PT-2026-120214

Trigger.dev before 4.5.4 contains a hardcoded default secret vulnerability in the /coordinator Socket.IO namespace that allows unauthenticated attackers to connect using the published coordinator-secret value. Attackers can emit READY FOR EXECUTION to retrieve decrypted run environment variables ...

PT-2026-120729

Name of the Vulnerable Software and Affected Versions Storybook versions 8.0.0 through 8.6.18 Storybook versions 9.x through 9.1.20 Storybook versions 10.x through 10.6.1 Storybook versions 11.0.0-alpha.0 through 11.0.0-alpha.5 Description The development server can expose its WebSocket...

PT-2026-120197

Trigger.dev before 4.5.12 contains an authorization bypass vulnerability that allows authenticated project members to complete another member's DEVELOPMENT environment waitpoint by skipping the per-user environment ownership check. Attackers who know a victim's waitpoint friendly ID can submit...

PT-2026-120794

A flaw has been found in HarnessRouter up to 0.31.12. This impacts an unknown function of the file gateway/app.py of the component Targets Test Endpoint. Executing a manipulation of the argument base url can lead to server-side request forgery. The attack may be performed from remote. Upgrading t...

PT-2026-120706

Name of the Vulnerable Software and Affected Versions Cisco Expressway Series affected versions not specified Description An issue exists involving uncaught exceptions, which are errors that occur during program execution that the software fails to handle, leading to potential instability or...

PT-2026-120900

The ABC theme provides configurable layouts and visual styling for Drupal websites, including support for Font Awesome icons in navigation menus. The theme does not sufficiently sanitize menu link titles before inserting them into HTML class attributes. This vulnerability is mitigated by the...

PT-2026-120614

Name of the Vulnerable Software and Affected Versions WP Mailster versions prior to 1.9.1.1 Description An unrestricted file upload flaw allows an unauthenticated attacker to upload files of dangerous types, such as a web shell, to the web server. A web shell is a malicious script that allows...

PT-2026-120459

The HireZoot WordPress plugin before 4.1.1 does not sanitise and escape some of its stored data before outputting it in the admin dashboard, and additionally reverses the HTML-entity encoding that would otherwise neutralise it, allowing users with the Author role to perform Stored Cross-Site...

PT-2026-120674

Name of the Vulnerable Software and Affected Versions Electron versions prior to 42.11.9 Electron versions prior to 43.7.6 Electron versions prior to 44.5.0 Electron versions prior to 45.0.0-alpha.13 Description Pointer lock permission requests originating from certain cross-origin iframes cause...

PT-2026-120758

Apache Pulsar namespaces can restrict which roles may use a subscription, either with the Prefix subscription authentication mode, which requires a subscription name to start with the role name, or by granting permission on a subscription to specific roles. Topic-level subscription operations, su...

PT-2026-120807

A weakness has been identified in leomoon-studios wiki-go up to 1.9.1. Affected by this vulnerability is the function SaveHandler/SourceHandler of the file internal/handlers/editor.go of the component API. Executing a manipulation can lead to path traversal. The attack can be launched remotely. T...

PT-2026-120816

Name of the Vulnerable Software and Affected Versions EKKOLearnAI ekko-studio versions prior to 1.0.7 Description A flaw in the Media Generation API component allows remote exploitation via file inclusion. The issue exists within the saveGeneratedImages function located in the...

PT-2026-120194

Trigger.dev before 4.6.0 contains a missing authorization vulnerability in the waitpoint token wait endpoint that allows authenticated attackers to block runs belonging to other organizations. Attackers holding any secret API key can supply a victim run ID with their own waitpoint, causing that r...

PT-2026-120475

The TI WooCommerce Wishlist WordPress plugin before 2.13.0 does not enforce the same owner-only access control on its REST API that it applies on the front-end, allowing unauthenticated users to read the metadata and item contents of private wishlists...

PT-2026-120453

The Uncanny Toolkit for LearnDash WordPress plugin before 3.8.2 does not validate the origin of a password-reset request, allowing an unauthenticated attacker to set the password of a user who is partway through a password reset to an attacker-chosen value through a forged request, resulting in...

PT-2026-120173

FreeRDP from 2.0.0 before 3.32.0 contains an improper certificate validation vulnerability in its proxy that accepts untrusted target TLS certificates when no verification module is configured. Network-positioned attackers can intercept the proxy's outbound connection and present a self-signed,...

