PT-2026-99007

Parse Server before 4.10.0 was affected by a supply chain incident in which incorrect version tags were pushed to the official repository pointing to an unreviewed personal fork of a contributor with write access. No releases were published with these tags; a project was exposed only if it define...

PT-2026-99006

OpenBao is an open source identity-based secrets management system. Prior to 2.5.5, an authenticated OpenBao caller with write access to transit/keys/ could terminate the server process by setting derived to true while the type parameter selected rsa-, ecdsa-, or ed25519. The Transit policy...

PT-2026-98470

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A CPU soft lockup can occur in the scsi qla2xxx driver due to an incorrect polling mechanism in the qla27xx copy multiple pkt and qla27xx copy fpin pkt functions. These functions poll th...

PT-2026-98712

In the Linux kernel, the following vulnerability has been resolved: bpf: zero extend the result of an arena 32-bit cmpxchg bpf convert ctx accesses rewrites an atomic on an arena pointer from BPF STX | BPF ATOMIC to BPF STX | BPF PROBE ATOMIC, and it runs before bpf opt subreg zext lo32 rnd hi32...

PT-2026-98839

Name of the Vulnerable Software and Affected Versions kitty versions 0.47.0 through 0.48.x Description Improper link resolution in the drag source staging path of the drag and drop protocol allows a program writing to the terminal to create files and directories outside the staging directory. Thi...

PT-2026-98410

Name of the Vulnerable Software and Affected Versions StockAgile affected versions not specified Description Stored Cross-Site Scripting XSS occurs in the API and management panel. The issue exists on the server side within the '/inventory/configuration/payment-methods' endpoint, where malicious...

PT-2026-98383

Name of the Vulnerable Software and Affected Versions SSL Zen plugin for WordPress versions prior to 4.7.43 Description Reflected Cross-Site Scripting occurs when unauthenticated attackers trick users into clicking specially crafted links to inject arbitrary web scripts. The issue exists because...

PT-2026-98676

In the Linux kernel, the following vulnerability has been resolved: net/sched: fq pie: clamp quantum in change path fq pie change accepts any quantum value from userspace, including 1. With a crafted size table qdisc pkt len reaches 2 GiB, so quantum=1 makes the deficit-refill loop spin 2^31 time...

PT-2026-98369

Name of the Vulnerable Software and Affected Versions Gutenverse versions prior to 4.0.9 Description The Gutenverse – WordPress Blocks, Page Builder & Site Editor plugin for WordPress contains a Stored Cross-Site Scripting issue. Authenticated attackers with contributor-level access or higher can...

PT-2026-98416

Name of the Vulnerable Software and Affected Versions StockAgile affected versions not specified Description Stored Cross-Site Scripting XSS occurs in the API and management panel. The issue exists on the server side within the '/inventory/configuration/categories' endpoint, where malicious...

PT-2026-98599

In the Linux kernel, the following vulnerability has been resolved: tracing: Set the trace clock before registering the histogram trigger hist register trigger puts the trigger on the global named triggers list in cmd ops-init, and only then sets the trace clock: if data-cmd ops-init ret = data-c...

PT-2026-98874

Name of the Vulnerable Software and Affected Versions Input Leap versions prior to 3.0.4 Description When the non-default --enable-drag-drop option is active on Windows or macOS, the software mishandles the distinction between forward slashes / and backslashes . This flaw allows directory travers...

PT-2026-98468

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the scsi qla2xxx driver where the qla nvme xmt ls rsp function fails to remove uctx from the fcport-unsol ctx head list before freeing it with kfree during an LS rejec...

PT-2026-98711

In the Linux kernel, the following vulnerability has been resolved: bpf: don't rewrite bpf fastcall patterns entered by a jump mark fastcall pattern for call must ensure that matched "spill; call; fill" instruction series is not interrupted by a jump. Otherwise the rewrite applied by bpf remove...

PT-2026-99107

Name of the Vulnerable Software and Affected Versions pgPointcloud versions prior to 1.2.6 Description An issue exists in the dimensional patch WKB Well-Known Binary deserialization process. Authenticated database users can exploit this by providing crafted pcpatch values with manipulated size...

PT-2026-98555

In the Linux kernel, the following vulnerability has been resolved: net: bridge: use option bits for CFM/MRP frame handlers CFM and MRP register a global br frame type whose hlist node is linked into the per-bridge frame type list when the first MEP/MRP instance is created. Enabling the protocol ...

