PT-2026-75925

Summary token-optimizer-mcp is vulnerable to OS command injection in the smart user tool. The get-user-info operation accepts a user-controlled username argument and later interpolates it into a shell command executed through execAsync: ts getent passwd "$username" || grep "^$username:" /etc/pass...

PT-2026-75931

Summary Budibase automation steps outgoing webhook, Zapier, n8n, Slack, Discord, Make.com make server-side HTTP requests to user-provided URLs using node-fetch directly, completely bypassing the IP blacklist protection that exists in the REST API integration. Additionally, the REST API blacklist...

PT-2026-72087

A critical OS command injection vulnerability has been identified in the Haiwell IoT Cloud HMI Gateway product. The vulnerability exists in the Net Check feature accessible via the /setting endpoint. The cmdPing Socket.io event fails to properly sanitize user-supplied input before passing it to t...

PT-2026-76014

When fabric-ca is configured with an LDAP backend, the username from HTTP Basic authentication is included in an LDAP uid search filter without proper escaping. An unauthenticated attacker with network access to the CA enrollment endpoint could exploit this to perform LDAP injection before passwo...

PT-2026-71966

The Paymob for WooCommerce WordPress plugin before 4.1.9 does not properly sanitise a client-supplied identifier before using it in a SQL query within its public, unauthenticated payment callback, and performs this query before verifying the payment provider's HMAC signature. This allows...

PT-2026-72130

Name of the Vulnerable Software and Affected Versions Red Hat Quay affected versions not specified Description A flaw exists in the Stripe billing webhook handler. An unauthenticated attacker can forge billing events by sending crafted JSON requests to the /webhooks/stripe endpoint. The system...

PT-2026-72126

Name of the Vulnerable Software and Affected Versions Red Hat Quay affected versions not specified Description Red Hat Quay contains flaws in the validation of JSON Web Tokens JWT used for single sign-on SSO authentication and federated robot accounts. The issues involve improper audience...

PT-2026-72112

PAX Technology Q80 AIP File Parsing Link Following Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of PAX Technology Q80. Authentication is not required to exploit this vulnerability. The specific flaw...

PT-2026-72073

Emlog is an open source website building system. In 2.6.26 and earlier, missing CSRF protection on the AI Assistant execute tool action in admin/ai.php lets a remote unauthenticated attacker submit a forged cross-site request from an attacker-controlled page to a recently logged-in administrator...

PT-2026-72094

IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to bypass security restrictions due to the ability to disable server-side input validation via a request parameter...

PT-2026-71981

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.7.4 Description A SQL injection issue exists in the backlink/mention search query within kernel/model/backlink.go. The application concatenates stored block metadata title, name, alias, anchor text and a...

PT-2026-71994

The getgrav/grav-plugin-api plugin before 1.0.13 contains an API-key scope cap bypass in the POST /reports/twig-content/allowlist endpoint ReportsController. The endpoint enforces requirePermission'api.config.write' followed by a bare isSuperAdmin check instead of requireSuper. Because isSuperAdm...

PT-2026-72075

The LoRaWAN Fragmented Data Block Transport service subsys/lorawan/services/frag transport.c does not validate the fragment counter in a received DATA FRAGMENT command before forwarding it to the configured decoder. In frag transport package callback the value frag counter = hdr-frag index n &...

PT-2026-71984

The actix-files crate actix files before version 0.6.10 contains an information exposure vulnerability. When a non-existing folder is passed as the serve from argument to Files::new, the mount path defaults to an empty path; the service then joins the request path with this empty path and...

PT-2026-76437

These are all security issues fixed in the chromedriver-151.0.7922.137-1.1 package on the GA media of openSUSE Tumbleweed...

PT-2026-71967

The Epeken All Kurir for Woocommerce WordPress plugin through 2.1.2 does not verify that a payment-confirmation request originates from the owner of the targeted order, nor that any payment actually occurred, allowing unauthenticated attackers to mark arbitrary orders as confirmed and, in a...

PT-2026-72006

File Browser versions before 2.63.20 fail to honor the createUserDir isolation in proxy and hook authentication auto-provisioning paths. Attackers with valid upstream-authenticated credentials can read, modify, delete, and share files belonging to other users by exploiting the server root scope...

