PT-2026-125878

🚨 MAJOR SECURITY ALERT: bitcoinjs patches multiple high security issues in their packages We hit some of the most critical infrastructure in Bitcoin is dependent on bitcoinjs packages—bitcoinjs-lib, bip39, tiny-secp256k1 were affected are ato multiple high security issues affecting major wallets,...

PT-2026-125877

🚨 MAJOR SECURITY ALERT: bitcoinjs patches multiple high security issues in their packages We hit some of the most critical infrastructure in Bitcoin is dependent on bitcoinjs packages—bitcoinjs-lib, bip39, tiny-secp256k1 were affected are ato multiple high security issues affecting major wallets,...

PT-2026-125882

Summary qs.stringify with allowEmptyArrays: true writes the key of an empty array without encoding it, even though keys are encoded by default. A key that contains & or the configured delimiter, =, or ∴ becomes query string syntax instead of data, so a caller-supplied key name can add parameters ...

PT-2026-125871

Psono Server CE & EE versions 1.0.0 through 7.2.3 did not enforce the direction of file-transfer credentials on file-repository operations. An authenticated remote attacker with read-only access to a file could present a download transfer to the upload endpoint, obtain a signed upload URL for an...

PT-2026-125872

Psono Server CE & EE versions 3.1.0 through 7.2.3 did not consume a stored WebAuthn challenge after assertion verification. An unauthenticated remote attacker who possessed the user's password and one captured valid WebAuthn assertion could replay that assertion with separate login tokens while t...

PT-2026-125870

Psono Server versions 5.3.5 through 7.2.3 used a permission class that did not enforce token write scope when claiming a device code. An authenticated remote attacker holding a restricted API key-derived session could claim an attacker-controlled device code and obtain a full read-write session...

PT-2026-125873

Psono Server CE && EE versions 0.1.0 through 7.2.3 accepted a user-controlled host when configuring a personal Duo device and passed it to the Duo client without an allowlist or explicit timeout. An authenticated remote attacker could cause the server to connect to selected hosts over HTTPS on po...

PT-2026-125552

DevilutionX 1.4.0 through 1.5.5 contains an out-of-bounds read vulnerability in the bundled libmpq libmpq file number from hash function that allows attackers to read heap memory via unchecked block table index values. Attackers can place a crafted .mpq archive in the game's data path, such as a...

PT-2026-125554

Mistral Vibe before 3.0.3 contains a remote code execution vulnerability that allows attackers to run commands by defining git filter drivers in an untrusted repository's .git/config. When started with --worktree, git worktree add applies .gitattributes and runs filter smudge, clean, or process...

PT-2026-125550

A malicious actor who lures an authenticated user to a malicious page could exploit a Cross-Site Request Forgery CSRF vulnerability found in airMAX M devices to make unauthorized changes and execute a Denial of Service DoS attack on the device...

PT-2026-125546

llama.cpp b10398 before b11301 contains an integer overflow vulnerability in gguf init from reader that allows attackers to bypass tensor element-count validation by supplying shapes whose product wraps to zero. Attackers can craft GGUF files with enormous tensor extents that overflow ggml nbytes...

PT-2026-125650

A vulnerability was detected in MD-MAFUJUL-HASAN Online-Payroll-Management-System up to a8902bf64575e325f6d6bf93a55f7bd273ec58cd. Affected is an unknown function of the file chat.php. Performing a manipulation of the argument ID results in cross site scripting. It is possible to initiate the atta...

PT-2026-125537

A vulnerability was found in SourceCodester Online Food Ordering System 1.0. The impacted element is an unknown function of the file order.php. The manipulation of the argument price/title results in client-side enforcement of server-side security. It is possible to launch the attack remotely. Th...

PT-2026-125538

A security vulnerability has been detected in DAMO Academy VideoLLaMA2 up to 1.1. Affected by this issue is the function load pretrained model of the file videollama2/model/ init .py of the component Model Loading. The manipulation of the argument name or path leads to improper validation of...

PT-2026-125895

This issue may allow an authenticated IPMI Administrator to read arbitrary files from the BMC filesystem, disclosing material well beyond the intended IPMI management role...

PT-2026-125653

Untrusted Pointer Dereference in ASUS certain motherboards firmware allows a kernel-level privileges user can supply an arbitrary memory address via an I/O command, leading to subsequent system information being tampered with or causing a system crash. Refer to the 'Security Update for Multiple...

