418643 matches found
PT-2026-126382
TRO600 contains an arbitrary file read vulnerability. An unauthenticated attacker can exploit this vulnerability to read or download arbitrary files on the affected device, including sensitive configuration files and password data, resulting in the disclosure of sensitive information...
PT-2026-126337
Semantic MediaWiki from 2.5.0 before 7.3.1 contains an improper authorization vulnerability that allows ordinary editors to permanently protect pages by adding an Is edit protected annotation. When $smwgEditProtectionRight is enabled, EditProtectionUpdater applies indefinite edit and move...
PT-2026-126707
A vulnerability was identified in oretnom23 php-travel-agency-system. This issue affects some unknown processing of the file admin/customer detail.php of the component Admin Record Pages. The manipulation of the argument costomer id/ticket id/emp id/salary id/page id leads to sql injection. It is...
PT-2026-126709
GnuPG version 2.5.21 for Windows contains a vulnerability where default Discretionary Access Control List DACL inheritance on the C:ProgramData directory allows members of the BUILTINUsers group to create arbitrary subdirectories under this path. An attacker with low-privilege access can create t...
PT-2026-126314
Heap-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System 3. This issue affects JP1/Automatic Job Management System 3 - Manager: from 10-00 before 13-50-31...
PT-2026-126661
GFI KerioConnect Kerio Connect before 10.0.8 Patch 2 contains a stored cross-site scripting vulnerability in the Webmail component that allows a remote attacker to run JavaScript in a victim's authenticated Webmail session by uploading a crafted SVG email attachment that bypasses sanitization of...
PT-2026-126332
Semantic MediaWiki 3.0.0 before 7.3.1 contains an uncontrolled recursion vulnerability in LegacyParser::getSubqueryDescription that processes nested query tokens before depth limits apply. Unauthenticated attackers can submit deeply nested query elements to the action=ask API to consume substanti...
PT-2026-126638
An improper authentication vulnerability in WatchGuard Fireware OS's AuthPoint multi-factor authentication process allows a local, unauthenticated attacker on the appliance to hijack another user's in-progress MFA session by supplying a specially crafted request and convincing the victim user to...
PT-2026-126371
REDAXO before 5.21.3 contains a cross-site request forgery vulnerability in the backend user administration page users/users because the CSRF token check only runs when the save parameter is set, while the update path triggered by FUNC UPDATE does not require it. Attackers can lure a logged-in...
PT-2026-126700
Adobe Campaign Classic ACC is affected by an Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability that could result in arbitrary code execution in the context of the current user. An attacker with high privileges could exploit this vulnerability to...
PT-2026-126342
Semantic MediaWiki from 3.0.0 before 7.3.1 contains a cross-site scripting vulnerability that allows attackers to inject markup by storing malicious semantic property values rendered unescaped in autocomplete suggestions. When another user opens the property-value autocomplete with an empty query...
PT-2026-127146
A hard-coded cryptographic key vulnerability exists in the user-configuration backup mechanism of TP-Link RE305 V3 and Archer C7 V5. A fixed AES-128 key and initialization vector are embedded in the firmware configuration-management component. An attacker who obtains an affected configuration...
PT-2026-126347
Semantic MediaWiki from 2.5.0 before 7.3.1 contains a stored cross-site scripting vulnerability that allows users with page-edit rights to inject scripts via External identifier property values. Attackers can annotate markup payloads that ExternalIdentifierValue renders unescaped on Special:Brows...
PT-2026-127192
Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an authenticated attacker may cause a stack buffer overflow in res xmpp XMPP namespace prefix handling using carefully...
PT-2026-126634
Cleartext Transmission of Sensitive Information vulnerability in the WatchGuard Mobile VPN with SSL client for Windows allows a local attacker who can capture loopback traffic to obtain the user’s VPN username and password...
PT-2026-126679
In EPICS Base release 7.0.10 and prior, an integer overflow in network request processing can cause memory to be allocated with an incorrect size. Subsequent handling of attacker supplied data may result in memory corruption, denial of service, or potential remote code execution...
