200653 matches found
PT-2026-76868
Mahara before 25.04.5 and 26.04.0 is vulnerable to unauthorized access to internal accounts via Learning Tools Interoperability LTI under certain circumstances. This applies to LTI 1.1 and LTI 1.3 Advantage...
PT-2026-73251
Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, plugins/chat/lib/chat/onebox handler.rb resolves Chat::Thread by route thread id independently of the route channel id before checking whether the user can preview the selected chat channel. An...
PT-2026-73228
UAF vulnerability in the time and time zone module. Impact: Successful exploitation of this vulnerability may affect availability...
PT-2026-73257
Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, the Rich Text Editor rendered a chat-transcript username as HTML, allowing stored cross-site scripting. This issue is fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0...
PT-2026-73231
Permission control vulnerability in the Gallery module. Impact: Successful exploitation of this vulnerability may affect service confidentiality...
PT-2026-73377
An authenticated user with basic write privileges can cause the mongod process to terminate abnormally by sending a crafted transaction command with an incomplete set of required fields. The issue stems from inconsistent validation across related transaction command parameters, resulting in a fat...
PT-2026-73373
Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.4.21, 4.5.14, 4.6.4, and 4.7.0, PrivateAddressCheck.private address? in app/lib/private address check.rb normalized IPv4-mapped IPv6 addresses but did not recognize IPv4-compatible IPv6 addresses with IPAddripv...
PT-2026-73287
Ghost is a Node.js content management system. From 6.26.0 until 6.54.1, a validation issue allowed some functionality, such as Webmentions, to be abused by an unauthenticated user to make limited HTTP requests to hosts in the Ghost server's internal network. A successful attack would not result i...
PT-2026-73221
A vulnerability was detected in itsourcecode Hospital Management System 1.0. The impacted element is an unknown function of the file /viewprescriptionrecord.php. The manipulation of the argument delid results in sql injection. It is possible to launch the attack remotely. The exploit is now publi...
PT-2026-73191
A security flaw has been discovered in treefrogframework treefrog-framework up to 2.11.2. This vulnerability affects the function std::strncmp of the file src/tsessioncookiestore.cpp of the component Session Cookie Handler. The manipulation results in improper authentication. The attack can be...
PT-2026-73217
A vulnerability was identified in Webkul Bagisto up to 2.4.4. This vulnerability affects unknown code of the file /admin/customers of the component Backend Customer Behavior Data Endpoint. Such manipulation of the argument ID leads to improper privilege management. The attack can be executed...
PT-2026-73201
A security vulnerability has been detected in GL.iNet BE9300 and MT6000 4.8.x. This vulnerability affects unknown code of the component Firewall-management RPC. The manipulation of the argument dest port/dest ip leads to os command injection. The attack may be initiated remotely. Upgrading to...
PT-2026-73189
A vulnerability has been found in itsourcecode Hospital Management System 1.0. Affected is an unknown function of the file /viewpatient.php. Such manipulation of the argument delid leads to sql injection. The attack may be performed from remote. The exploit has been disclosed to the public and ma...
PT-2026-73384
A user with read-only privileges is able to craft an aggregation pipeline using the $linearFill window function operator with a specific sortBy expression type to cause the mongod process to terminate abnormally, resulting in denial of service. The issue stems from insufficient validation of sort...
PT-2026-76615
openssl encrypt versions before 1.4.0 contain an information disclosure vulnerability in the /ready endpoint that returns full database exception strings to unauthenticated callers. Attackers can trigger database errors to extract sensitive information including hostnames, IP addresses, connectio...
PT-2026-76870
An issue in Trueview T18061 WiFi 3MP Robot Pan-Tilt Security Camera Version 1.0 allows a physically proximate attacker to escalate privileges via the RSA private key component...
PT-2026-76746
An issue in GAPTEQ Designer v.3.5 allows a remote attacker to escalate privileges via the Company Manger role...
PT-2026-76665
Dell ObjectScale, versions prior to 4.3.0.1, contains an Insertion of Sensitive Information into Log File vulnerability in the svc tools. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information disclosure...
