PT-2026-89006

PocketMine-MP versions before 5.39.2 fail to validate entity despawn state when processing attack packets from clients. Attackers can exploit a race condition by attacking a disconnecting player to trigger multiple death handlers, causing inventory items and experience to drop multiple times for...

PT-2026-89167

Summary On SQLite deployments, the lookup that maps an external identity to a local account does a substring match instead of an exact match. A subject value containing SQL wildcard characters therefore matches accounts the value was never issued for, and the sign-in binds to whichever account th...

PT-2026-89172

Summary Any authenticated user with access to a shared terminal server could get script of their choosing to run in the Open WebUI origin itself. The in-app port preview rendered the content of a previewed port in an iframe whose sandbox always granted allow-same-origin alongside allow-scripts, a...

PT-2026-89161

Summary A user who is demoted from admin by an identity provider keeps admin-level read and write access to every user's notes, over any Socket.IO connection that was already open when the demotion happened. Open WebUI caches the user's role on the socket at connection time, and the two SSO...

PT-2026-89179

Summary Chat histories are stored as an unvalidated JSON object. The walk that reconstructs a chat's message chain detected repeats using each message's own id field while moving through the history by map key, so a message that simply omitted id was never recorded as visited. A history whose...

PT-2026-89173

Summary With the Playwright web loader enabled, Open WebUI checks the address behind a user-submitted URL before allowing the request, then handed the request to the browser to perform. The browser resolved the hostname a second time, on its own, and that answer was never checked. An attacker who...

PT-2026-88586

Clickjacking in TrustedWebActivities in Google Chrome on on Android prior to 153.0.8010.36 allowed a local attacker to spoof address bar via a co-installed app. Chromium security severity: Medium...

PT-2026-88617

Race condition in Mobile in Google Chrome on on iOS prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. Chromium security severity: High...

PT-2026-88872

The Quentn WP WordPress plugin before 1.2.15 does not properly sanitise and escape a parameter before using it in an SQL query, allowing high privilege users such as administrators to perform SQL injection attacks...

PT-2026-88923

Server side request forgery in Apache Impala versions 4.4.x and 4.5.x. Authenticated Impala users with permissions to execute the ai generate text function can exfiltrate secrets provided by the credential providers configured in the hadoop.security.credential.provider.path property of...

PT-2026-88924

Insufficient authorization of Data Source tables in Impala 2.7-4.5 allows a client with privileges to upload a file to remote storage and create a table to execute arbitrary Java code. Users are recommended to upgrade to version 4.5.2, which fixes this issue...

PT-2026-88941

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an External Control of File Name or Path vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to filesystem access...

PT-2026-89079

Cash Collect contains an improper authorization vulnerability in the Sage AR Automation API. Insufficient tenant-level authorization checks allow authenticated users to access administrative resources belonging to other tenants by specifying a valid non predictable tenant identifier...

PT-2026-88902

CVE-2026-79696: A Perfect 10.0 in Google's Agent Toolkit Google just shipped a fix for a vulnerability that scored a perfect 10.0 on the CVSS scale — the maximum severity a flaw can get. The bug lives in ADK, Google Cloud's Agent Development Kit for Python — the framework a growing number of team...

PT-2026-88796

OOB write vulnerability in the rendering and composition module. Impact: Successful exploitation of this vulnerability may affect availability...

PT-2026-89211

Unauthenticated Network-Exposed Turborepo Task Execution via /api/run Summary @yeger/turbo-graph starts its embedded Next.js server without binding to the loopback interface, causing it to listen on all network interfaces 0.0.0.0:29312 by default. The /api/run HTTP endpoint exposed by this server...

PT-2026-88646

Incorrect type conversion or cast in Safebrowsing in Google Chrome on on Mac prior to 153.0.8010.36 allowed a remote attacker to bypass system access restrictions via a crafted file. Chromium security severity: Low...

PT-2026-88919

Missing Authorization, Improper Control of Generation of Code 'Code Injection', Improper Control of Dynamically-Managed Code Resources, Use of Externally-Controlled Input to Select Classes or Code 'Unsafe Reflection' vulnerability in Apache Nutch Server Nutch REST API. This issue affects Apache...

PT-2026-88618

Observable discrepancy in Safebrowsing in Google Chrome on on iOS prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to potentially obtain sensitive information via a crafted HTML page. Chromium security severity: Medium...

