PT-2026-117485

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description The software fails to sufficiently validate user-supplied data, enabling the injection of malicious Expression Language EL code. This flaw allows for the executi...

PT-2026-117399

Frappe CRM before 1.81.2 contains a missing authorization vulnerability that allows authenticated Sales Users to access other users' CRM Notification records due to absent permission hooks. Attackers can query frappe.client endpoints filtering on to user or call mark as read with another user...

PT-2026-118002

Details In russh/src/server/encrypted.rs, server read auth request pk 0.63.3, around lines 880-990: The requested algorithm name pubkey algo is read and only used to decode the key: PublicKeyOrCertificate::decode&pubkey algo, &pubkey key. The derived hash alg is then dropped...

PT-2026-117570

Name of the Vulnerable Software and Affected Versions Cpanel::JSON::XS versions prior to 4.80 Description A memory leak occurs in the decode hv function when an object is rejected due to a duplicate key or a missing colon. Specifically, if a quoted key is 24 bytes or longer, contains a non-ASCII...

PT-2026-118031

Vikunja: Any user can enumerate every team and its members by attaching arbitrary teams to a throwaway project in code.vikunja.io/api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing...

PT-2026-117374

Name of the Vulnerable Software and Affected Versions Red Hat Advanced Cluster Security for Kubernetes affected versions not specified Description An issue exists in the Central SAML authentication ACS endpoint where used SAML assertion or response identifiers are not retained to prevent replay...

PT-2026-118009

Nil-pointer dereference in GetSlicers when a worksheet has extLst present but no drawing element in github.com/xuri/excelize...

PT-2026-118022

Pre-negotiation frame limit is not enforced to 4KB in github.com/rabbitmq/amqp091-go...

PT-2026-118023

Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL in github.com/argoproj/argo-cd...

PT-2026-118039

Vikunja: Assignee email addresses disclosed to read-only project members via the task assignees endpoint in code.vikunja.io/api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing...

PT-2026-118030

Vikunja: Link-share principal-type confusion enables cross-account team removal, bot takeover, and roster disclosure in code.vikunja.io/api...

PT-2026-117207

A vulnerability was determined in diem-project diem up to 116974edfb9a5b8bd69cb13586dc62bcdbb485ad. This affects an unknown part of the file dmCorePlugin/plugins/dmUserPlugin/modules/dmUser/lib/BasedmUserActions.class.php of the component Sign-In. This manipulation of the argument Referer causes...

PT-2026-117997

Summary russh keys::agent::server::add key russh/src/keys/agent/server.rs:271-319 spawns a dedicated tokio task for every 5-byte SSH AGENT CONSTRAIN LIFETIME record attached to an added key, each cloning the key blob and sleeping for the declared lifetime up to 136 years. The loop has no...

PT-2026-117390

Uncontrolled recursion in the SVG parser and renderer of the Qt SVG module QtSvg in Qt Group Qt allows attackers to cause a denial of service application crash via stack exhaustion via a crafted SVG file with deeply nested elements...

PT-2026-117220

A security vulnerability has been detected in alexta69 MeTube up to 2026.09.28. This vulnerability affects the function DownloadQueue. write feed metadata sync of the file app/ytdl.py of the component Feed-metadata Thumbnail Fetch Handler. Such manipulation leads to server-side request forgery. T...

PT-2026-118017

Panic via unchecked pivot-cache field index in github.com/xuri/excelize/v2...

PT-2026-118037

Vikunja: Every /api/v2 pre-auth endpoint is unthrottled on a stock install while its /api/v1 twin is rate limited in code.vikunja.io/api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causin...

PT-2026-117494

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description A flaw allows a user to access sensitive database details, including usernames and passwords, by sending a DWR request with a specific workflow rule. This issue...

PT-2026-117202

A vulnerability has been found in diem-project diem up to 116974edfb9a5b8bd69cb13586dc62bcdbb485ad. Affected by this vulnerability is the function html of the file dmAdminPlugin/web/js/dmAdminCtrl.js of the component Version Check Service. The manipulation leads to cross site scripting. Remote...