PT-2026-120346

Name of the Vulnerable Software and Affected Versions Tenda AC19 version 16.03.10.07 Description A stack-based buffer overflow exists in the httpd Web Management Service. The issue occurs within the formSetFirewallCfg function located in the /goform/SetFirewallCfg endpoint when processing the...

PT-2026-120477

The Advanced File Manager WordPress plugin before 6.0.0 does not correctly determine whether a stored file is an SVG before sanitising it, allowing users granted file-manager access by an administrator to store a file containing script that is not stripped and that runs in the browser of anyone w...

PT-2026-120455

The Backup and Staging by WP Time Capsule WordPress plugin before 1.22.28 does not perform capability or nonce checks on the handler that deploys a staging site to the live site, allowing any authenticated user with a Subscriber account on a WP Time Capsule staging site to overwrite the separate...

PT-2026-120213

Trigger.dev before 4.5.6 self-hosted Docker Compose deployments using the default secrets from hosting/docker/.env.example allow authentication bypass because the hardcoded MAGIC LINK SECRET lets anyone forge valid magic link tokens. Unauthenticated attackers can log in as any email address, then...

PT-2026-120622

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in WPdreams Ajax Search Lite ajax-search-lite allows Blind SQL Injection.This issue affects Ajax Search Lite: from n/a through 4.14.6...

PT-2026-120217

Trigger.dev before 4.5.0 looks up runs by friendlyId alone in the api.v1.runs.$runParam.replay route without scoping the lookup to the caller's runtime environment. An attacker holding any tenant's API key who knows a victim's run friendlyId can replay that run into their own environment and read...

PT-2026-120462

The Productive Commerce WordPress plugin before 1.1.49 does not perform a capability check in one of its AJAX actions and exposes the nonce that guards it on every admin-area page, allowing any authenticated user such as a subscriber to activate arbitrary Productive Commerce WordPress plugin befo...

PT-2026-120468

The Kliken: Ads + Pixel for Meta WordPress plugin before 1.2.3 does not verify that a visitor holds an order's key before outputting that order's details on the order confirmation page, allowing unauthenticated users to retrieve the billing location, purchased products and totals of other...

PT-2026-120458

The SmartyParcel WordPress plugin before 1.23.4 does not perform authorisation checks when serving shipping label downloads, allowing unauthenticated users to obtain the shipping labels of arbitrary orders, which contain customer names, addresses and phone numbers...

PT-2026-120466

The AI Engine WordPress plugin before 3.8.6 does not check that the caller is allowed to edit the targeted object before updating its title and excerpt, allowing users with the Editor role and above to modify arbitrary posts of any type, including content they cannot otherwise edit such as...

PT-2026-120463

The WPZOOM Portfolio Lite WordPress plugin before 1.4.34 does not check that a user is allowed to edit a post before changing its type and order, which could allow users with the contributor role and above to convert any other user's posts and pages into portfolio items, removing them from their...

PT-2026-120471

The miniOrange 2FA WordPress plugin before 6.3.1 does not prevent a pending passkey login from registering an additional passkey on an account that already has one configured, allowing an attacker who knows a user's password to add their own authenticator and bypass the second factor...

PT-2026-120442

A vulnerability in Cerberus FTP Server allows an authenticated remote attacker to perform UNC path injection via a manipulated parameter. By supplying a malicious SMB share path, an attacker can execute authentication coercion against the underlying server, resulting in the leakage of the Cerberu...

PT-2026-120449

The Booking Package WordPress plugin before 1.7.31 does not generate booking cancellation tokens using a secure source of randomness, deriving them instead from values it exposes publicly, so an unauthenticated attacker can reconstruct an arbitrary booking's token, disclose that booking's persona...

PT-2026-120465

The Swift Performance Lite WordPress plugin before 2.3.7.4 does not properly sanitize and escape a value before using it in a SQL statement, which could allow users with the author role and above to perform SQL injection attacks...

PT-2026-120460

The SureCart WordPress plugin before 4.9.5 does not restrict which related objects an anonymous visitor may include when reading a single upsell funnel through its REST API, nor strip private fields from those objects, allowing unauthenticated users to read merchant-private catalog data such as...

PT-2026-120446

The Appointment Booking Plugin WordPress plugin before 5.7.5 does not verify that an authenticated agent-level user is assigned to a customer before returning or searching that customer's record, allowing any agent to read and enumerate the personal information of every customer on the site,...

PT-2026-120445

The Payment Gateway for Idram WordPress plugin before 2.1.6 does not verify the authenticity of incoming payment notifications, because the merchant credentials used to compute their checksum are empty by default, allowing unauthenticated attackers to forge a valid payment confirmation and mark...

