414787 matches found
PT-2026-117475
Name of the Vulnerable Software and Affected Versions carbon console affected versions not specified Description The carbon console fails to sufficiently encode user-supplied XML input, which enables the injection of malicious scripts. A remote attacker can exploit this to execute arbitrary...
PT-2026-117691
Name of the Vulnerable Software and Affected Versions IBM Storage TS4500 Library versions 1.1.1.6 through 1.12.0.3 Description IBM TS4500 Tape Library and Diamondback Tape Library fail to invalidate sessions properly. This flaw allows an authenticated user to impersonate another user on the syste...
PT-2026-117689
Name of the Vulnerable Software and Affected Versions IBM Storage TS4500 Library versions 1.1.1.6 through 1.12.0.3 IBM Diamondback Tape Library affected versions not specified Description An authenticated user can trigger a denial of service by sending specially crafted SMTP requests. This action...
PT-2026-118054
Vikunja: Link-share token reads any tenant's kanban buckets and enumerates usernames/IDs instance-wide BOLA in code.vikunja.io/api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing...
PT-2026-118074
KEDA: Privilege escalation from namespace admin to cluster admin via KEDA TriggerAuthentication in github.com/kedacore/keda...
PT-2026-117530
Name of the Vulnerable Software and Affected Versions IBM Concert versions 1.0 through 3.0.0 Description The software employs cryptographic algorithms that are weaker than expected, which could enable an attacker to decrypt highly sensitive information. Recommendations At the moment, there is no...
PT-2026-117311
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. The importer stores imported question bodies as raw HTML without passing them through the normal Markdown-to-HTML sanitization path, ...
PT-2026-117637
Dell Application Store, versions prior to 26.05.0.7, contain an Incorrect Permission Assignment for Critical Resource vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Disclosure of sensitive information...
PT-2026-117319
Insufficient session expiration vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. Insufficient session invalidation allowed revoked users to continue accessing known private uploaded files with a stale visit token. Users are recommended to upgrade to version 2.0.3,...
PT-2026-117328
Server-Side Request Forgery SSRF, Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' and Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Camel Docling component. This issue affects Apache Camel: from 4.15.0 before 4.18.5, from 4.19.0...
PT-2026-117531
IBM Concert 1.0 through 3.0.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information...
PT-2026-117547
Element X iOS is a Matrix iOS Client provided by Element. Element X iOS before version 26.05.0 fails to check the URL allowlist when parsing io.element.call://. If an attacker is able to trick the user into opening a maliciously crafted io.element.call:// URL, they are able to load an...
PT-2026-117235
A potential security vulnerability in HPE Compute Scale-up Server 3200 and 3250 platforms and Superdome Flex server could be remotely exploited to list and modify RMC filesystem...
PT-2026-117247
Name of the Vulnerable Software and Affected Versions Document Gallery WordPress plugin versions prior to 5.1.2 Description Insufficient sanitization and escaping of several gallery shortcode attributes occur before they are embedded in a single-quoted HTML attribute within the rendered gallery...
PT-2026-118085
containerd: Unpack DoS via repeated opaque whiteouts in github.com/containerd/containerd...
PT-2026-117365
Improper Restriction of XML External Entity Reference vulnerability in Apache Camel. This issue affects Apache Camel: from 4.7.0 before 4.18.5, from 4.19.0 before 4.22.1. Improper Restriction of XML External Entity Reference in the Smooks component camel-smooks in Apache Camel allows an attacker...
PT-2026-117369
Name of the Vulnerable Software and Affected Versions Apache Camel versions 4.0.0 through 4.18.4 Apache Camel versions 4.19.0 through 4.22.0 Description The Camel-Jgroups component contains a deserialization of untrusted data issue. The JGroupsEndpoint.createExchangeMessage function, called by...
PT-2026-117322
Name of the Vulnerable Software and Affected Versions Apache Answer versions prior to 2.0.3 Description An authentication bypass exists in the reaction API endpoint. The system fails to enforce content visibility controls, which allows unauthorized users to read reaction metadata from restricted...
PT-2026-117321
Incorrect implementation of authentication algorithm vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. A flaw in the User Center login integration can cause a newly created external user session to omit its external identity, allowing subsequent requests to bypass...
PT-2026-117488
Name of the Vulnerable Software and Affected Versions WSO2 Identity Server affected versions not specified Description The authentication endpoint fails to provide a consistent system response when a username does not exist, allowing attackers to differentiate between valid and invalid usernames...
PT-2026-117343
Generation of Error Message Containing Sensitive Information vulnerability in Apache Camel Knative component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. When processing of an exchange failed on the consumer side, the Knative HTTP consumer wrote the...
PT-2026-117344
Improper Authentication vulnerability in Apache Camel Shiro component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The Shiro security processor skipped credential verification when the subject already bound to the current thread carried the same principal...
PT-2026-117364
Use of Cache Containing Sensitive Information vulnerability in Apache Camel HTTP component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The OAuth2 client token cache is global to the JVM, and its key omitted several of the fields that determine what a tok...
PT-2026-117352
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Camel HTTP component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. Two paths handed credentials to a redirect target, which is a host chosen by the remote server rather than...
PT-2026-117342
Cross-Site Request Forgery CSRF vulnerability in Apache Camel OAuth component. This issue affects Apache Camel: from 4.11.0 before 4.18.5, from 4.19.0 before 4.22.1. The authorization code callback did not carry a state parameter binding it to the authorization request that started the flow, and...
