414734 matches found
PT-2026-118006
Excelize Decrypt: unrecoverable panics on malformed OLE/CFB encrypted workbooks in github.com/xuri/excelize...
PT-2026-117381
Missing Authorization vulnerability in YITH YITH WooCommerce Product Bundles yith-woocommerce-product-bundles allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects YITH WooCommerce Product Bundles: from n/a through 2.29.0...
PT-2026-118011
Panic and memory exhaustion via unbounded CFB stream allocation in github.com/xuri/excelize...
PT-2026-117413
SGLang through 0.5.22 with the Mooncake disaggregation backend accepts unauthenticated decode registration messages on the Prefill rank ZMQ PULL socket, allowing denial of service. Network-adjacent attackers can send many registrations with unique mooncake session id values and large nested-buffe...
PT-2026-118066
GitHub CLI allows attestation verification bypass through unescaped regex metacharacters in github.com/cli/cli...
PT-2026-117502
A security vulnerability has been detected in Webkul Aureus ERP up to 1.6.0. This issue affects some unknown processing of the file composer.json. Such manipulation leads to insertion of sensitive information into debugging code. The attack may be launched remotely. The exploit has been disclosed...
PT-2026-118053
Vikunja: Plaintext storage of password-reset/email-confirm tokens in database enables account takeover on DB read access in code.vikunja.io/api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is...
PT-2026-117274
MISP contains a data integrity flaw in its event deletion logic. When a user deletes an event, several associated records are not removed from the database, leaving them as orphaned entries. The affected record types include event report tags, event graph entries, proposal shadow attribute...
PT-2026-118065
GitHub CLI partially discloses authentication tokens in gh auth status output in github.com/cli/cli...
PT-2026-118060
Vikunja: Denial of service via decompression bomb in the data import in code.vikunja.io/api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability...
PT-2026-117998
Summary The keepalive timeout was not used during the initial portion of a request. Impact An attacker could keep an idle connection open indefinitely before sending any data. Workaround Use a reverse proxy as recommended for all production deployments with sensible keepalive limits...
PT-2026-117243
A weakness has been identified in itsourcecode Online Cake Ordering System 1.0. This issue affects some unknown processing of the file confirm.php. This manipulation of the argument cancel causes sql injection. The attack may be initiated remotely. The exploit has been made available to the publi...
PT-2026-117372
A flaw was found in the rhc-canonical-facts.service systemd unit shipped with rhc. The service runs as root and operates on a file inside a directory owned by an unprivileged system user without verifying that the file is not a symbolic link. A local attacker who has already compromised the...
PT-2026-117216
A vulnerability was identified in Tencent ncnn up to 44b02dabdcf97499281a4692ebd65bad73dcf8b6. Affected by this vulnerability is the function matmul transb of the file src/layer/matmul.cpp of the component MatMul. The manipulation leads to out-of-bounds read. The attack can be initiated remotely...
PT-2026-118090
CoreDNS k8s external headless AXFR can emit an empty transfer batch that panics the transfer plugin in github.com/coredns/coredns...
PT-2026-117458
CLI Bridge provides filesystem access within a workspace root. Prior to 0.0.2, a dangling symlink pointing outside the workspace root bypasses resolveSafePath when fs.realpathSync throws ENOENT for a nonexistent target. The fallback resolves only the parent directory and returns the symlink path ...
PT-2026-118044
Vikunja: CalDAV relation creation bypasses TaskRelation.CanCreate, allowing an unauthorized write into any task by known UID in code.vikunja.io/api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If thi...
PT-2026-117415
libdisplay-info through 0.4.0 contains a heap out-of-bounds read vulnerability in the DisplayID v1 section parser in displayid.c that occurs when a data block's declared length exceeds the section. Attackers can supply a crafted EDID from a malicious monitor, KVM, capture device, or EDID file to...
PT-2026-117437
BoxyHQ Enterprise SaaS Starter Kit through 1.6.0 contains a missing authorization vulnerability that allows non-owner team members to manage billing because payment routes skip the team payments permission check. Authenticated MEMBER or ADMIN users can call create-portal-link,...
PT-2026-117460
FOSSBilling is an open source billing and client-management platform. From 0.1.0 until 0.8.7, the unauthenticated api/guest/system/template exists endpoint permits path traversal because templateExists uses Path::join on the attacker-controlled file parameter without rejecting .. sequences or...
PT-2026-117444
The Sensei LMS WordPress plugin before 4.26.4 contains a broken access control vulnerability in the add new module term AJAX handler that allows authenticated Teacher-role attackers to assign module taxonomy terms to arbitrary courses by supplying a crafted course id, since the handler validates...
PT-2026-117451
A security vulnerability has been detected in vraj404 Criminal-Management-System up to 2808d057e7ddc5295519a487365b0cacfd0ba8c4. Affected by this issue is the function mysqli query of the file Officers/searchOff.php of the component Search Page. Such manipulation of the argument Search leads to s...
PT-2026-117454
Name of the Vulnerable Software and Affected Versions Progressive Robot hMailServer versions 6.0.0 through 6.3.6 Description An issue exists in the DKIM signing process where the server uses a less trusted source, allowing a remote unauthenticated attacker to have emails signed with the DKIM key ...
PT-2026-117504
IBM MQ could allow a remote attacker with queue manager control or man-in-the-middle access on unencrypted channels to cause a denial of service in client applications using asynchronous message consumption due to improper validation of queue name length values...
PT-2026-117429
Thelia before 3.1.5 and 3.2.x before 3.2.4 contains a business logic vulnerability that allows authenticated customers to bypass coupon usage limits because usage is counted only when orders become paid. Attackers can place multiple pay-later orders while a usage remains, or cancel paid orders to...