PT-2026-98394

Name of the Vulnerable Software and Affected Versions User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor versions prior to 4.0.3 Description Insufficient input sanitization and output escaping allow authenticated attackers with subscriber-level access and...

PT-2026-98580

In the Linux kernel, the following vulnerability has been resolved: accel/ivpu: Validate firmware log buffer metadata The tracing log headers parsed by fw log print buffer reside in DMA-shared BOs that the NPU firmware can write to. fw log from bo validated log-header size and log-size, but fw lo...

PT-2026-98662

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfnetlink log: cope with concurrent instance destruction Instances are refcounted. However, only memory release happens on the 1 - 0 transition; the unlink from hashes can occur with any refcount. Uncooperative userspa...

PT-2026-99070

Name of the Vulnerable Software and Affected Versions GLPI versions 0.70 through 10.0.25 GLPI versions 11.0.0 through 11.0.7 Description A technician can manipulate the authtype value via the API to modify the authentication method of another user. In environments utilizing SSO logins or the lega...

PT-2026-98880

Name of the Vulnerable Software and Affected Versions InvoicePlane versions prior to 1.7.2 Description The Invoices::generate xml function appends a database-derived xml id to the XMLconfigs helper directory and includes the resulting PHP path without proper validation of the identifier. A...

PT-2026-99011

Parse Server versions = 9.0.0 before 9.10.0 and = 8.2.2 before 8.6.86 return GraphQL validation error messages that name required custom input fields even when public introspection is disabled graphQLPublicIntrospection: false, the default. A client holding only the public application id — with n...

PT-2026-98683

In the Linux kernel, the following vulnerability has been resolved: pds core: fix cmd regs access racing BAR unmap on reset pdsc reset prepare and pdsc reset done's pdsc map bars error path clear/iounmap cmd regs without devcmd lock, and pdsc legacy firmware update's download loop derefs cmd regs...

PT-2026-98899

Name of the Vulnerable Software and Affected Versions Zammad versions prior to 7.0.2 Description An issue with permission checks in the knowledge base management area allows users with limited read permissions to interact with items outside their assigned access scope due to incomplete data...

PT-2026-98421

Name of the Vulnerable Software and Affected Versions lazy html versions 0.1.0 through 0.1.12 Description An issue exists where improper neutralization of input during web page generation allows mutation Cross-site Scripting XSS. This occurs during a parse and serialize round-trip of...

PT-2026-98690

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A flaw exists in the mv88e6xxx get rxnfc function within the net: dsa: mv88e6xxx module. The function uses rxnfc-rule cnt as a write index when dumping the policy IDR, which overwrites t...

PT-2026-98384

Name of the Vulnerable Software and Affected Versions SSL Zen — SSL Certificate Installer & HTTPS Redirects versions prior to 4.7.43 Description The plugin is subject to Directory Traversal, a flaw that allows an attacker to access files and directories that are stored outside the web root folder...

PT-2026-99111

Name of the Vulnerable Software and Affected Versions MediaFlow Proxy versions prior to 2.5.0 Description An issue exists in the '/proxy' endpoint where missing and incomplete destination validation of the d query parameter allows for server-side request forgery SSRF. This occurs when a server is...

PT-2026-98362

Name of the Vulnerable Software and Affected Versions Automation Web Platform – Notifications and OTP for WooCommerce, Advanced Country Code plugin for WordPress versions prior to 4.8.7 Description An issue exists due to missing permission enforcement on the publicly accessible REST route POST...

PT-2026-98978

GitLab has remediated an issue in GitLab EE affecting all versions from 18.11 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could have allowed an authenticated user with the Security Manager role to execute arbitrary CI/CD jobs and access protected...

PT-2026-98396

Name of the Vulnerable Software and Affected Versions Optima Express IDX versions prior to 8.7.6 Description An issue allows unauthenticated attackers to escalate the privileges of a pre-registered account to the Author role. This occurs because the provisionBlogCredentials function in...

PT-2026-98485

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the xfs module where the xfs btree bload prep block function fails to release the new bp variable if the xfs btree bload drop buf function encounters an IO error while...

PT-2026-98381

Name of the Vulnerable Software and Affected Versions WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters versions prior to 4.9.9 Description Insufficient input sanitization and output escaping allow authenticated attackers with subscriber-level access and above t...