PT-2026-76566

When fabric-ca is configured with an LDAP backend, the username from HTTP Basic authentication is included in an LDAP uid search filter without proper escaping. An unauthenticated attacker with network access to the CA enrollment endpoint could exploit this to perform LDAP injection before passwo...

PT-2026-72072

Capstone is a disassembly framework. Prior to version 6.0.0-Alpha9, Capstone's public cs insn name API forwards caller-supplied instruction IDs directly to the selected architecture backend. Most backends validate the ID before indexing instruction-name tables, but the M68K and RISCV backends hav...

PT-2026-72047

Dell Wyse Management Suite WMS, versions prior to 2605.0.2, contain a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure...

PT-2026-72027

Uncontrolled resource consumption vulnerability in the JSON plugin of Apache Struts. When an application is configured to populate actions from a JSON request body, the plugin reads that body into memory without bounding how much it will accept, so a single request can exhaust the heap and deny...

PT-2026-71974

WordPress is vulnerable to a remote code execution vulnerability via malicious Postscript file upload by an Author level user or higher. Prerequisites: Imagick and Ghostscript in use on the server A malicious user with the upload files capability This issue affects all versions of WordPress...

PT-2026-72059

A local privilege escalation vulnerability exists in Security Center. An attacker with write access to a specific configuration file could achieve arbitrary code execution with elevated privileges, without requiring further user or victim interaction...

PT-2026-72079

An authenticated command injection vulnerability exists in Security Center related to file upload processing. An attacker could exploit this issue by uploading a specially crafted file, potentially resulting in arbitrary command execution on the underlying operating system...

PT-2026-72013

A security flaw has been discovered in Tenda W20E 15.11.0.61068 1546 841 CN TDC. Impacted is the function formQOSRuleDel of the file /goform/delQos of the component QoS Rule Deletion. Performing a manipulation of the argument qosIndex results in stack-based buffer overflow. Remote exploitation of...

PT-2026-72096

IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to obtain sensitive information due to improper validation of file paths...

PT-2026-72091

IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to bypass security restrictions due to improper authorization using user-supplied input...

PT-2026-71973

A security vulnerability has been detected in TOTOLINK A800R 4.1.2cu.5137 B20200730. This impacts the function setMacFilterRules of the file /cgi-bin/cstecgi.cgi of the component firewall.so. Such manipulation of the argument Comment leads to stack-based buffer overflow. The attack may be perform...

PT-2026-73183

CVE-2026-73107 - Rejected reason: This CVE ID has been rejected or CVE ID :CVE-2026-73107 Published : Aug. 14, 2026, 5:20 p.m. | 24 minutes ago Description :Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. Severity: 0.0 | NA Visit the link for more...

PT-2026-72011

actix-http versions before 3.12.1 contain an HTTP request smuggling vulnerability in the HTTP/1.1 parser that accepts requests with both Content-Length and Transfer-Encoding: chunked headers. Unauthenticated remote attackers can exploit this through a front-end intermediary to desynchronize backe...

PT-2026-72023

A security flaw has been discovered in 648540858 wvp-GB28181-pro 2.7.4-20260107. This vulnerability affects unknown code of the file LogController.java of the component Log File Download Endpoint. The manipulation of the argument fileName results in path traversal. The attack may be launched...

PT-2026-72062

A vulnerability was determined in TOTOLINK A800R 4.1.2cu.5137 B20200730. This affects the function setStaticDhcpConfig of the file /cgi-bin/cstecgi.cgi of the component lan.so. Executing a manipulation of the argument Comment can lead to stack-based buffer overflow. It is possible to launch the...

PT-2026-72018

A vulnerability was detected in alldatacenter alldata up to 0.6.8. This affects the function Hessian2Input.readObject of the file /serialize/impl/HessianSerializer.java of the component xxl-rpc Listener. The manipulation results in deserialization. The attack may be performed from remote. The...

PT-2026-76039

VP8L decoding in golang.org/x/image/vp8l can allocate an excessive amount of memory when processing a crafted VP8L image containing many unused Huffman tree groups. This allows a remote attacker to cause a denial of service via memory exhaustion...

