation of the d query parameter allows for server-side request forgery SSRF. This occurs when a server is...

PT-2026-98362

Name of the Vulnerable Software and Affected Versions Automation Web Platform – Notifications and OTP for WooCommerce, Advanced Country Code plugin for WordPress versions prior to 4.8.7 Description An issue exists due to missing permission enforcement on the publicly accessible REST route POST...

PT-2026-98978

GitLab has remediated an issue in GitLab EE affecting all versions from 18.11 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could have allowed an authenticated user with the Security Manager role to execute arbitrary CI/CD jobs and access protected...

PT-2026-98396

Name of the Vulnerable Software and Affected Versions Optima Express IDX versions prior to 8.7.6 Description An issue allows unauthenticated attackers to escalate the privileges of a pre-registered account to the Author role. This occurs because the provisionBlogCredentials function in...

PT-2026-98485

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the xfs module where the xfs btree bload prep block function fails to release the new bp variable if the xfs btree bload drop buf function encounters an IO error while...

PT-2026-98381

Name of the Vulnerable Software and Affected Versions WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters versions prior to 4.9.9 Description Insufficient input sanitization and output escaping allow authenticated attackers with subscriber-level access and above t...

PT-2026-98561

In the Linux kernel, the following vulnerability has been resolved: drm/rockchip: analogix dp: fix unchecked bound endpoint name length rockchip dp drm encoder enable uses sprintf to format a device tree path into a 32-byte stack buffer. Device tree paths are not limited to this size, so a...

PT-2026-98338

Name of the Vulnerable Software and Affected Versions ningzichun student-management-system versions up to 98760f5711cf6dc8b4adca53a9e207ca49b02ebf Description A flaw exists in the example lite.sql file that allows a remote attacker to execute a manipulation leading to the use of default...

PT-2026-98706

In the Linux kernel, the following vulnerability has been resolved: bpf: Don't infer non-NULL from a pointer with an unbounded offset reg not null decides that a register holds a non-NULL value by looking at its type alone. For pointer types that allow arithmetic the type only guarantees a non-NU...

PT-2026-98674

In the Linux kernel, the following vulnerability has been resolved: net/sched: hhf: clamp quantum in change and init paths hhf change accepts any quantum from userspace, including 1. With a crafted size table qdisc pkt len reaches 2 GiB, so quantum=1 makes the deficit-refill loop spin 2^31 times...

PT-2026-98694

In the Linux kernel, the following vulnerability has been resolved: nexthop: Initialize extack in remove nh grp entry remove nh grp entry prints the extack message when a listener fails to replace the reduced nexthop group. However, extack is not initialized and listeners are not required to set ...

PT-2026-98932

Name of the Vulnerable Software and Affected Versions kitty versions 0.25.0 through 0.48.9 Description Missing authorization in the askpass escape code handler allows a local user to obtain text typed into a prompt displayed by the terminal. The handle remote askpass function in kitty/window.py...

PT-2026-98336

Name of the Vulnerable Software and Affected Versions ningzichun student-management-system versions up to 98760f5711cf6dc8b4adca53a9e207ca49b02ebf Description A remote authorization bypass exists in the file user/editLog.php. This issue occurs when the arguments sid, addtime, type, reason, detail...

PT-2026-99060

Name of the Vulnerable Software and Affected Versions TDuck survey form versions prior to 6.0 Description Insufficient authorization checks exist within the FormThemeController write endpoints for global form themes and categories. This allows authenticated users without administrative privileges...

PT-2026-98952

Name of the Vulnerable Software and Affected Versions Bludit CMS versions prior to 3.22.1 Description Authenticated users with the Author role can modify privileged page fields reserved for administrators by injecting reserved parameters into a content save request. This occurs because the...

PT-2026-99059

Name of the Vulnerable Software and Affected Versions X-SpringBoot versions prior to 6.0 Description The software exposes appKey and appSecret credentials via the 'GET /application/manager/select' endpoint. This occurs because the endpoint lacks authentication and field filtering, allowing...

PT-2026-99109

Name of the Vulnerable Software and Affected Versions GestSup versions prior to 3.2.61 Description An issue exists in the basic IMAP connector's attachment handling that fails to skip blocked file extensions. Unauthenticated attackers can send emails containing PHP attachments to monitored...