PT-2026-126692
Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an authenticated attacker may crash Asterisk through a buffer over-read in the PJSIP MWI body parser by sending a carefully...
PT-2026-126693
Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an out-of-bounds write in chan unistim DIALPAGE digit handling can overflow the phone number field and crash Asterisk when ...
PT-2026-126696
Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, a stack buffer overflow in the H.323 ooTrace trace-logging function can occur when unbounded vsprintf writes into a fixed...
PT-2026-126688
A vulnerability was determined in oretnom23 php-travel-agency-system. This vulnerability affects unknown code of the file admin/customer search.php of the component Admin Search Pages. Executing a manipulation of the argument customer name/voucher no/emp name can lead to sql injection. The attack...
PT-2026-126338
Semantic MediaWiki from 2.5.0 before 7.3.1 contains an uncontrolled resource consumption vulnerability that allows low-privilege editors to bypass smwgMaxNumRecurringEvents by supplying a large limit parameter. Attackers can save pages using set recurring event without an end date to generate...
PT-2026-126326
Heap-based Buffer Overflow Vulnerability in JP1 Products. This issue affects JP1/Integrated Management 3 - Manager: from 13-00 before 13-50-31; JP1/Automatic Job Management System 3 - Manager: from 13-00 before 13-50-31; JP1/Automatic Job Management System 3 - Agent: from 13-00 before 13-50-31;...
PT-2026-126327
Out-of-bounds Write Vulnerability in JP1 Products. This issue affects JP1/Integrated Management 3 - Manager: from 13-00 before 13-50-31; JP1/Automatic Job Management System 3 - Manager: from 13-00 before 13-50-31; JP1/Automatic Job Management System 3 - Agent: from 13-00 before 13-50-31;...
PT-2026-126357
Joomla Extension - dj-extensions.com - Unauthenticated Stored XSS in DJ-HelpfulArticles quote was applied on insert, which protects the SQL statement but does nothing for HTML output. There was no CSRF token, no rate limit, and the vote de-duplication keyed on the same attacker-controlled field...
PT-2026-126367
REDAXO core from 5.3.0 before 5.21.4 contains an authentication bypass vulnerability in the structure/history plugin that allows unauthenticated attackers to forge temporary login tokens. Attackers can force the session-tied secret into a predictable state and forge tokens for accounts like admin...
PT-2026-126360
REDAXO before 5.21.5 contains a cross-site request forgery vulnerability because the backend processes the safemode GET parameter in index.php without validating a CSRF token. Attackers can lure a logged-in administrator into opening a crafted link to disable global safe mode, writing safe mode:...
PT-2026-126643
A stack-based buffer overflow vulnerability in Fireware OS's SIP proxy allows a remote, unauthenticated attacker to execute arbitrary code by sending a specially crafted request through a policy that uses the SIP proxy...
PT-2026-126397
Observable response discrepancy vulnerability in Rolantis Information Technologies Tourism Industry and Trade Co. Ltd. Agentis allows Account Footprinting. This issue affects Agentis: before 4.8...
PT-2026-126702
Adobe Campaign Classic ACC is affected by an Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthoriz...
PT-2026-126355
In affected versions of Octopus Server, a user holding the System Manager role could escalate their privileges to full system Administrator...
PT-2026-126308
The twofactor gauthenticator plugin for Roundcube is vulnerable to 2fa authentication bypass by spoofed client address headers. Due to the lack of validation of the Client-IP and X-Forwarded-For headers, an attacker who obtains user's password can spoof a whitelisted IP address, resulting in the...
PT-2026-126307
The twofactor gauthenticator plugin for Roundcube is vulnerable to session persistence after failed 2FA verification. Due to the lack of server-side session destruction, an attacker can ignore the logout redirect and keep the session alive. This may allow an attacker who obtains user's password t...
PT-2026-126425
EasyImages2.0 through 2.8.6 contains an unauthenticated path traversal vulnerability in app/down.php, app/thumb.php and app/info.php that allows reading files outside the upload directory. Attackers can supply ../ sequences in the dw, history or img parameters to read files with allowed upload...