PT-2026-88700

Improper input validation in Safebrowsing in Google Chrome on on Android prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. Chromium security severity: Medium...

PT-2026-88906

Several Newfold plugins are vulnerable to Authentication Bypass. The vulnerability exists because the plugins bundle the wp-module-data module. In the module, the authenticate method — registered on the rest authentication errors filter and therefore evaluated for every unauthenticated REST API...

PT-2026-88793

Permission control vulnerability in the event notification module. Impact: Successful exploitation of this vulnerability may affect service confidentiality...

PT-2026-88764

Tanium addressed a path traversal vulnerability in Tanium Data Service...

PT-2026-88833

Improper access control in SettingsProvider prior to SMR Sep-2026 Release 1 allows local attackers to access sensitive information...

PT-2026-89103

Dell PowerScale OneFS versions 9.12.0.0 through 9.13.1.0 contain an Insecure Temporary File vulnerability. A low privileged remote attacker could potentially exploit this vulnerability, leading to denial of service and information tampering...

PT-2026-87218

Insufficient granularity of access control in SQL Server allows an authorized attacker to elevate privileges over a network...

PT-2026-87509

Use of uninitialized resource in Remote Desktop Client allows an authorized attacker to execute code over a network...

PT-2026-87270

Integer overflow or wraparound in Windows NTFS allows an authorized attacker to elevate privileges locally...

PT-2026-87292

Buffer over-read in Windows NTFS allows an authorized attacker to execute code locally...

PT-2026-88074

Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally...

PT-2026-88495

Acrobat Reader is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue requires user interaction in that a victi...

PT-2026-87867

Remote Code Execution in Windows Routing and Remote Access Service RRAS allows attacker to gain an unauthorized access to victim's machine...

PT-2026-87133

snipe-it before 8.7.0 contains an incorrect calculation vulnerability in checkout request handling that allows authenticated users to corrupt the assets.requests counter through duplicate submissions and cancellations without active requests. Attackers can repeatedly call cancel endpoints without...

PT-2026-87130

Snipe-IT before 8.7.0 streams the SQL entry from an uploaded backup archive directly into the MySQL/MariaDB command-line client mysql without the --binary-mode flag, so the client interprets lines beginning with backslash commands such as ! as local shell commands. An authenticated...

PT-2026-87392

Exposure of private personal information to an unauthorized actor in Windows Universal Plug and Play UPnP Device Host allows an authorized attacker to disclose information locally...

PT-2026-87794

Heap-based buffer overflow in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally...

PT-2026-87711

Use after free in Windows DWM Core Library allows an authorized attacker to elevate privileges over a network...

PT-2026-87598

Use after free in Windows Services for NFS ONCRPC XDR Driver allows an unauthorized attacker to execute code over a network...

PT-2026-87226

🚨 SQL Server 2025 admins: patch CVE-2026-67373 now. An authenticated attacker can turn a crafted query into remote code execution—because apparently databases needed an “execute anything” feature. https://t.co/1vG0qS5kO6 MicrosoftSecurity Msrc Cve202667373 https://t.co/EYU7o7cD4n...

PT-2026-87680

Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network...

PT-2026-87311

🛠️ XPS isn’t just printer-file wallpaper: CVE-2026-68897 can elevate privileges across Windows clients and servers. Patch it, verify the build—and stop trusting “Important” to mean harmless. https://t.co/pCI6y6OSI4 MicrosoftSecurity Msrc Cve202668897 https://t.co/BfOMN4UXI5...

PT-2026-87600

Incorrect calculation of buffer size in Windows iSCSI allows an unauthorized attacker to execute code over a network...

PT-2026-88450

🔴 CISA flags hardcoded credential flaw in CareCam Pro IP cameras deployed globally ANJIA AJL33PC0801 IP camera firmware linuxlinux202008261138 svn13796, U-Boot 2010.06 compiled Aug 26 2020 contains hardcoded bootloader credentials. An attacker with physical access can exploit CVE-2026-85083 to ga...

PT-2026-87884

Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network...

PT-2026-87089

A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on the server...

PT-2026-87085

A Missing Authorization vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on the server...

PT-2026-87885

Buffer over-read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network...

PT-2026-88328

Adobe Experience Manager is affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the...

PT-2026-87654

Server-side request forgery ssrf in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network...

PT-2026-88332

Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting XSS vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in...