PT-2026-117362

Generation of Error Message Containing Sensitive Information vulnerability in Apache Camel gRPC component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. When a route behind a gRPC consumer failed, the exception's message was placed into the gRPC status...

PT-2026-117351

Improper Restriction of XML External Entity Reference vulnerability in Apache Camel XPath component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. With documentType set to InputSource, XPathBuilder handed the payload straight to javax.xml.xpath, which build...

PT-2026-117350

Improper Input Validation vulnerability in Apache Camel Tika component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The Tika producer mapped every metadata key parsed out of the submitted document onto the Exchange as a header, with no filter applied...

PT-2026-117353

Improper Handling of Case Sensitivity vulnerability in Apache Camel Platform HTTP component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The guard that prevents a request header being reflected into the response compared header names case sensitively, whi...

PT-2026-117496

IBM MQ could allow an authenticated attacker to cause a denial of service or corrupt memory due to improper validation of buffer sizes in MQOPEN operations...

PT-2026-118042

Vikunja: Write-level project members can delete admin-tier link shares through an unloaded permission check in code.vikunja.io/api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing...

PT-2026-118023

Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL in github.com/argoproj/argo-cd...

PT-2026-118009

Nil-pointer dereference in GetSlicers when a worksheet has extLst present but no drawing element in github.com/xuri/excelize...

PT-2026-118022

Pre-negotiation frame limit is not enforced to 4KB in github.com/rabbitmq/amqp091-go...

PT-2026-117562

Parse Server before 8.6.93 and 9.0.0 before 9.10.1 does not enforce identity-scoped protectedFields authenticated, role, or per-user groups on count queries using the $relatedTo operator, exposing the size of protected Relation fields. An authenticated user who can read the owning object can...

PT-2026-117272

A security flaw has been discovered in DeepPavlov up to 1.7.0. Impacted is the function resolve of the file deeppavlov/core/common/params.py of the component Config Reference Resolver. The manipulation results in code injection. The attack can be launched remotely. The exploit has been released t...

PT-2026-117316

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. Unauthenticated attackers could obtain metadata associated with hidden questions through public answer profiles. Users are recommended to upgrade to version...

PT-2026-117313

A vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. A verification code issued for one email-based workflow could be accepted by another sensitive workflow because the code purpose was not properly enforced. Users are recommended to upgrade to version 2.0.3, which...

PT-2026-117510

IBM MQ could allow an authenticated attacker to cause a denial of service by sending a specially crafted asynchronous consume request that crashes the queue manager agent process...

PT-2026-117509

IBM MQ could allow an authenticated attacker to cause a denial of service due to improper validation of RFH2 message header fields in queued publish/subscribe operations...

PT-2026-117513

IBM MQ could allow an authenticated attacker to trigger a minor out-of-bounds read when sending malformed compressed data, though the data is not disclosed and the request is rejected...

PT-2026-117505

IBM MQ could allow an authenticated attacker to cause a denial of service due to improper validation of offset values in MQOPEN requests...

PT-2026-117212

A security flaw has been discovered in diem-project diem up to 116974edfb9a5b8bd69cb13586dc62bcdbb485ad. This issue affects the function dmBaseLinkTag::text of the file dmCorePlugin/lib/view/html/link/dmBaseLinkTag.php of the component dmWidget. Performing a manipulation of the argument text...

PT-2026-117309

MISP contains a vulnerability in the handling of module plugin settings. When the server rebuilds module-supplied settings for API consumption, it drops the redacted and cli only flags that a module declares in its own configuration metadata. As a result: - A module that marks a setting such as a...

PT-2026-117469

Name of the Vulnerable Software and Affected Versions @rvf/set-get versions prior to 7.0.4 Description Prototype pollution occurs in the setPath function, allowing unauthenticated attackers to overwrite properties of shared built-in functions through inherited Object.prototype methods. By...

PT-2026-117462

🚨 CVE-2026-112157 A weakness has been identified in MemTensor memmy-agent up to 1.0.9/1.1.1/1.2.2. The impacted element is the function requireAdminWrite of the file Memory/src/server/http.ts of the component Memory Service. This manipulation causes resource consumption. Remote exploitation of th...

PT-2026-117241

Name of the Vulnerable Software and Affected Versions BDM Digital Payment Gateway WordPress plugin versions prior to 1.3.13 Description The plugin fails to verify credentials on its public payment-status update route and treats unset credentials as valid. This allows unauthenticated attackers to...

PT-2026-117228

Name of the Vulnerable Software and Affected Versions Gateway for Vantiv on WC WordPress plugin versions prior to 1.0.2 Description The plugin fails to verify the authenticity of payment notifications received by its hosted-payment return handler. This allows unauthenticated attackers to manipula...

PT-2026-117234

Name of the Vulnerable Software and Affected Versions bootc affected versions not specified Description An issue exists when using the default containers signature policy. During automatic or manual upgrades of a mutable image tag, unsigned content may be applied for registries that fall through ...

PT-2026-117405

Missing Authorization vulnerability in Surfer Surfer surferseo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Surfer: from n/a through 1.8.0.744...

PT-2026-117384

A flaw was found in the GStreamer ASF demuxer in gst-plugins-ugly. When parsing a Simple Index object, an attacker-controlled entry count is used to size a heap allocation without being limited to the payload available in the object. Processing a crafted ASF, WMV, or WMA file can cause a very lar...

PT-2026-117254

The TrueBooker WordPress plugin before 1.3.0 does not have authorisation checks in some of its AJAX actions, and does not validate the submitted service price server-side, allowing unauthenticated users to create bookings at a price of their choosing and to attach them to arbitrary customer...