PT-2026-98627

In the Linux kernel, the following vulnerability has been resolved: net: stmmac: initialize ptp lock at probe time priv-ptp lock is only initialized in stmmac ptp register, which runs during stmmac open. However, the lock is also used while the interface is down and has never been opened: tc tapr...

PT-2026-98881

Name of the Vulnerable Software and Affected Versions InvoicePlane versions prior to 1.7.2 Description InvoicePlane stores an administrator-controlled custom field table value without validating it against allowed table names. The Mdl custom fields::used function later concatenates this stored...

PT-2026-98814

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A memory leak occurs in the nvmet-rdma module when the connect backlog limit is exceeded. In this scenario, the connect path drops the device reference but fails to release the newly...

PT-2026-98789

In the Linux kernel, the following vulnerability has been resolved: smb/client: validate new EOF for insert range smb3 insert range does not check if the new file size i size + len is valid. This allows FALLOC FL INSERT RANGE to bypass RLIMIT FSIZE, exceed s maxbytes, or produce a size outside th...

PT-2026-98830

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the ext4 file system where transaction overflow can occur during writeback. This happens because the reserved credits for extent conversion were insufficient in certai...

PT-2026-98695

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix subbuf resize races with trace pipe raw readers Concurrent subbuffer resizes may crash trace pipe raw readers or leak uninitialized memory to userspace due to stale size values. Modify ring buffer alloc read page to...

PT-2026-98799

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the NTFS driver where the ntfs dio zero range function fails to correctly handle errors from blkdev issue zeroout. Because the failure check in ntfs attr fallocate did...

PT-2026-98490

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the XFS file system where unit conversions in the per binval computation are performed incorrectly. Specifically, the second parameter of the xfs buf inval log space...

PT-2026-99110

Zoraxy versions 3.2.3 through 3.3.4 fail to properly parse IPv6 addresses in the RemoteAddr field when setting forwarded headers. Unauthenticated attackers connecting over IPv6 can supply arbitrary X-Forwarded-For values to spoof their source IP and bypass authorization provider IP-based access...

PT-2026-98320

Name of the Vulnerable Software and Affected Versions Lemonldap::NG::Portal versions 2.23.0 through 2.23.3 Description An issue exists where public Relying Parties in PKCE or secret mode can bypass Proof Key for Code Exchange PKCE, a security extension for OAuth 2.0 that prevents authorization co...

PT-2026-98861

Name of the Vulnerable Software and Affected Versions Espruino version 2v29 Description A NULL pointer dereference occurs in the jslGetRawString function within src/jslex.c. When provided with specially crafted raw or binary string input, the lexer may pass a NULL iterator target to the...

PT-2026-98825

Name of the Vulnerable Software and Affected Versions APSL puput versions 1.2.1 through 2.2.0 Description A reflected cross-site scripting XSS issue exists in the EntryAbstract.save function. This allows authenticated attackers with Wagtail Editor privileges to execute arbitrary code within the...

PT-2026-98823

Name of the Vulnerable Software and Affected Versions OpenStack Glance affected versions not specified Description A Server-Side Request Forgery SSRF issue exists in the Image API v2 of OpenStack Glance, specifically within the VMware datastore driver of glance store. When the show multiple...

PT-2026-99092

Name of the Vulnerable Software and Affected Versions X-SpringBoot versions prior to 6.0 Description Unauthenticated endpoints return login verification codes directly in HTTP responses without sending them to the account owners. An attacker can request these codes using a known mobile number or...

PT-2026-98822

Name of the Vulnerable Software and Affected Versions OpenStack Glance affected versions not specified Description A Server-Side Request Forgery SSRF issue exists in the Image API v2. When the show multiple locations configuration option is enabled in glance-api.conf, an authenticated attacker ca...

PT-2026-98984

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.0 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could have allowed an authenticated user to prevent another user from modifying their group settings due to improper validation o...

PT-2026-98845

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A tree connection leak exists in the smb2 tree connect function. The issue occurs when the ksmbd iov pin rsp function fails, resulting in the failure to disconnect the new tree connectio...

PT-2026-98811

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the BPF Berkeley Packet Filter subsystem regarding per-CPU map updates for array, hash, and cgroup storage maps when BPF F CPU or BPF F ALL CPUS are not used. The syst...