PT-2026-117171

A vulnerability was detected in Artifex MuPDF up to 1.28.5. This impacts the function free char list of the file source/pdf/pdf-xref.c of the component Signature Locking. Performing a manipulation results in double free. The attack may be initiated remotely. The exploit is now public and may be...

PT-2026-117213

A weakness has been identified in calcom cal.com and cal.diy up to 6.2.0. Impacted is the function createWebhookProcedure of the file packages/trpc/server/routers/viewer/webhook/util.ts of the component Webhook Handler. Executing a manipulation of the argument ID can lead to authorization bypass...

PT-2026-117170

A security vulnerability has been detected in aircheng-org iWebShop-5 up to 5.16. This affects the function send message mobile of the file controllers/simple.php. Such manipulation of the argument user id leads to weak password recovery. The attack can be launched remotely. The exploit has been...

PT-2026-117242

The Salon Booking System WordPress plugin before 10.31.11 does not enforce a minimum of zero when subtracting a fixed-amount discount from a booking's total, allowing an unauthenticated visitor who knows a valid discount code to create a confirmed booking stored with a negative total...

PT-2026-117200

A vulnerability is in Web Server default connection ports under the process name GeoWebServer.exe...

PT-2026-117199

A vulnerability is in Web Server default connection ports under the process name GeoWebServer.exe...

PT-2026-117512

Name of the Vulnerable Software and Affected Versions IBM MQ affected versions not specified Description A stack buffer overflow occurs during channel connection establishment when processing TLS certificates containing malformed distinguished names. This flaw allows a remote attacker to execute...

PT-2026-117516

IBM MQ 9.4.5.0 through 9.4.5.1 could allow an authenticated user to cause a denial of service by sending a specially crafted message that crashes consuming applications...

PT-2026-117544

IBM Cloud Pak System 2.3.6.0, and 2.3.6.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information...

PT-2026-117329

Name of the Vulnerable Software and Affected Versions Apache Camel versions 4.0.0 through 4.18.4 Apache Camel versions 4.19.0 through 4.22.0 Description Apache Camel HTTP, Netty HTTP, Undertow, and Vert.x HTTP components contain an issue where inbound messages can override the endpoint URI using...

PT-2026-117555

Asymmetric resource consumption amplification in .NET allows an unauthorized attacker to deny service over a network...

PT-2026-117559

Asymmetric resource consumption amplification in .NET allows an unauthorized attacker to deny service over a network...

PT-2026-117553

Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network...

PT-2026-117557

Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network...

PT-2026-117245

A security vulnerability has been detected in Dav-ee dairy-management-system 31ace9692d1e1e6d64339a42c463b361319c615c/f31a584c3330c013b61f8b0306d9e0849c6d693d. This vulnerability affects the function mysqli query of the file employees/delete.php. The manipulation of the argument e payroll no lead...

PT-2026-117474

Name of the Vulnerable Software and Affected Versions Netskope Client versions prior to R142 Description A gap in the NSClient agent occurs when a system connects to an access point with a Captive Portal and then switches to a network that already has internet connectivity, causing the Captive...

PT-2026-117693

A weakness has been identified in H3C Magic NX15 V100R017. This affects the function importprofile of the file /api/upload. This manipulation of the argument fileName causes path traversal. It is possible to initiate the attack remotely. The exploit has been made available to the public and could...

PT-2026-117535

A segmentation violation in the dump isom saps function /mp4box/filedump.c of GPAC MP4Box v2.5-DEV-rev1672-gc9a31d0e1-masterallows attackers to cause a Denial of Service DoS via supplying a crafted MP4 file...

PT-2026-117486

Name of the Vulnerable Software and Affected Versions WSO2 Identity Server affected versions not specified Description An authorization flaw exists in the SCIM 2.0 and SCIM 1.1 endpoints where the system fails to sufficiently validate authorization for federated users interacting with the local...