PT-2026-120754

The Apache Pulsar broker admin REST API provides a truncate operation for persistent topics DELETE /admin/v2/persistent/tenant/namespace/topic/truncate. Truncating a topic moves all subscription cursors of the topic to the end of the topic and deletes the topic's inactive ledgers. Truncating a...

PT-2026-120805

Name of the Vulnerable Software and Affected Versions @sentry/nextjs versions 9.36.0 through 9.47.1 @sentry/nextjs versions 10.x through 10.75.1 @sentry/nextjs versions 11.0.0-rc.0 Description The webpack integration for @sentry/nextjs skips application middleware for every request path under a...

PT-2026-120822

Name of the Vulnerable Software and Affected Versions Pillow versions prior to 13.0.0 Description On Windows, the src/PIL/WmfImagePlugin.py component passes unchecked 32-bit WMF or EMF dimensions to the native drawwmf handler in src/display.c. The handler determines the size of a Device Independe...

PT-2026-120717

Name of the Vulnerable Software and Affected Versions Electron versions prior to 42.11.6 Electron versions prior to 43.7.3 Electron versions prior to 44.4.3 Electron versions prior to 45.0.0-alpha.9 Description In the main process for macOS offscreen rendering, frame data received from the GPU...

PT-2026-120731

Name of the Vulnerable Software and Affected Versions Astro versions prior to 7.3.2 Description The JSX and MDX rendering pipeline in the astro:jsx renderer treats string children of script and style elements as trusted HTML. It fails to distinguish between compiler-generated literal content and...

PT-2026-120676

Impact For hid and usb permission checks made from an iframe, session.setPermissionCheckHandler was given the top-level frame's origin and details instead of the requesting frame's. Apps that allow these permissions based on origin could grant an embedded frame access intended for the top-level...

PT-2026-120677

Name of the Vulnerable Software and Affected Versions Electron versions prior to 42.11.3 Electron versions prior to 43.7.0 Electron versions prior to 44.3.0 Electron versions prior to 45.0.0-alpha.5 Description Requests to open external protocol URLs can be attributed to a document other than the...

PT-2026-120751

The Apache Pulsar broker exposes a transaction administration REST API under /admin/v3/transactions. When authentication and authorization are enabled, most of the read endpoints of this API verify only that the request is authenticated and that the broker serves the requested topic or transactio...

PT-2026-120753

Apache Pulsar allows an administrator to require end-to-end message encryption for all topics in a namespace by setting the encryption required namespace policy. When this policy is set, the broker rejects messages that are published without encryption. When the broker loads a persistent topic, i...

PT-2026-120493

In Eclipse OpenJ9 versions prior to 0.63.0, the JITServer component is vulnerable to a pre-authentication remote denial of service. When processing the initial 4-byte length field of an incoming TCP connection, an integer overflow in MessageBuffer::computeRequiredCapacity causes the receiving...

PT-2026-120834

Name of the Vulnerable Software and Affected Versions Pillow versions 5.1.0 through 12.11.0 Description The PdfParser.linearize page tree function in src/PIL/PdfParser.py treats a PDF /Pages graph as a tree without tracking duplicate indirect references. When the Image.save function is used with...

PT-2026-120724

The Pulsar broker serves two schema commands on its binary protocol: GetSchema, which returns the schema registered for a topic, and GetOrCreateSchema, which registers a new schema version for an existing topic. The broker handled both commands after checking only that the client connection was...

PT-2026-120759

When a configured proxy role sends a request to the broker on behalf of another user the original principal, the broker is designed to authorize both the proxy role and the original principal and to allow the request only if both are authorized, so that the original principal cannot exceed its ow...

PT-2026-120551

Name of the Vulnerable Software and Affected Versions Node.js versions 22.x Node.js versions 24.x Node.js versions 26.x Description A flaw in TLS hostname verification occurs when a client connects using a non-canonical IPv4 spelling, such as 0177.0.0.1, 0x7f.0.0.1, 2130706433, or 127.1. The...

PT-2026-120765

VaadinService.requestEnd in Vaadin Framework 8 locks the session and then reads the v-uiId request parameter outside the block that releases the lock. A request carrying a non-numeric v-uiId makes Integer.parseInt throw while the session lock is held, so the lock is never released and the contain...

PT-2026-120749

Name of the Vulnerable Software and Affected Versions Node.js versions 26.x Node.js versions 24.x Node.js versions 22.x Description A flaw in the HTTP Agent connection reuse mechanism allows a client to accept a response as valid even if it was sent before the client issued the request. This occu...