PT-2026-117261

A flaw has been found in subhajitkhan online-clinic-management-system up to e9ee77a8827a1446220fa07ee693dc4d9a29a578. The affected element is the function echo of the file doctorregistration.php of the component Doctor Registration. Executing a manipulation of the argument doc name can lead to...

PT-2026-117453

Name of the Vulnerable Software and Affected Versions Progressive Robot hMailServer versions 6.2.22 through 6.3.6 Progressive Robot hMailServer versions 6.0.0 through 6.3.6 Description Missing authorization in the Sieve editheader action and the mail-rule Set header value action allows an...

PT-2026-117386

@fastify/oauth2 is a Fastify wrapper for OAuth2 login flows. In versions 7.2.0 through 8.3.1, the state and code-verifier cookies are set without a Path attribute at a login route with two or more path segments, while the clearing step at the OAuth callback writes them with a root path, so the...

PT-2026-118081

Nginx UI: Auto backup name allows path traversal outside validated storage path in github.com/0xJacky/Nginx-UI...

PT-2026-117576

Name of the Vulnerable Software and Affected Versions Cpanel::JSON::XS versions prior to 4.80 Description An issue exists where memory exhaustion can occur due to the buffering of incremental input beyond the max size limit within the incr parse function. The parser appends each data chunk to its...

PT-2026-117580

Name of the Vulnerable Software and Affected Versions Cpanel::JSON::XS versions 3.0202 through 4.79 Description Memory leak occurs when encoding values as strings in the encode stringify function. The issue arises when the function writes a value in string form under allow stringify, convert...

PT-2026-117439

FlyCms through commit edfdf724 contains a mass assignment vulnerability that allows authenticated users to overwrite protected account columns by submitting extra User bean fields to /ucenter/account update. Attackers can change their review status, rename themselves, or duplicate another account...

PT-2026-117217

在 openGauss-connector-jdbc 的 pgjdbc/src/main/java/org/postgresql/log/LogFactory.java 中，LogFactory 根据 JDBC 连接参数中的 logger 类名调用 Class.forName 加载类后，直接反射调用以 String 为参数的构造函数，再转换为 Log。缺少 asSubclassLog.class 校验，非 Log 实现类也会在类型检查前被实例化。因此，当攻击者可控制 JDBC URL 或连接属性中的 logger 类名，且客户端 classpath...

PT-2026-117232

A security flaw has been discovered in sgl-project SGLang up to 0.5.19. Affected is the function WeightExporter.send weights to remote instance of the file python/sglang/srt/model executor/model runner components/weight exporter.py of the component Weight Exporter. Performing a manipulation of th...

PT-2026-117303

A vulnerability was determined in DeepPavlov up to 1.7.0. This affects the function MultiTaskPipelinePreprocessor. init of the file deeppavlov/models/preprocessors/multitask preprocessor.py. This manipulation of the argument preprocessor causes code injection. The attack is possible to be carried...

PT-2026-117418

libtins through 4.6 contains an out-of-bounds read vulnerability in DNS::soa record::init that allows remote attackers to read past buffer bounds by supplying SOA data lacking NUL terminators. Attackers can feed raw SOA RDATA without a zero byte to applications using the buffer constructor, causi...

PT-2026-117452

SQL injection via identifier injection in the tableName and tableFields POST parameters of admin AJAX endpoints admin/AJAX lookup handler.php, admin/AJAX check id.php, admin/AJAX vocabolary control.php in SENAYAN Library Management System SLiMS Bulian 9.8.0 allows any authenticated staff user to...

PT-2026-117424

libaribb24 aribb24 through 1.0.3 contains a heap-based buffer overflow vulnerability in src/parser.c that allows attackers to corrupt heap memory via an oversized caption data unit. Attackers can supply a crafted caption PES packet in a media file or broadcast stream, processed through arib parse...

PT-2026-117236

The FormFlow for GoHighLevel GHL WordPress plugin through 1.0.0 does not restrict access to a log file it writes inside the publicly accessible uploads directory, allowing unauthenticated attackers to read its contents, which include connected-CRM identifiers and, on sites that have linked the...