PT-2026-117658

Name of the Vulnerable Software and Affected Versions Pillow versions 9.2.0 through 12.x Description A denial of service issue exists where the library can retain a rejected GIF frame size after a decompression-bomb exception is raised. In the GifImageFile. seek function, a specially crafted GIF...

PT-2026-117331

Name of the Vulnerable Software and Affected Versions Apache Camel versions 4.0.0 through 4.18.4 Apache Camel versions 4.19.0 through 4.22.0 Description A path traversal issue exists in the Apache Camel FTP component affecting ftp, ftps, and sftp schemes. The remote-file consumers build absolute...

PT-2026-117332

Name of the Vulnerable Software and Affected Versions Apache Camel versions 4.18.0 through 4.18.4 Apache Camel versions 4.19.0 through 4.22.0 Description A path traversal issue exists in the Apache Camel Mina SFTP component. Remote-file consumers build absolute remote paths by concatenating a...

PT-2026-117337

Name of the Vulnerable Software and Affected Versions Apache Camel versions 4.0.0 through 4.18.4 Apache Camel versions 4.19.0 through 4.22.0 Description An improper limitation of a pathname to a restricted directory, known as Path Traversal, exists in the Apache Camel Azure Files component. The...

PT-2026-117472

Name of the Vulnerable Software and Affected Versions Picomatch versions prior to 4.0.8 Description A regular expression denial of service ReDoS occurs when parsing single-branch repeated extglob patterns, such as + or +a. The analyzeRepeatedExtglob function in lib/parse.js fails to handle these...

PT-2026-117540

Name of the Vulnerable Software and Affected Versions markdown-it versions prior to 14.3.2 markdown-it versions prior to 15.0.2 Description When the typographer option is set to true, specially crafted Markdown input can trigger quadratic processing time within the smartquotes rule. This occurs...

PT-2026-117634

Name of the Vulnerable Software and Affected Versions markdown-it versions prior to 14.3.3 markdown-it versions prior to 15.0.3 Description When the html option or commonmark preset is enabled, the parser can be forced into quadratic processing time when encountering repeated unterminated inline...

PT-2026-117318

Exposure of sensitive information through data queries vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. An improper authorization check in the similar-question search allowed authenticated users to view metadata of non-public questions. Users are recommended to...

PT-2026-118063

Vikunja: Unbounded nested task-filter recursion permits API process termination in code.vikunja.io/api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...

PT-2026-117569

Cognition before 0.13.0 contains an unauthenticated remote code execution vulnerability due to defaulting its agent sandbox backend to local execution and shipping no authentication on its REST/SSE API. Attackers can create a session via POST /sessions and post a message via POST...

PT-2026-117302

Deserialization of Untrusted Data vulnerability in ExpressTech Quiz And Survey Master quiz-master-next allows Object Injection.This issue affects Quiz And Survey Master: from n/a through 11.2.7...

PT-2026-117473

Name of the Vulnerable Software and Affected Versions MongoDB PHP driver affected versions not specified Description An uncontrolled recursion weakness exists in the BSON decoding logic. An unauthenticated party can supply crafted binary document data to the decoder to exhaust the process stack...

PT-2026-117645

Name of the Vulnerable Software and Affected Versions Pillow versions 7.2.0 through 12.11.0 Description A flaw exists when processing MIC images, where the library can enter an infinite loop while determining the frame count. This occurs because MicImageFile inherits TIFF frame traversal, but...

PT-2026-117653

Name of the Vulnerable Software and Affected Versions Pillow versions prior to 13.0.0 Description Rank-based filters in the Pillow Python imaging library can dereference invalid image storage when processing a zero-size image. The ImagingExpand function allocates a non-empty output but faults...

PT-2026-117654

Name of the Vulnerable Software and Affected Versions Pillow versions 11.3.0 through 12.x Description A heap use-after-free occurs when libtiff rejects a tag while encoding TIFF data to an in-memory buffer. This happens when an application saves attacker-influenced TIFF tags to BytesIO, causing...