PT-2026-76670
Mattermost versions 11.7.x = 11.7.6, 10.11.x = 10.11.21 Mattermost failed to restrict OAuth deauthorization and personal access token management endpoints to direct user sessions, which allowed an OAuth app with a delegated user token to revoke the user's authorizations or tokens for other...
PT-2026-76622
openssl encrypt versions before 1.4.0 contain a plugin sandbox bypass vulnerability where the PluginImportGuard blocks a different set of modules than the AST analyzer's DANGEROUS MODULES set. Attackers can bypass AST analysis through string obfuscation or encoding to import unblocked dangerous...
PT-2026-76869
Name of the Vulnerable Software and Affected Versions Mahara versions prior to 25.04.5 Mahara versions prior to 26.04.0 Description An issue exists in the Text block/section functionality where a specifically crafted call allows the retrieval of backed-up content from a different Text section,...
PT-2026-73290
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.6 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an authenticated user with developer-role permissions to commit changes to a project after being removed as a...
PT-2026-76761
ApostropheCMS is an open-source Node.js content management system. Prior to 4.32.0, the page module's move operation fails to enforce the destination parent's create permission because its oldParent archive condition disables the check for ordinary moves, allowing an authenticated editor or...
PT-2026-76773
An issue in OSSRS SRS Simple Realtime Server v5.0.213 allows a remote attacker to execute arbitrary code via RTMP publish authorization, vhost-level security configuration security.enabled, SrsSecurity::check, trunk/src/app/srs app security.cpp, and SRS RTMP listener components...
PT-2026-73330
Vulnerability in Oracle Java SE component: JavaFX. The supported version that is affected is Oracle Java SE: 8u491. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE. Successful attacks require human...
PT-2026-73311
Vulnerability in Oracle Java SE component: JavaFX. The supported version that is affected is Oracle Java SE: 8u491. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE. Successful attacks require human...
PT-2026-73363
Vulnerability in Oracle Java SE component: JavaFX. The supported version that is affected is Oracle Java SE: 8u491. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE. Successful attacks require human...
PT-2026-76872
Name of the Vulnerable Software and Affected Versions PbootCMS version 3.2.15 Description An issue allows an attacker to execute arbitrary code through the MemberController.php, UserController.php, CommentController.php, ContentController.php, and helper.php components. Recommendations At the...
PT-2026-76734
SQL Injection vulnerability in StudIP 6.0.x before 6.0.3 and 5.4.x before 5.4.12 allows a remote attacker to execute arbitrary code and obtain sensitive information via the store functions...
PT-2026-76877
Name of the Vulnerable Software and Affected Versions Mattermost versions 11.7.0 through 11.7.6 Mattermost versions 10.11.0 through 10.11.21 Mattermost versions 11.8.0 through 11.8.3 Description The Boards plugin fails to enforce the PermissionManageBoardRoles authorization on the channelId field...
PT-2026-76867
Mattermost versions 11.7.x = 11.7.6, 10.11.x = 10.11.21, 11.8.x = 11.8.3 fails to validate WebSocket command field types which allows an authenticated user to crash the plugin process and deny service to all Boards users via a custom focalboard SUBSCRIBE TEAM message with a non-string teamId...
PT-2026-76738
HP has identified a potential vulnerability in HP Web Jetadmin WJA that may allow an unauthenticated actor to read from or write to arbitrary files through a DLL hijacking mechanism...
PT-2026-73350
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: ImageIO. Supported versions that are affected are Oracle Java SE: 8u491, 8u491-perf, 11.0.31, 17.0.19, 21.0.11, 25.0.3, 26.0.1; Oracle GraalVM for JDK: 17.0.19 and...
PT-2026-73386
When PROXY protocol v2 is used on the Unix domain socket path, roles derived from X.509 client certificates may not be validated against the configured tlsCATrusts allow-list. This can result in unintended role assignments following MONGODB-X509 authentication. Affected scenarios require local...