PT-2026-98561

In the Linux kernel, the following vulnerability has been resolved: drm/rockchip: analogix dp: fix unchecked bound endpoint name length rockchip dp drm encoder enable uses sprintf to format a device tree path into a 32-byte stack buffer. Device tree paths are not limited to this size, so a...

PT-2026-98706

In the Linux kernel, the following vulnerability has been resolved: bpf: Don't infer non-NULL from a pointer with an unbounded offset reg not null decides that a register holds a non-NULL value by looking at its type alone. For pointer types that allow arithmetic the type only guarantees a non-NU...

PT-2026-98674

In the Linux kernel, the following vulnerability has been resolved: net/sched: hhf: clamp quantum in change and init paths hhf change accepts any quantum from userspace, including 1. With a crafted size table qdisc pkt len reaches 2 GiB, so quantum=1 makes the deficit-refill loop spin 2^31 times...

PT-2026-98694

In the Linux kernel, the following vulnerability has been resolved: nexthop: Initialize extack in remove nh grp entry remove nh grp entry prints the extack message when a listener fails to replace the reduced nexthop group. However, extack is not initialized and listeners are not required to set ...

PT-2026-98932

Name of the Vulnerable Software and Affected Versions kitty versions 0.25.0 through 0.48.9 Description Missing authorization in the askpass escape code handler allows a local user to obtain text typed into a prompt displayed by the terminal. The handle remote askpass function in kitty/window.py...

PT-2026-98336

Name of the Vulnerable Software and Affected Versions ningzichun student-management-system versions up to 98760f5711cf6dc8b4adca53a9e207ca49b02ebf Description A remote authorization bypass exists in the file user/editLog.php. This issue occurs when the arguments sid, addtime, type, reason, detail...

PT-2026-99059

Name of the Vulnerable Software and Affected Versions X-SpringBoot versions prior to 6.0 Description The software exposes appKey and appSecret credentials via the 'GET /application/manager/select' endpoint. This occurs because the endpoint lacks authentication and field filtering, allowing...

PT-2026-99109

Name of the Vulnerable Software and Affected Versions GestSup versions prior to 3.2.61 Description An issue exists in the basic IMAP connector's attachment handling that fails to skip blocked file extensions. Unauthenticated attackers can send emails containing PHP attachments to monitored...

PT-2026-98627

In the Linux kernel, the following vulnerability has been resolved: net: stmmac: initialize ptp lock at probe time priv-ptp lock is only initialized in stmmac ptp register, which runs during stmmac open. However, the lock is also used while the interface is down and has never been opened: tc tapr...

PT-2026-98881

Name of the Vulnerable Software and Affected Versions InvoicePlane versions prior to 1.7.2 Description InvoicePlane stores an administrator-controlled custom field table value without validating it against allowed table names. The Mdl custom fields::used function later concatenates this stored...

PT-2026-98814

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A memory leak occurs in the nvmet-rdma module when the connect backlog limit is exceeded. In this scenario, the connect path drops the device reference but fails to release the newly...

PT-2026-98789

In the Linux kernel, the following vulnerability has been resolved: smb/client: validate new EOF for insert range smb3 insert range does not check if the new file size i size + len is valid. This allows FALLOC FL INSERT RANGE to bypass RLIMIT FSIZE, exceed s maxbytes, or produce a size outside th...

PT-2026-98830

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the ext4 file system where transaction overflow can occur during writeback. This happens because the reserved credits for extent conversion were insufficient in certai...

PT-2026-98695

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix subbuf resize races with trace pipe raw readers Concurrent subbuffer resizes may crash trace pipe raw readers or leak uninitialized memory to userspace due to stale size values. Modify ring buffer alloc read page to...

PT-2026-98687

In the Linux kernel, the following vulnerability has been resolved: s390/ism: folio put after error dmb-cpu addr was allocated via folio alloc. Use folio put instead of kfree in the error exit of ism alloc dmb to avoid slab allocator corruption. While at it, reset dmb-cpu addr after folio put to...

PT-2026-98999

Circles' remote-instance signature verification fetches the attacker-supplied keyId URL before trust in the remote instance is established, and explicitly allows local/private addresses for this request, bypassing Nextcloud's core SSRF protections. The public, unauthenticated endpoints POST...

PT-2026-98817

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An out-of-bounds read issue exists in the resp worker function within the accel/qaic component. This occurs because the logic for handling DBC deactivation skipped the bounds checking co...