PT-2026-118014

Coraza body processor has a JSON key collision that allows unauthenticated attackers to bypass OWASP CRS inspection in github.com/corazawaf/coraza...

PT-2026-117389

A security flaw has been discovered in satya-vinay Events-Management-System up to 437c77ceb69bf9fe2e3f4f46f7871b83f425383a. Affected by this issue is some unknown functionality. Performing a manipulation results in missing authentication. The attack is possible to be carried out remotely. The...

PT-2026-117624

Craft CMS from 5.0.0 before 5.11.0 contains a remote code execution vulnerability that allows authenticated Control Panel users to escape the Twig sandbox by passing uncleansed criteria to getNext, getPrev, or getOwners. Attackers can inject Yii "as" or "on" config keys to attach malicious event...

PT-2026-117541

A security vulnerability has been detected in grandnode grandnode2 up to 2.3.0. This impacts the function ProductImportDataObject.PrepareProductPictures of the component Excel Import. The manipulation of the argument Picture1/Picture2/Picture3 leads to path traversal. The attack can be initiated...

PT-2026-117587

Name of the Vulnerable Software and Affected Versions Microsoft Edge affected versions not specified Description A severe issue has been disclosed affecting Microsoft Edge, with reports of elevated activities targeting this flaw. Recommendations At the moment, there is no information about a newe...

PT-2026-117315

Missing Authorization vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. An authorization flaw in the MCP answer retrieval tool allows holders of a global API key to access answer content associated with hidden, deleted, or pending-review questions. Users are...

PT-2026-117432

Krayin CRM 2.2.5 before 2.2.7 contains a server-side request forgery filter bypass that allows users with webhook permissions to reach internal addresses via DNS rebinding. Attackers can return a public address during WebhookService::isSafeEndpoint validation and an internal address when Guzzle...

PT-2026-117583

Name of the Vulnerable Software and Affected Versions Cpanel::JSON::XS versions 4.43 through 4.79 Description An issue exists during canonical encoding in the utf16 cmp function where byte-string keys are misordered. Canonical encoding sorts keys by UTF-16 code units; however, if any key in a has...

PT-2026-117410

SGLang through 0.5.22 contains a denial of service vulnerability that allows API clients to abort other users' in-flight generation requests by supplying a short client-controlled rid. Attackers can submit streaming /generate requests with single hex character rids and disconnect, triggering...

PT-2026-117408

BentoML through 1.4.39 contains a Dockerfile instruction injection vulnerability that allows attackers to add arbitrary build instructions by embedding newlines in docker.env mapping keys rendered by the legacy base.j2 template. Attackers can supply a crafted bentofile.yaml or imported bento...

PT-2026-117438

FlyCms through commit edfdf724 contains a missing authorization vulnerability in ActionService.counter that allows authenticated users to modify other users' content rows because checkRowOwner never verifies ownership. Any registered user can send requests to /ucenter/action/modelCode/id/counter ...

PT-2026-117403

A security vulnerability has been detected in speaches-ai speaches up to 0.9.0-rc.3. This vulnerability affects the function PyannoteDiarizationModelManager. load fn of the file src/speaches/executors/pyannote diarization.py of the component Pyannote Diarization Model Loading. The manipulation of...

PT-2026-117391

Improper Validation of Specified Quantity in Input vulnerability in Mamunur Rashid Classified Listing classified-listing allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Classified Listing: from n/a through 6.1.5...

PT-2026-117376

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in E2Pdf.com e2pdf e2pdf allows Stored XSS.This issue affects e2pdf: from n/a through 1.32.57...

PT-2026-117341

Permissive Cross-domain Policy with Untrusted Domains vulnerability in Apache Camel Platform HTTP Vertx component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. createCorsHandler set Access-Control-Allow-Credentials: true outside the origin check, so the...

