PT-2026-120225

Coraza from 3.0.0 before 3.8.1 has a JSON body processor that flattens nested properties into dot-separated ARGS POST names without escaping literal dots, so distinct properties collide. Unauthenticated attackers can add a later dotted property such as account.role that overwrites a malicious...

PT-2026-120774

The device multiplexer pseudo-driver in drivers/misc/devmux/devmux.c exposes two system calls, devmux select get and devmux select set. When CONFIG USERSPACE is enabled, their user-mode verifiers z vrfy devmux select get and z vrfy devmux select set forwarded directly to the kernel implementation...

PT-2026-120777

The kernel helper z waitq head kernel/include/wait q.h reads the head of a thread wait queue, but on SMP systems it was called from several places without holding the scheduler spinlock sched spinlock that serializes wait-queue mutation. The consequential call site is z timer expiration handler i...

PT-2026-120776

The Infineon PSOC 6 BLESS HCI driver in drivers/bluetooth/hci/hci infineon psoc6 bless.c stored the outgoing HCI packet descriptor in a file-scope variable, static cy stc ble hci tx packet info t hci tx pkt. psoc6 bless send cleared and populated that descriptor's packetType, dataLength and data...

PT-2026-120772

The Bluetooth Classic A2DP host stores a codec Information Element IE in struct bt a2dp codec ie, a one-byte len field plus a fixed 8-byte codec ie array. When an AVDTP peer sent a codec IE longer than 8 bytes, a2dp process config ind in subsys/bluetooth/host/classic/a2dp.c copied only the first ...

PT-2026-120778

The Nuvoton NPCX eSPI driver parses Target-Attached-Flash TAF requests in espi taf parse drivers/espi/espi npcx.c, taking the 12-bit length field directly out of the request header in the FLASHRXBUF FIFO. For write and RPMC OP1 requests it copied DIV ROUND UPlen, 4 words into struct espi taf...

PT-2026-120672

Name of the Vulnerable Software and Affected Versions Electron versions prior to 42.11.3 Electron versions prior to 43.7.0 Electron versions prior to 44.3.0 Electron versions prior to 45.0.0-alpha.6 Description Electron incorrectly treats pages opened in a new window from links as...

PT-2026-120673

Name of the Vulnerable Software and Affected Versions Electron versions prior to 42.11.1 Electron versions prior to 43.5.1 Electron versions prior to 44.1.1 Electron versions prior to 45.0.0-alpha.4 Description The chrome.tabs.query function returns the URL and title of each tab to extensions tha...

PT-2026-120795

Name of the Vulnerable Software and Affected Versions Amazon SageMaker Python SDK V3 versions prior to 3.10.0 Amazon SageMaker Python SDK V2 versions prior to 2.257.3 Description Insufficient verification of the communication channel source within the default bucket function allows remote actors ...

PT-2026-120752

The Apache Pulsar broker admin REST API provides endpoints to read, set and remove the topic-level entry filter policy of a topic. For persistent topics these endpoints check that the caller is authorized for the entry filters topic policy operation. The corresponding endpoints for non-persistent...

PT-2026-120226

Coraza from 3.0.4 before 3.8.1 contains a request body inspection bypass because request-body processor selection compares the entire Content-Type value exactly, so URL-encoded bodies whose Content-Type carries a media-type parameter are never parsed. Unauthenticated attackers can send...

PT-2026-120887

GitLab has remediated an issue in GitLab EE affecting all versions from 17.4 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that under certain conditions could have allowed an authenticated to bypass a required merge request approval policy on a protected branch due to improper access...

PT-2026-120888

Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 10.1 through 19.3.5 GitLab CE/EE versions 19.4 through 19.4.2 GitLab CE/EE versions 19.5 through 19.5.0 Description An issue exists when OmniAuth SAML and LDAP auto-linking are both enabled. An authenticated user can take...

PT-2026-120889

GitLab has remediated an issue in GitLab EE affecting all versions from 12.0 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, when the instance-wide SAML or LDAP membership lock was enabled, an authenticated user could have granted or accepted project and group membership outside t...

PT-2026-120232

HKUDS Vibe-Trading from 0.1.0 before 0.1.7 contains a path traversal vulnerability that allows remote attackers to read sensitive server files through LLM agent file-read tools. Attackers can prompt the agent to invoke read document, which lacks sandbox checks, or safe user path-gated tools to le...

PT-2026-120185

ArcadeDB before 26.10.1 contains a remote code execution vulnerability that allows authenticated users, including read-only reader role holders, to execute Groovy code because GremlinQueryEngine.command lacks scripting authorization checks. Attackers can submit Gremlin commands to the POST...