PT-2026-117287

Path-confinement bypass during metadata backup deletion in Apache Kylin. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted. This issue affects Apache Kylin: from 4.0.0 through 5.0.4. Users are...

PT-2026-117290

Missing authentication for in-house broadcast and polymorphic deserialization vulnerability in Apache Kylin. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted. This issue affects Apache Kylin: fro...

PT-2026-117289

Missing authorization on jdbc source config update in Apache Kylin. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted. This issue affects Apache Kylin: from 4.0.0 through 5.0.4. Users are...

PT-2026-117291

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Apache Kylin. The impact is moderate if kylin service is in query only mode, which is the default and most common mode. This issue affects Apache Kylin: from 4.0.0 through 5.0.4. Users are...

PT-2026-117288

Server-Side request forgery SSRF vulnerability in Apache Kylin. Impact most to the kylin job service that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted. This issue affects Apache Kylin: from 4.0.0 through 5.0.4. Users are recommend...

PT-2026-117382

A vulnerability was determined in satya-vinay Events-Management-System up to 437c77ceb69bf9fe2e3f4f46f7871b83f425383a. Affected is the function mysqli query of the file doedit.php of the component Registration-Edit Handler. This manipulation of the argument...

PT-2026-117524

IBM Concert 1.0 through 3.0.0 is vulnerable to Information Disclosure via Heap Inspection...

PT-2026-117523

IBM Concert 1.0 through 3.0.0 is vulnerable to Improper Certificate Validation...

PT-2026-117672

Name of the Vulnerable Software and Affected Versions Pillow versions 5.1.0 through 12.1.0 Description A flaw exists where the library can enter an infinite loop during the rewriting of PDF pages. This occurs because the PdfParser.rewrite pages function follows parent relationships without...

PT-2026-117518

Name of the Vulnerable Software and Affected Versions AIOHTTP versions prior to 3.14.4 Description An attacker can send an absolute-form request that causes Request.scheme to use attacker-controlled request-target scheme data instead of the connection protocol. Applications relying on...

PT-2026-117697

A security vulnerability has been detected in H3C Magic NX15 NX15V100R017. This impacts the function sub 416874 of the file /usr/bin/usrlist. Such manipulation leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be...

PT-2026-117393

Locust through 2.46.7 contains a cross-site request forgery vulnerability that allows remote attackers to stop load tests or reset statistics via GET requests to /stop and /stats/reset. Attackers can lure an operator to a malicious page triggering cross-site GET requests, terminating running swar...

PT-2026-117367

A flaw has been found in ztxz16 fastllm up to 1.8.2. Affected by this issue is the function SafeTensorItem::CreateBuffer of the file src/model.cpp of the component Safetensors Weight Loading. This manipulation of the argument data offsets causes buffer overflow. The attack can be initiated...

PT-2026-117368

A vulnerability was determined in ztxz16 fastllm up to 0.1.8.2. This impacts the function GGUFBuffer::ReadString of the file third party/gguf/gguf.cpp of the component String Parsing. This manipulation of the argument len causes buffer overflow. The attack can be initiated remotely. The exploit h...

PT-2026-117373

A vulnerability was found in llSourcell Doctor-Dignity up to 3f2ffb6c892f13b50a708d05900d3227acb40ded. This impacts the function get lib module of the file python/mlc chat/chat module.py. The manipulation of the argument model lib results in code injection. The attack may be launched remotely. Th...

PT-2026-117325

A vulnerability has been found in f3-factory fatfree-core up to 3.9.2. This vulnerability affects the function curl of the file web.php of the component HTTP Client. Such manipulation leads to improper certificate validation. The attack may be performed from remote. Attacks of this nature are...

PT-2026-117305

A vulnerability was detected in AXA Group NLP.js 4.27.0. This impacts the function Evaluator.walkFunction of the file packages/evaluator/src/evaluator.js of the component Condition Expression Pipeline. The manipulation of the argument condition results in code injection. It is possible to launch...

PT-2026-117521

A flaw has been found in FusionPBX up to 5.4.4/5.5.7/5.6.5. The affected element is an unknown function of the file app/dialplans/resources/classes/dialplan.php of the component Dialplan Editor. Executing a manipulation can lead to os command injection. The attack can be executed remotely. The...

PT-2026-117503

A vulnerability was detected in Webkul Aureus ERP up to 1.6.0. Impacted is an unknown function of the file plugins/webkul/security/src/Filament/Resources/UserResource/Schemas/UserForm.php. Performing a manipulation of the argument Password results in weak password requirements. Remote exploitatio...

PT-2026-117442

A vulnerability was identified in vraj404 Criminal-Management-System up to 2808d057e7ddc5295519a487365b0cacfd0ba8c4. This impacts the function move uploaded file of the file home.php. The manipulation of the argument my img leads to unrestricted upload. Remote exploitation of the attack is...

PT-2026-117304

A vulnerability was determined in BlackBeltTechnology pi-agent-dashboard up to 0.8.0. The affected element is an unknown function of the file /BlackBeltTechnology/pi-agent-dashboard of the component WebSocket Gateway. Executing a manipulation of the argument cwd can lead to origin validation erro...

PT-2026-117543

TickTick Android application com.ticktick.task 8.2.2.0 contains a path traversal vulnerability in its exported ShareReceiveActivity that allows a malicious local application to write files outside the intended attachment directory by supplying a crafted content:// URI with a traversal filename vi...

PT-2026-117525

IBM Concert 1.0 through 3.0.0 could allow an unauthorized user to inject data into log messages due to improper neutralization of special elements when written to log files...