PT-2026-125883

The Kirki plugin for WordPress is vulnerable to Privilege Escalation via PHP Object Injection in all versions up to, and including, 6.2.5 via deserialization of untrusted input through the 'get-single-symbol' branch of the kirki post apis AJAX dispatcher due to a missing capability check. This...

PT-2026-125869

The Analytics Insights – Google Analytics Dashboard for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Page Title in all versions up to, and including, 6.3.12 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticate...

PT-2026-126309

Stack-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System 3. This issue affects JP1/Automatic Job Management System 3 - Manager: from 11-00 before 13-50-31; JP1/Automatic Job Management System 3 - Agent: from 11-00 before 13-50-31...

PT-2026-125880

The PayDunya WooCommerce Payment Gateway WordPress plugin through 1.1.6 does not verify the authenticity of incoming payment notifications and, until the gateway is configured, authenticates them with a value derived from an empty secret that anyone can compute, allowing unauthenticated attackers...

PT-2026-125881

Out-of-bounds read in the QAuthenticator NTLM authentication handling in the Qt Network module in Qt Group Qt allows remote attackers to obtain sensitive information heap memory contents or cause a denial of service application crash via a crafted NTLM challenge sent by a malicious server or prox...

PT-2026-125885

An improper certificate validation vulnerability exists in Moxa Remote Connect Suite MRC Client. Under certain conditions, an unauthenticated attacker with on-path access to the communication between the MRC Client and its server could impersonate a trusted server and conduct a man-in-the-middle...

PT-2026-125540

llama.cpp before b2731 contains an out-of-bounds read vulnerability in llama model loader that allows attackers to read memory outside the mapped model file via crafted GGUF tensor offsets. Attackers can supply a crafted or truncated GGUF model file with arbitrary 64-bit tensor offsets to crash t...

PT-2026-126306

The twofactor gauthenticator plugin for Roundcube is vulnerable to brute-forcing of the second-factor code. Due to the lack of rate limiting, an attacker who obtains user's password can submit arbitrary 6-digit codes, resulting in second-factor bypass and unauthorized access to the system. This...

PT-2026-125890

An out-of-bounds read vulnerability in the QTextCodec TSCII encoding of the Qt 5 Compatibility APIs module Qt Core in Qt 5 and earlier impacts Qt. Applications that convert text to the TSCII encoding through QTextCodec may read memory outside the input buffer, which can cause the application to...

PT-2026-126308

The twofactor gauthenticator plugin for Roundcube is vulnerable to 2fa authentication bypass by spoofed client address headers. Due to the lack of validation of the Client-IP and X-Forwarded-For headers, an attacker who obtains user's password can spoof a whitelisted IP address, resulting in the...

PT-2026-126307

The twofactor gauthenticator plugin for Roundcube is vulnerable to session persistence after failed 2FA verification. Due to the lack of server-side session destruction, an attacker can ignore the logout redirect and keep the session alive. This may allow an attacker who obtains user's password t...

PT-2026-125867

The Payment Integration Wompi WordPress plugin through 4.0.1 does not verify the authenticity of incoming payment notifications on a stock install, because the callback's checksum is keyed on a merchant secret that is empty until it is manually configured, allowing an unauthenticated attacker to...

PT-2026-125900

Joomla Extension - balbooa.com - Missing Authorization Check on Editor Controller Task in Gridbox 2.20.4.2 - EditorController::getBlogPosts reads the order parameter and invokes getBlogPosts . Unlike other tasks in this controller, it omits the GridboxHelper::checkUserEditLevel check...

PT-2026-125868

The Payex Payment Gateway for Woocommerce WordPress plugin through 1.2.10 does not properly verify the authenticity of incoming payment notifications, relying on a validation secret that is empty by default, allowing unauthenticated attackers to forge a valid payment confirmation and mark any ord...

PT-2026-126304

Joomla Extension - phoca.cz - CSRF in category management in Phoca Download 3.1.0 - 6.1.5...

PT-2026-125884

An attacker who obtained the hardcoded key could decrypt domain/service account passwords, task run-as credentials, and sysprep passwords stored in or transmitted by GSS Deployment Server installation...