PT-2026-120170

FreeRDP before 3.32.1 contains a heap out-of-bounds read vulnerability in the Android client that allows malicious RDP servers to read beyond surface buffers by supplying unvalidated mappedWidth and mappedHeight values. Attackers can send a crafted RDPGFX MAP SURFACE TO WINDOW PDU with oversized...

PT-2026-120167

FreeRDP before 3.32.1 on Windows contains a heap out-of-bounds read in client cli present gateway message that passes a byte count as wide-character printf precision. A malicious RD Gateway can send pre-authentication consent or service messages, causing the client to read twice the buffer size,...

PT-2026-120180

vLLM before 0.31.0 contains a cache aliasing vulnerability that allows authenticated attackers to collide shared cache keys by supplying caller-controlled values such as EXIF ImageID or cache salt. Attackers can set a UUID EXIF ImageID to receive another request's cached processed media, or match...

PT-2026-120181

Name of the Vulnerable Software and Affected Versions vLLM versions 0.7.3 through 0.30.x Description An uncontrolled resource consumption issue allows remote clients to manipulate multimodal processor parameters by providing per-request mm processor kwargs. Attackers can specify excessive values...

PT-2026-120193

Trigger.dev 4.5.0 before 4.6.2 contains an improper authorization vulnerability in the PUT snapshot-url session endpoint that allows public session token holders to obtain presigned S3 write URLs. End users can overwrite their own session's durable chat snapshot to forge the agent's conversation...

PT-2026-120184

ArcadeDB from 26.2.1 before 26.10.1 contains a missing authorization vulnerability in the Bolt protocol handler that lets authenticated users read other databases' schema metadata. Attackers with credentials for one database can set the db field in RUN or BEGIN messages and call db.labels or SHOW...

PT-2026-120183

ArcadeDB from 26.2.1 before 26.10.1 contains a missing authorization vulnerability in the Bolt protocol handler that allows authenticated users to enumerate all database names. Attackers with credentials for any single database can issue a SHOW DATABASES query over the Bolt port to reveal...

PT-2026-120438

A security vulnerability has been detected in DT42 BerryNet up to 3.10.2. The affected element is the function DLModelManager.get model meta of the file berrynet/dlmodelmgr.py of the component Model Package Metadata Handler. The manipulation of the argument label leads to path traversal. The atta...

PT-2026-120561

A data race in the RDMA transport of Apache bRPC versions 1.18.0 allows a remote client to crash the server process denial of service when RDMA is enabled at build time and runtime. Root Cause: When a bRPC server negotiates RDMA with a client, the handshake completes on the TCP fd, but the server...

PT-2026-120845

In Splunk Enterprise versions below 10.4.4, a user that holds a role with the preview data management pipeline capability or edit data management pipeline job capability could read or delete Data Management SPL2 preview jobs and results outside their ownership scope. The vulnerability is possible...

PT-2026-120861

In Splunk SOAR versions below 8.7.0, a user that holds a role with the install apps capability could store attacker-controlled content that Splunk SOAR displays in app documentation by installing an app. If another user who holds a role with permission to view apps opens the app documentation,...

PT-2026-120814

Name of the Vulnerable Software and Affected Versions GitPython versions prior to 3.2.1 Description The create submodule function in git/objects/submodule/base.py accepts an attacker-influenced submodule path and invokes clone repo before rejecting the destination. In versions 3.1.x, the validate...

PT-2026-122477

Уязвимость микропрограммного обеспечения шлюза Cisco Expressway связана с неконтролируемым достижимым утверждением. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, вызвать отказ в обслуживании...

PT-2026-122462

Уязвимость компонента session.upload progress ядра интерпретатора языка программирования PHP связана с использованием памяти после освобождения. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, выполнить произвольный код путем отправки специально сформированного...

PT-2026-122482

Уязвимость микропрограммного обеспечения шлюза Cisco Expressway связана с некорректным определением символических ссылок перед доступом к файлу. Эксплуатация уязвимости может позволить нарушителю оказать воздействие на конфиденциальность, целостность и доступность защищаемой информации...

PT-2026-122474

Уязвимость функции обработки пакетов IPv4 операционной системы Cisco IOS XR сетевых устройств Cisco ASR 9000 и ASR 9900 связана с недостаточной проверкой входных данных. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, вызвать отказ в обслуживании...