PT-2026-126422
MrDoc through 1.1.1 contains a broken access control vulnerability in the manage doc share type 3 branch that allows authenticated users to modify other users' document share settings because updates lack an ownership check. Attackers can compute predictable share tokens from the MD5 of document ...
PT-2026-126442
A vulnerability was identified in a2aproject a2a-go up to 2.4.0. The affected element is the function Cancel of the file internal/taskexec/distributed manager.go of the component Distributed Manager. Such manipulation leads to denial of service. It is possible to launch the attack remotely...
PT-2026-126427
mcp-ffmpeg through 1.0.5 contains an OS command injection vulnerability that allows attackers to run shell commands by supplying crafted videoPath or outputDir values to the resize-video, extract-audio and get-video-info tools. Attackers can embed $, backticks or a closing double quote in an...
PT-2026-125902
Cross-Site Scripting XSS in the processing of SVG images submitted to the /api/v2/ai/sessions API in the format data:image/svg+xml;base64. Script tags embedded in the SVG are processed when the content is rendered in the assistant window, allowing JavaScript to be executed and the displayed conte...
PT-2026-126428
Kali-GPT through commit a608c74 contains an OS command injection vulnerability in execute tool in kali gpt/tools/mcp server.py that allows MCP clients to run commands via unsanitized scanner parameters. Attackers or prompt-injected agents can embed shell metacharacters in parameters like target,...
PT-2026-126410
An issue in Shirt Pocket's SuperDuper! 4.0.9 and earlier allow a local attacker to obtain sensitive information...
PT-2026-126411
A vulnerability was determined in a2aproject a2a-go up to 2.4.0. Impacted is an unknown function of the file a2asrv/rest.go of the component REST SSE handler. This manipulation causes resource consumption. It is possible to initiate the attack remotely. Upgrading to version 2.5.0 is recommended t...
PT-2026-126306
The twofactor gauthenticator plugin for Roundcube is vulnerable to brute-forcing of the second-factor code. Due to the lack of rate limiting, an attacker who obtains user's password can submit arbitrary 6-digit codes, resulting in second-factor bypass and unauthorized access to the system. This...
PT-2026-127149
An operating-system command injection vulnerability exists in the tmpServer service of TP-Link RE305 V3. The service runs with root privileges and listens on the local loopback interface. A local attacker with access to a low-privileged process on the device may submit a crafted request to the...
PT-2026-127151
Tanium addressed an improper access controls vulnerability in Comply...
PT-2026-127147
An authentication flaw exists in the password-recovery functionality of TP-Link RE305 V3. The verification-code interface allows an unauthenticated attacker on the same local network to trigger generation of an administrator password-reset verification code. Because the interface lacks an effecti...
PT-2026-126329
A stack-based buffer overflow vulnerability exists in the web management interface of affected Moxa wireless device servers. An authenticated remote attacker with low privileges could exploit insufficient bounds checking of user-supplied input, causing the web management service to become...
PT-2026-126426
esp-mcp through commit 28afddf contains an OS command injection vulnerability that allows attackers to run arbitrary commands by supplying shell metacharacters in MCP tool parameters. Attackers influencing agent tool calls through prompt injection can inject metacharacters into target, port,...
PT-2026-126706
OpenWISP Controller is a network and WiFi controller for provisioning, configuration management, updates, and PKI management. From 1.0.0 until 1.3.2, the GET /api/v1/controller/ca//crl endpoint allows an authenticated organization manager with CA view permission to retrieve another organization's...
PT-2026-126439
Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain a Relative Path Traversal vulnerability. A high privilege...
PT-2026-126429
Vorota-ai nmap-mcp through commit 3636afa contains an improper allowlist validation vulnerability in the scan vulnerabilities tool that lets callers run blocked NSE script categories. MCP clients or prompt-injected agents can pass categories like exploit, dos, brute, or intrusive to nmap --script...