PT-2026-125542

llama.cpp before b5649 contains a heap out-of-bounds read vulnerability in llama vocab::impl::print info that allows attackers to crash model loading via oversized special token IDs. Attackers can supply a crafted GGUF model with a short tokenizer.ggml.tokens array, causing llama-cli or...

PT-2026-125901

Stored cross-site scripting XSS in BloX widgets. The /api/dashboards//widgets/ API accepts HTML and JavaScript content in the ‘desc’ and ‘text’ parameters. The code entered is executed in the browser when the widget is rendered, which could compromise the confidentiality of the information...

PT-2026-125902

Cross-Site Scripting XSS in the processing of SVG images submitted to the /api/v2/ai/sessions API in the format data:image/svg+xml;base64. Script tags embedded in the SVG are processed when the content is rendered in the assistant window, allowing JavaScript to be executed and the displayed conte...

PT-2026-125888

An OS command injection vulnerability exists because of insufficient input filtering. An attacker can inject a command payload into a BMC function; the payload may execute when the related service is restarted...

PT-2026-125545

llama.cpp b5899 before b10261 contains a heap out-of-bounds write vulnerability in llm tokenizer plamo2::build that allows attackers to corrupt heap memory via crafted GGUF models. Attackers can supply BYTE-typed token text like whose negative parsed value writes token ids before the bytes buffer...

PT-2026-125549

A malicious actor who lures an authenticated user to a malicious page could exploit a Cross-Site Request Forgery CSRF vulnerability found in airMAX M devices to execute a Command Injection on the device...

PT-2026-125547

A malicious actor with access to the adjacent network and under certain conditions could exploit a Stored Cross-Site Scripting XSS vulnerability found in airMAX M devices to escalate privileges on the device...

PT-2026-126329

A stack-based buffer overflow vulnerability exists in the web management interface of affected Moxa wireless device servers. An authenticated remote attacker with low privileges could exploit insufficient bounds checking of user-supplied input, causing the web management service to become...

PT-2026-125894

A flaw in the BMC RAKP+ implementation may allow an attacker to send a request followed by a specially crafted RAKP message and establish an RMCP+ session, which could then be used to execute commands...

PT-2026-126338

Semantic MediaWiki from 2.5.0 before 7.3.1 contains an uncontrolled resource consumption vulnerability that allows low-privilege editors to bypass smwgMaxNumRecurringEvents by supplying a large limit parameter. Attackers can save pages using set recurring event without an end date to generate...

PT-2026-126333

Semantic MediaWiki from 3.0.0 before 7.3.1 contains an algorithmic complexity vulnerability in TermParser::normalize compact form that allows unauthenticated attackers to cause quadratic CPU consumption. Attackers can submit long search terms with many distinct in:... or has:... expressions to...

PT-2026-126346

Semantic MediaWiki from 3.1.0 before 7.3.1 contains a reflected cross-site scripting vulnerability in the Special:SMWAdmin ID lookup that allows unauthenticated attackers to inject markup through the unescaped id parameter. Attackers can lure an smw-admin administrator into opening a crafted look...

PT-2026-126355

In affected versions of Octopus Server, a user holding the System Manager role could escalate their privileges to full system Administrator...

PT-2026-126341

Semantic MediaWiki from 3.0.0 before 7.3.1 contains a cross-site request forgery vulnerability in Special:SMWAdmin because it overwrites the wpEditToken with a freshly generated valid token. Attackers can lure an authenticated smw-admin user to a malicious page that triggers schema setup,...

PT-2026-126353

SemanticMediaWiki from 3.1.0 before 7.3.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject markup through the search parameter of the extended Special:Search profile. Attackers can send visitors crafted URLs using the smw profile with SVG eve...

PT-2026-126356

In JetBrains Junie CLI before 26.8.17 command execution was possible due to incomplete validation of allowlisted commands...

PT-2026-125898

This issue may allow an IPMI authenticated administrator to execute commands as the operating system root user on the BMC...

PT-2026-126318

Authentication Bypass by Spoofing Vulnerability in HiRDB. This issue affects HiRDB Server Version 10: from 10-00 before 10-12-01; HiRDB Server Version 9: from 09-00 through 09-66-22; HiRDB Server with Additional Function Version 9: from 09-00 through 09-66/V; HiRDB Server Version 932: from 09-02...