PT-2026-117626

Craft CMS from 5.0.0 before 5.11.0 contains an authentication bypass vulnerability that allows attackers to reuse verification codes because users/verify-email does not invalidate them for active users. Attackers who obtain a victim's emailed code can submit it to users/set-password after the...

PT-2026-117642

A vulnerability was identified in DiffSK configobj up to 5.0.9. Affected by this vulnerability is the function sectionmarker of the file configobj/ init .py. The manipulation leads to inefficient regular expression complexity. Remote exploitation of the attack is possible. The project was informe...

PT-2026-117374

Name of the Vulnerable Software and Affected Versions Red Hat Advanced Cluster Security for Kubernetes affected versions not specified Description An issue exists in the Central SAML authentication ACS endpoint where used SAML assertion or response identifiers are not retained to prevent replay...

PT-2026-118007

Excelize: Unbounded row number in Rows.Columns makes GetRows and the Rows iterator loop for days in github.com/xuri/excelize...

PT-2026-118084

Nezha Monitoring: Whole-instance DoS in Nezha dashboard: a member can crash the process for every tenant in github.com/nezhahq/nezha...

PT-2026-117664

Name of the Vulnerable Software and Affected Versions GIMP affected versions not specified Description A flaw exists in the PSD thumbnail resource loader that performs a BGR-to-RGB channel swap using a fixed 3-byte stride without verifying if the JPEG thumbnail is RGB. A specially crafted graysca...

PT-2026-117512

Name of the Vulnerable Software and Affected Versions IBM MQ affected versions not specified Description A stack buffer overflow occurs during channel connection establishment when processing TLS certificates containing malformed distinguished names. This flaw allows a remote attacker to execute...

PT-2026-117357

Incorrect Default Permissions vulnerability in Apache Camel PQC component. This issue affects Apache Camel: from 4.12.0 before 4.18.5, from 4.19.0 before 4.22.1. When the component wrote generated key material to disk it did so with the permissions the process default umask produced, rather than...

PT-2026-117528

IBM Concert 1.0 through 3.0.0 allows web page cache to be stored locally which can be read by another user on the system...

PT-2026-117271

SQL injection SQLi vulnerability—specifically a UNION-based vulnerability—in the Integratec application that affects the sInfo parameter sent via POST to the endpoint /login/ap Login.aspx/start. Successful exploitation of this vulnerability could allow an attacker to steal data from the database,...

PT-2026-117652

Name of the Vulnerable Software and Affected Versions TiBillet Lespass versions up to 10e87909c5d526dffa6d424c104fc12860740537 Description A weakness in the APIv1 component allows for server-side request forgery, a condition where an attacker can induce the server to make requests to an unintende...

PT-2026-117471

Crawl4AI from 0.8.7 through 0.9.5 contains a server-side request forgery vulnerability in the Docker API server that allows unauthenticated attackers to bypass destination checks via URL userinfo parsing differences. Attackers can set fetch ssl certificate=true with crafted userinfo URLs so...

PT-2026-117569

Cognition before 0.13.0 contains an unauthenticated remote code execution vulnerability due to defaulting its agent sandbox backend to local execution and shipping no authentication on its REST/SSE API. Attackers can create a session via POST /sessions and post a message via POST...

PT-2026-117682

A vulnerability was found in H3C Magic NX15 100R017. This issue affects the function sub 416874 of the file /usr/bin/usrlist. Performing a manipulation results in os command injection. Remote exploitation of the attack is possible. The exploit has been made public and could be used. The vendor wa...

PT-2026-117312

A vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. The question operation controller gates hide/show operations on the wrong permission check result the unpin permission instead of the hide permission, so in custom role configurations that separate these permission...

PT-2026-117221

A vulnerability was detected in radareorg radare2 6.2.0/6.2.2. This issue affects the function r core cmd str pipe in the library libr/core/rtr http.inc.c of the component HTTP Sandbox Policy Handler. Performing a manipulation results in protection mechanism failure. Remote exploitation of the...

PT-2026-118003

Mercury runs a JupyterLab server with anonymous access by default mercury app/ main .py sets --IdentityProvider.token='' when no --token/MERCURY TOKEN is given; when tokenless it also sets --ServerApp.disable check xsrf=True. It relies on a blocklist mercury app/block handler.py BLOCKED PATTERNS:...