PT-2026-117345
Improper Validation of Integrity Check Value vulnerability in Apache Camel Crypto PGP component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. unmarshal verified the modification detection code only when the message was an OpenPGP symmetrically encrypted...
PT-2026-117356
Exposure of Data Element to Wrong Session vulnerability in Apache Camel AS2 component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. Signing material belonging to an individual request was stored in state that is shared across requests rather than confined ...
PT-2026-117354
Generation of Error Message Containing Sensitive Information vulnerability in Apache Camel CXF component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. When a route behind a CXF SOAP consumer failed with an exception the service contract does not declare, t...
PT-2026-117487
Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description Session-bound tokens are not revoked upon user session termination when token binding validation is enabled and the "Revoke token upon user logout" option is...
PT-2026-117363
Insufficient Granularity of Access Control vulnerability in Apache Camel Platform HTTP component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The component decided whether an endpoint ran in proxy mode by testing whether its configured path started with t...
PT-2026-117362
Generation of Error Message Containing Sensitive Information vulnerability in Apache Camel gRPC component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. When a route behind a gRPC consumer failed, the exception's message was placed into the gRPC status...
PT-2026-117351
Improper Restriction of XML External Entity Reference vulnerability in Apache Camel XPath component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. With documentType set to InputSource, XPathBuilder handed the payload straight to javax.xml.xpath, which build...
PT-2026-117350
Improper Input Validation vulnerability in Apache Camel Tika component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The Tika producer mapped every metadata key parsed out of the submitted document onto the Exchange as a header, with no filter applied...
PT-2026-117353
Improper Handling of Case Sensitivity vulnerability in Apache Camel Platform HTTP component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The guard that prevents a request header being reflected into the response compared header names case sensitively, whi...
PT-2026-117496
IBM MQ could allow an authenticated attacker to cause a denial of service or corrupt memory due to improper validation of buffer sizes in MQOPEN operations...
PT-2026-117499
Name of the Vulnerable Software and Affected Versions AIOHTTP versions prior to 3.14.4 Description Keepalive timeout handling is absent during the initial portion of a request. This allows an attacker to maintain an idle connection indefinitely before transmitting any request data, which consumes...
PT-2026-117501
Name of the Vulnerable Software and Affected Versions AIOHTTP versions 2.0.0 through 3.14.3 Description Multipart request processing can retain an unbounded number of open file descriptors. An unauthenticated attacker can exhaust these file descriptors by sending specially crafted multipart...
PT-2026-117497
Name of the Vulnerable Software and Affected Versions russh versions prior to 0.64.1 Description The agent server in the library contains a flaw where it spawns a separate long-lived task for every SSH AGENT CONSTRAIN LIFETIME record received in a constrained add-key request. The add key function...
PT-2026-117627
Name of the Vulnerable Software and Affected Versions Craft CMS versions 5.0.0 through 5.10.x Description An authorization bypass exists where site-scoped GraphQL tokens can mutate content belonging to other sites. This occurs because the requireAllowedSite function is not enforced. An attacker...
PT-2026-118263
CVE-2026-108519 - Rejected reason: This CVE ID has been rejected or CVE ID :CVE-2026-108519 Published : Oct. 18, 2026, 11:16 p.m. | 2 hours, 13 minutes ago Description :Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. Severity: 0.0 | NA Visit the link fo...
PT-2026-117493
Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description An unauthenticated user can execute workflow rules without authentication by sending a DWR request. This is achieved by setting isPasswordUppercase as one call...
PT-2026-117263
A security vulnerability has been detected in michaelrsweet mxml 4.0.5/4.0.6. This affects the function mxml load data of the file mxml-file.c. The manipulation leads to use after free. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. The...
PT-2026-120338
Affected versions include emSign ECC Root CA - G3, which can allow certificate paths through distrusted emSign intermediates. Affected versions may accept certificate paths containing distrusted emSign intermediate public keys. The private keys corresponding to these intermediates are now well...
PT-2026-117210
Name of the Vulnerable Software and Affected Versions Google OSS Agent Mesh SAM versions 0.1.0-alpha.1 through 0.1.0-alpha.8 Description Missing authorization and the use of insecure default resource initialization allow a remote attacker to self-enroll into the mesh and invoke arbitrary tools...
PT-2026-117433
Koalixcrm through 1.14.0 contains a stored cross-site scripting vulnerability that allows staff users to inject script by storing malicious task titles rendered unescaped by Task.link to task. Attackers can embed HTML or script that executes when administrators open the task changelist or change...
PT-2026-122237
Name of the Vulnerable Software and Affected Versions Wasmtime versions 46.0.0 through 48.0.6 Wasmtime versions 49.0.0 through 49.0.3 Description A flaw exists when lowering a host-created component-model stream or future into a guest. The system may omit a required payload-type check after the...
PT-2026-117574
Name of the Vulnerable Software and Affected Versions Cpanel::JSON::XS versions prior to 4.80 Description Memory exhaustion can occur when encoding exponent notation as full decimal digits while using the allow bignum setting. When allow bignum is enabled, JSON numbers with fractions or exponents...
PT-2026-117566
A heap use-after-free in the gf odf ac4 cfg clean list function /odf/descriptors.c of GPAC Project/MP4Box 2.5-DEV-rev1593-gfe88c3545-master allows attackers to cause a Denial of Service DoS via supplying a crafted AC4 file...
PT-2026-117361
Improper Input Validation vulnerability in Apache Camel Mail component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. CVE-2026-46584 addressed mail headers reaching the Exchange without passing through a header filter, but the MimeMultipart data format...