PT-2026-117248

Name of the Vulnerable Software and Affected Versions Document Gallery WordPress plugin versions prior to 5.1.2 Description The plugin fails to verify the signature on an unauthenticated webhook endpoint when no shared secret is configured, which is the default setting. This allows unauthenticate...

PT-2026-117330

Deserialization of Untrusted Data vulnerability in Apache Camel Spring Redis component. This issue affects Apache Camel: from 2.11.0 before 4.18.5, from 4.19.0 before 4.22.1. RedisConfiguration.getSerializer lazily built a bare JdkSerializationRedisSerializer whenever no serializer option was...

PT-2026-117237

Name of the Vulnerable Software and Affected Versions ElementsReady Addons for Elementor WordPress versions prior to 6.7.3 Description Insufficient authorization checks in several settings-save handlers allow users with subscriber-level access and above to overwrite stored settings. This includes...

PT-2026-117561

Parse Server 8.2.2 before 8.6.94 and 9.0.0 before 9.10.1 applies its GraphQL introspection control only to operation text sent directly with a request, not to operations resolved from Apollo Server's automatic persisted query cache. Unauthenticated attackers holding the public Application Id and...

PT-2026-117240

Name of the Vulnerable Software and Affected Versions Coinbase Commerce Payment Gateway for WooCommerce WordPress plugin versions prior to 1.4.2 Description The plugin fails to verify the authenticity of incoming payment webhook notifications. This occurs because the shared secret used to validat...

PT-2026-117359

Improper Input Validation vulnerability in Apache Camel Core component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The saga processor consulted a header named Long-Running-Action to decide which saga an exchange belonged to. The name carries no Camel...

PT-2026-117552

Improper verification of cryptographic signature in .NET allows an unauthorized attacker to bypass a security feature over a network...

PT-2026-118072

Nginx UI: MCP configuration tools bypass restricted directive validation and allow secondary authenticated users to execute NJS in Nginx worker context in github.com/0xJacky/Nginx-UI...

PT-2026-117238

Name of the Vulnerable Software and Affected Versions ElementsReady Addons for Elementor WordPress versions prior to 6.7.3 Description The plugin fails to properly restrict access to protected WooCommerce product downloads. This allows unauthenticated users to bypass payment requirements and...

PT-2026-117249

Name of the Vulnerable Software and Affected Versions HPE Compute Scale-up Server 3200 affected versions not specified HPE Compute Scale-up Server 3250 affected versions not specified HPE Superdome Flex affected versions not specified HPE Superdome Flex 280 affected versions not specified...

PT-2026-118079

Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks in github.com/argoproj/argo-cd...

PT-2026-117308

MISP contains a vulnerability in its server settings lookup mechanism that allows an authenticated user to retrieve sensitive configuration data that should have been redacted. The settings lookup function resolves a dotted setting name to a node in the configuration tree. When a branch name such...

PT-2026-122238

Name of the Vulnerable Software and Affected Versions Wasmtime versions prior to 36.0.19 Wasmtime versions prior to 48.0.7 Wasmtime versions prior to 49.0.4 Description The Cranelift compiler backend on aarch64 architectures can incorrectly compile a Wasm br table instruction when it contains mor...

PT-2026-117479

Name of the Vulnerable Software and Affected Versions FOSSBilling versions 0.1.0 through 0.8.6 Description The unauthenticated endpoint "/api/guest/client/create" reveals whether a submitted email belongs to a registered client. This occurs because the guest signup process returns a distinct,...

PT-2026-117456

Name of the Vulnerable Software and Affected Versions Progressive Robot hMailServer versions 6.0.0 through 6.3.6 Description Unchecked input for a loop condition allows a remote unauthenticated attacker to cause a denial of service by stopping the mail server. The server uses the...

PT-2026-117455

Name of the Vulnerable Software and Affected Versions hMailServer versions 6.2.22 through 6.3.6 hMailServer versions 6.0.0 through 6.3.6 Description Missing authorization in the Sieve notify action and the mail-rule Reply action allows an authenticated user to send emails through the server using...