PT-2026-71988

Grav CMS before 2.0.13 contains a remote code execution vulnerability in the Flex Objects plugin settings validation that allows authenticated users to execute arbitrary code by uploading a ZIP file containing PHP code. Attackers can bypass routine name validation by using array notation instead ...

PT-2026-72022

Improper control of generation of code 'Code Injection' in the settings feature in Devolutions PowerShell Universal 2026.2.3 and earlier allows an authenticated user with settings management permission to execute arbitrary PowerShell code via a crafted setting value that is not properly escaped...

PT-2026-72005

FileBrowser before 2.63.19 does not account for case-insensitive filesystems when checking home directory ownership during self-registration. When Signup and CreateUserDir are enabled and FileBrowser's root is on a case-insensitive filesystem confirmed on Windows/NTFS, two self-registered usernam...

PT-2026-72133

Name of the Vulnerable Software and Affected Versions OpenStack Ironic versions prior to 38.0.1 Description The autodetect deploy interface may fail to execute the cleaning process immediately after a node is enrolled with or switched to the autodetect deploy interface. Recommendations Update to...

PT-2026-72063

A vulnerability was identified in TOTOLINK A800R 4.1.2cu.5137 B20200730. This impacts the function setUrlFilterRules of the file /cgi-bin/cstecgi.cgi of the component firewall.so. The manipulation of the argument url leads to stack-based buffer overflow. The attack can be initiated remotely. The...

PT-2026-72001

Grav versions from 1.5.2 through 2.0.12 contain a stored cross-site scripting vulnerability in the Security::detectXss function system/src/Grav/Common/Security.php. The event-handler scan is anchored at ?, which cannot cross the first literal ; when a appears inside a quoted attribute value the...

PT-2026-75992

Summary The run-metadata update endpoint PUT /api/v1/runs/:runId/metadata applies client-supplied "operations" by passing the attacker-controlled operation.key straight into new JSONHeroPathoperation.key.setnewMetadata, value packages/core/src/v3/runMetadata/operations.ts:22-23, with no...

PT-2026-76575

Summary Vault token and secret values are exposed in thrown errors when using hashi-vault-js. Details Every API method in Vault.js executes throw parseAxiosErrorerr, which returns the raw AxiosError untouched. That error carries the full Axios configuration, including the X-Vault-Token header and...

PT-2026-71382

Local privilege escalation vulnerabilities in the Palo Alto Networks GlobalProtect™ app enable a local user to escalate their privileges to NT AUTHORITYSYSTEM on Windows, and root on macOS and Linux. This enables a non-administrative user to execute arbitrary commands with administrative...

PT-2026-71867

IBM Langflow OSS 1.0.0 through 1.9.6 could allow a remote attacker to obtain unauthorized access to user accounts due to improper restriction of excessive authentication attempts...

PT-2026-71381

An improper input validation vulnerability exists in the Windows Pre-Logon Access Provider PLAP component of the Palo Alto Networks GlobalProtect™ app on Windows devices which enables a man-in-the-middle MitM attacker to execute arbitrary code with SYSTEM privileges on an affected client. The...

PT-2026-71673

vLLM is an inference and serving engine for large language models. Prior to 0.27.0, an integer overflow in blockIdx.x 2 d in activation kernels.cu can cause act and mul kernel to consume another batched user's input, allowing a request processed in the same inference batch to receive a partial or...

PT-2026-71875

AgenticSeek commit fc242c7 contains an unauthenticated remote code execution vulnerability that allows any network-adjacent attacker to execute arbitrary commands by submitting crafted queries to the unprotected POST /query API endpoint bound to 0.0.0.0:7777 with wildcard CORS. Attackers can send...

PT-2026-71527

Subscriber Cross Site Scripting XSS in AcyMailing SMTP Newsletter = 10.11.1 versions...

PT-2026-71593

Unauthenticated Cross Site Scripting XSS in Smart Online Order for Clover = 1.6.1 versions...

PT-2026-71407

@fastify/busboy is a multipart form-data parser. In versions 1.0.0 through 3.2.0, an attacker who can submit multipart form-data can crash the parser by sending a part header whose name is a prototype-inherited property such as proto or constructor. The internal header parser stores headers in a...