PT-2026-122481

Уязвимость микропрограммного обеспечения шлюза Cisco Expressway связана с недостаточным контролем ресурса в период его существования. Эксплуатация уязвимости может позволить нарушителю оказать воздействие на конфиденциальность, целостность и доступность защищаемой информации...

PT-2026-122476

Уязвимость микропрограммного обеспечения шлюза Cisco Expressway связана с выходом операции за границы буфера в памяти. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, вызвать отказ в обслуживании...

PT-2026-122480

Уязвимость микропрограммного обеспечения шлюза Cisco Expressway связана с неверным управлением генерацией кода. Эксплуатация уязвимости может позволить нарушителю оказать воздействие на конфиденциальность, целостность и доступность защищаемой информации...

PT-2026-122483

Уязвимость микропрограммного обеспечения шлюза Cisco Expressway связана с неограниченной загрузкой файлов опасного типа. Эксплуатация уязвимости может позволить нарушителю оказать воздействие на целостность и доступность защищаемой информации...

PT-2026-122478

Уязвимость микропрограммного обеспечения шлюза Cisco Expressway связана с разыменованием указателей. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, вызвать отказ в обслуживании...

PT-2026-120917

This module enables users to upload files and create media items in bulk. The module doesn't sufficiently check user permission to create specific media types if the bulk upload form is configured for that media type. This vulnerability is mitigated by the fact that an attacker must have a role...

PT-2026-120178

vLLM after 0.24.0 and before 0.31.0 contains a memory exhaustion vulnerability in MOSS-Audio model serving that caches a processor for every distinct request-controlled mm processor kwargs value in an unbounded dictionary. Unauthenticated attackers can send distinct or oversized mel config values...

PT-2026-120773

The user-mode verifier for the peci transfer system call, z vrfy peci transfer in drivers/peci/peci handlers.c, checked only the device object permission and copied the caller-supplied struct peci msg with k usermode from copy. That copy validates the outer structure only; the buf pointers and le...

PT-2026-120779

The MCTP-over-I2C+GPIO target binding in subsys/pmci/mctp/mctp i2c gpio target.c emulates a small pseudo-register file, where the bus controller first writes a register number and then writes or reads payload bytes. The selected register b-reg addr and the data-phase flag b-rxtx were never cleare...

PT-2026-120715

A vulnerability has been found in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. This vulnerability affects the function delete folder of the file ajax.php of the component AJAX Handler. The manipulation of the argument ID leads to missing authentication. The...

PT-2026-120560

A reachable assertion in Apache bRPC version 1.18.0 on all platforms allows a malicious remote peer to crash the process, resulting in denial of service. Root Cause: When a Socket with health checking enabled fails, Socket::WaitAndReset closes its file descriptor while the event dispatcher may...

PT-2026-120234

HKUDS Vibe-Trading from 0.1.0 before 0.1.7 contains a missing authentication vulnerability that allows unauthenticated attackers to access the FastAPI surface because require auth returns early when API AUTH KEY is unset. Attackers can post messages to /sessions/id/messages to trigger root shell...

PT-2026-120646

Improper link resolution before file access 'link following' vulnerability in Velneo vServer. This issue affects vServer: from 32.3 before 36.6 and from 37.1 before 37.2...

PT-2026-120288

A flaw has been found in itsourcecode Online Cake Ordering System 1.0. Affected by this vulnerability is an unknown functionality of the file /deletecustomer.php. This manipulation of the argument ID causes sql injection. The attack is possible to be carried out remotely. The exploit has been...

PT-2026-120450

The Booking Package WordPress plugin before 1.7.31 does not perform any authorization or validity check before resetting its premium subscription state, allowing unauthenticated attackers to disable the Booking Package WordPress plugin before 1.7.31's paid features...

PT-2026-120608

WarehousePG WHPG 7.2.1 through 7.6.0 is affected by a missing authorization vulnerability CWE-862 in the built-in function gp log backend memory contexts. Any authenticated database role can run this function without a GRANT. It also gets around the superuser restriction that PostgreSQL places on...

PT-2026-120609

WarehousePG WHPG 6.27.1 through 6.27.6 and 7.2.1 through 7.6.0 are affected by a missing authorization vulnerability CWE-862 in the built-in cluster expansion functions gp expand lock catalog and gp expand bump version. Any authenticated database role can run them, and neither checks privileges. ...

PT-2026-120610

WarehousePG WHPG 6.27.1 through 6.27.6 and 7.2.1 through 7.6.0 are affected by a missing authorization vulnerability CWE-862 in gp add coordinator standby. The function is named gp add master standby in WHPG 6, and WHPG 7 keeps that name as an alias. Unlike the other segment add and remove...