PT-2026-117239

The Snap Finance WordPress plugin through 3.11.0 does not verify that the payment provider's response actually confirms a completed, approved transaction before marking a WooCommerce order as paid, allowing unauthenticated attackers to mark arbitrary orders as paid without completing payment...

PT-2026-117397

NoteGen through 0.38.3 contains an external control of file path vulnerability in chat image analysis that allows attackers to read local image files via unvalidated synced sourceUrl paths. Attackers with write access to the victim's sync target can plant absolute paths or file:// URLs, causing...

PT-2026-118025

Nginx-UI AuthRequired token cookie fallback enables CSRF against management APIs in github.com/0xJacky/Nginx-UI...

PT-2026-117996

Summary The Secure attribute was not being enforced for the shared cookie. Impact It may be possible to send a shared cookie marked Secure through an unencrypted request...

PT-2026-118080

TOTP / passkey enrolment requires no re-authentication, enabling persistent account takeover in github.com/0xJacky/Nginx-UI...

PT-2026-118019

Coraza: Resource exhaustion via deferred file handle accumulation in multipart body processor in github.com/corazawaf/coraza...

PT-2026-118020

Coraza: URL-encoded form Content-Type parameters bypass Coraza body inspection in github.com/corazawaf/coraza...

PT-2026-118091

Arcane: Environment access token bypasses the admin-required authorization gate on /api/debug/pprof in github.com/getarcaneapp/arcane/backend...

PT-2026-117476

The ForgeRock client fails to correctly validate refresh tokens. This allows a refresh token to be treated as a valid access token, enabling its use for consuming protected resources. This bypasses the intended security control that requires valid client credentials in addition to a refresh token...

PT-2026-117218

A security flaw has been discovered in Tencent ncnn up to 44b02dabdcf97499281a4692ebd65bad73dcf8b6. Affected by this issue is the function ncnn::yuv420sp2rgb of the file src/mat pixel.cpp of the component Conversion API. The manipulation results in integer overflow. The attack can be launched...

PT-2026-117483

A weakness has been identified in MikroTik RouterOS up to 6.40.5/6.44/7.20.8. Impacted is the function same check of the file ipt SAME.ko. Executing a manipulation can lead to integer overflow. The attack may be launched remotely. Upgrading to version 7.21.5 and 7.23.1 is recommended to address...

PT-2026-118046

Nginx UI: Unauthenticated signed-request body staging can exhaust temporary storage in github.com/0xJacky/Nginx-UI...

PT-2026-118047

Vikunja: CalDAV and feeds BasicAuth endpoints have no rate limit, bypassing the anti-brute-force floor on account passwords in code.vikunja.io/api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this...

PT-2026-117222

A flaw has been found in RVC-Project Retrieval-based-Voice-Conversion-WebUI up to 2.3.260718. Impacted is the function change info of the file webui.py. Executing a manipulation of the argument ckpt path can lead to code injection. The attack can be executed remotely. The exploit has been publish...

PT-2026-117635

A vulnerability was found in agit8or1 clientst0r up to 3.17.586. Affected by this vulnerability is the function fetch html of the file locations/services/property url importer.py of the component Property URL Importer. The manipulation of the argument url results in server-side request forgery. T...

PT-2026-117431

Krayin CRM before 2.2.7 contains a broken object level authorization vulnerability in EmailController write actions that allows scope-restricted authenticated users to manipulate other users' emails by supplying their numeric IDs. Attackers can call update, destroy, mass-update or mass-destroy...

PT-2026-117267

A vulnerability has been found in SourceCodester Inventory System 1.0. This vulnerability affects unknown code of the file /api/transactions handler.php?action=save purchase of the component Purchase Records Handler. The manipulation of the argument Product Name/Product Code/Vendor Name leads to...

PT-2026-118057

Vikunja: Link-share principal ID collision allows cross-account API token issuance and management in code.vikunja.io/api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive...

PT-2026-117536

Name of the Vulnerable Software and Affected Versions GPAC Project/MP4Box version 2.5-DEV-rev1593-gfe88c3545-master Description A heap buffer overflow occurs in the gf odf ac4 cfg alternative info function located in /odf/descriptors.c. This issue allows an attacker to trigger a Denial of Service...