PT-2026-76891
Impact An issue in DigestAuthProvider.verify: Algorithm silently forced to MD5. The configured algorithm parameter was ignored — every verification used MD5 regardless of configuration. Deployments believing they were running SHA-256 Digest auth were silently inheriting MD5's collision weaknesses...
PT-2026-76638
In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the cmd learn driver of the markasjunk plugin is subject to remote code execution via crafted placeholder replacement values. This issue only affects Roundcube instances using the markasjunk plugin with its cmd learn driver...
PT-2026-76646
In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, improper rule name quoting could lead to managesieve disabled actions setting bypass via a crafted rule name in a Sieve script. This issue only affects Roundcube instances using the managesieve plugin...
PT-2026-76649
In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the modoboa driver of the password plugin could leak a Modoboa API authentication token to a user-controlled host via crafted session data. This issue only affects Roundcube instances using the password plugin with its modoboa driver...
PT-2026-76671
Mattermost Plugins versions =11.8 10.20.11 11.5.7.0 The Mattermost GitLab plugin fails to verify channel permissions when processing API requests with a caller-supplied post id , and fails to validate the web url parameter against the configured GitLab instance, which allows an authenticated...
PT-2026-76819
9Router is an AI router & token saver. In 0.5.4 and earlier, the POST /api/auth/oidc/test endpoint in src/app/api/auth/oidc/test/route.js passes the user-controlled issuerUrl parameter to fetchOidcDiscovery in src/lib/auth/oidc.js without restricting private or loopback destinations, allowing...
PT-2026-73247
Discourse is an open-source discussion platform. Prior to 2026.1.7, 2026.6.2, 2026.7.1, and 2026.8.0, Discourse has HTML injection in PrettyText.format for email because cooked attribute values are reparsed as markup. Crafted Vimeo iframe sources, secure-upload URLs or dimensions, and hashtag...
PT-2026-76803
Determined fails to authorize requests on the generic task kill, pause, and unpause endpoints in the API handlers. Authenticated attackers can disrupt other users' workloads by terminating, pausing, or unpausing tasks they do not own...
PT-2026-76802
Next Terminal fails to enforce per-asset authorization checks on the portal ping and wake-on-LAN endpoints, allowing any authenticated user to probe and wake assets they are not granted access to. Attackers can call these endpoints with arbitrary asset identifiers to retrieve asset information...
PT-2026-76616
openssl encrypt versions before 1.4.0 accept refresh tokens as URL query parameters in keyserver and telemetry server routes. Attackers can extract tokens from server logs, proxy logs, browser history, and HTTP Referer headers to gain unauthorized access...
PT-2026-76598
SiYuan before 3.7.4 registers Go net/http/pprof debug endpoints including heap and goroutine dumps without authentication when --mode flag is not set to exactly prod. Attackers can access /debug/pprof/heap and related endpoints to extract in-memory secrets including AccessAuthCode and AI provider...
PT-2026-73378
An authenticated user with low privileges may be able to perform unauthorized reads and writes on data protected by role-based query-level access controls, due to insufficient validation of certain client-supplied command parameters. The issue affects find, update, delete, and aggregate commands ...
PT-2026-73204
A weakness has been identified in Adblock for Youtube Extension up to 7.2.1 on Chrome. The impacted element is the function updateDynamicRules of the file contentscript.js of the component Event Listener. This manipulation of the argument yt-anti-adblock-detected causes improper authorization. It...
PT-2026-73259
Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, the discourse templates endpoint exposed hidden tag names because DiscourseTemplates::TemplatesSerializer in plugins/discourse-templates/app/serializers/discourse templates/templates serializer.r...
PT-2026-76602
A vulnerability was determined in Wavlink WN531P3 and WN535M1 V250922. Affected by this vulnerability is the function strcpy of the file /etc/lighttpd/www/cgi-bin/export pingortrace.cgi of the component Export Pingortrace CGI. Executing a manipulation of the argument HTTP COOKIE can lead to...