PT-2026-117702
IBM ContextForge MCP Gateway 0.1.0 through 1.0.5 is vulnerable to a server-side request Forgery SSRF that allows authenticated users with gateway creation privileges to perform arbitrary HTTP POST requests to internal network resources and cloud metadata endpoints. The vulnerability occurs during...
PT-2026-117484
A security vulnerability has been detected in JumpServer up to 4.10.19. The affected element is an unknown function of the component Template Rendering. The manipulation of the argument IP/HOST leads to os command injection. Remote exploitation of the attack is possible. The exploit has been...
PT-2026-117631
Grav from 2.0.15 before 2.2.2 contains an allowlist bypass vulnerability that allows page editors to call arbitrary public static methods by renaming Flex form fields with replace-name@. Attackers with page-edit permission can smuggle data-@ directives past the callable check to invoke...
PT-2026-117701
IBM Verify Identity Access 11.0.3.1 and IBM Security Verify Access 10.0.9.3 Appliance could allow a physically proximate attacker to gain elevated privileges due to the use of hard-coded credentials...
PT-2026-117208
A vulnerability was identified in diem-project diem up to 116974edfb9a5b8bd69cb13586dc62bcdbb485ad. This vulnerability affects the function dmString::random of the file dmCorePlugin/lib/basic/dmString.php. Such manipulation leads to cryptographically weak prng. The attack may be performed from...
PT-2026-117273
In MISP, the event synchronization process contained a logic error in the preparation of event reports for remote push. The filtering of non-exportable tags was applied only once after the iteration over all reports, rather than to each individual report. As a result: - All reports except the las...
PT-2026-117355
Insertion of Sensitive Information into Log File vulnerability in Apache Camel MLLP component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The camel-mllp component carries a logPhi option that governs whether HL7 payload content may be written to the log...
PT-2026-117652
Name of the Vulnerable Software and Affected Versions TiBillet Lespass versions up to 10e87909c5d526dffa6d424c104fc12860740537 Description A weakness in the APIv1 component allows for server-side request forgery, a condition where an attacker can induce the server to make requests to an unintende...
PT-2026-117482
Mercury is a Python framework for sharing Jupyter notebooks as web applications and dashboards. From 3.0.0 until 3.2.11, mr.Markdown converts attacker-controlled Markdown to HTML without sanitizing raw HTML before assigning it to an ipywidgets.HTML sink. Event-handler attributes and other active...
PT-2026-117300
Unrestricted Upload of File with Dangerous Type vulnerability in PT Norther Lights Production MapSVG mapsvg-lite-interactive-vector-maps allows Upload a Web Shell to a Web Server.This issue affects MapSVG: from n/a through 8.16.1...
PT-2026-117169
A weakness has been identified in aircheng-org iWebShop-5 up to 5.16. The impacted element is the function IController::redirect of the file plugins/ userInfo/ userInfo.php of the component Login Redirect. This manipulation of the argument callback causes open redirect. The attack can be initiate...
PT-2026-117427
VideoLAN libbluray through 1.5.1 contains an uncontrolled memory allocation vulnerability in parse extent start points in clpi parse.c that trusts the num point field without bounds checking. Attackers can supply a crafted .clpi file on a disc, image, or directory with a huge num point to exhaust...
PT-2026-117539
Name of the Vulnerable Software and Affected Versions Hono versions 4.12.4 through 4.13.10 Description The serveStatic component in the Hono web application framework incorrectly decodes a routed request path a second time before performing a filesystem lookup. This behavior allows a malformed...
PT-2026-117250
The iPOSpays Payment Gateway for WooCommerce WordPress plugin before 1.4.7 does not verify that a payment was actually completed before recording an order as paid, allowing unauthenticated users to mark any unpaid order as paid and to rewrite its total...
PT-2026-117264
VOCALOID6 Editor provided by Yamaha Corporation improperly restricts XML external entity references. Loading a specially crafted project file may the product to initiate unintended communication, potentially leading to the leak of sensitive information from the device where the product is install...
PT-2026-118073
Nginx UI OTP secure-session step-up is missing on sensitive mutation routes in github.com/0xJacky/Nginx-UI...
PT-2026-117335
A security vulnerability has been detected in TufayelLUS TikTok-Video-Downloader-PHP up to c4230497bb23dd9c1f81456fe8a982d951feac0d. Affected by this issue is some unknown functionality of the file index.php of the component TLS Handler. Such manipulation leads to improper certificate validation...
PT-2026-117584
Name of the Vulnerable Software and Affected Versions Cpanel::JSON::XS versions 4.51 through 4.79 Description An issue exists where the software allows quadratic CPU usage during the processing of non-ASCII JSON data. This occurs because the incr parse function decodes each buffered value using a...
PT-2026-118064
GitHub CLI allows path traversal through unescaped request URL components in github.com/cli/cli...
PT-2026-117509
IBM MQ could allow an authenticated attacker to cause a denial of service due to improper validation of RFH2 message header fields in queued publish/subscribe operations...
PT-2026-117507
Name of the Vulnerable Software and Affected Versions IBM MQ Operator affected versions not specified Description An authenticated attacker can cause a denial of service or potentially execute arbitrary code. This is possible due to unrestricted Java deserialization within the MQ Classes for Java...
PT-2026-117442
A vulnerability was identified in vraj404 Criminal-Management-System up to 2808d057e7ddc5295519a487365b0cacfd0ba8c4. This impacts the function move uploaded file of the file home.php. The manipulation of the argument my img leads to unrestricted upload. Remote exploitation of the attack is...
PT-2026-118026
Nginx UI: Authentication bypass: password login does not enforce a passkey-only second factor 2FA bypass in github.com/0xJacky/Nginx-UI...