PT-2026-117656

Name of the Vulnerable Software and Affected Versions Pillow versions prior to 13.0.0 Description The FlashPix JPEG-tile decoder in the Pillow imaging library contains a flaw where decoded scanlines can be written beyond the allocated tile buffer. This occurs because FlashPix FPX JPEG decoding...

PT-2026-117660

Name of the Vulnerable Software and Affected Versions Pillow versions prior to 13.0.0 Description A double free of image memory can occur when the ImagingScaleAffine function encounters a selective allocation failure. This happens during the fast path processing of Transform.EXTENT or pure...

PT-2026-117670

Name of the Vulnerable Software and Affected Versions Pillow versions 8.1.0 through 12.x Description Pillow contains an out-of-bounds read issue when decoding certain malformed compressed TIFF files. The problem occurs in the decodeTile and decodeAsRGBA functions within src/libImaging/TiffDecode....

PT-2026-117676

Name of the Vulnerable Software and Affected Versions Pillow versions 5.1.0 through 12.11.0 Description When saving many frames with save all enabled, the library takes quadratic time to reserve PDF object identifiers. This occurs because the PdfParser.next object id function repeatedly rebuilds...

PT-2026-117683

Name of the Vulnerable Software and Affected Versions Pillow versions prior to 13.0.0 Description The TIFF encoder in Pillow can perform an out-of-bounds read when processing images with retained TIFF metadata where the plane size is inconsistent with BitsPerSample. An attacker can provide a...

PT-2026-118043

Vikunja: Saved filter creation with an empty filter string recalculates task positions across all tenants in code.vikunja.io/api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing...

PT-2026-117520

Name of the Vulnerable Software and Affected Versions AIOHTTP versions prior to 3.14.4 Description The pure Python parser in this asynchronous HTTP client/server framework accepts ambiguous HTTP request framing. This allows an unauthenticated attacker to perform request smuggling when an...

PT-2026-117619

Parse Server before 8.6.99 and 9.0.0 before 9.10.3-alpha.2 evaluates checks against the target account during a user update before authorizing the caller, and reflects their outcome in the response. An unauthorized caller, with or without a session, can confirm guessed usernames or emails and, wh...

PT-2026-117434

Intelligence Community UI Kit @ukic/canary-web-components 3.0.0-canary.12 before 3.0.0-canary.48 contains a DOM-based cross-site scripting vulnerability in ic-tree-item that re-parses router-item slot text as HTML. When tree item truncation is enabled, attackers who influence a tree item label ca...

PT-2026-118007

Excelize: Unbounded row number in Rows.Columns makes GetRows and the Rows iterator loop for days in github.com/xuri/excelize...

PT-2026-117585

A vulnerability was detected in grandnode grandnode2 up to 2.3.0. Affected is the function Html.Raw of the file src/Web/Grand.Web/Views/Product/Product.Layout.Simple.cshtml of the component Product Description Handler. The manipulation results in cross site scripting. The attack can be launched...

PT-2026-117388

A vulnerability was identified in satya-vinay Events-Management-System up to 437c77ceb69bf9fe2e3f4f46f7871b83f425383a. Affected by this vulnerability is an unknown functionality of the file dodelete.php of the component Registration-Delete Handler. Such manipulation of the argument ID leads to sq...

PT-2026-118056

Vikunja: Link-share token can enumerate users through the v2 API in code.vikunja.io/api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability...

PT-2026-118013

Coraza: Multipart filename RFC 5987 charset restriction lets a decoy filename bypass FILES-based rules in github.com/corazawaf/coraza...

PT-2026-117270

MISP contains an access control flaw in the proposal shadow attribute visibility logic. The authorization check accepted any attribute or object carrying one of the user's sharing groups without verifying the distribution level, and denied the owning organisation access to proposals on its own...

PT-2026-117211

在 openGauss-server 的 src/gausskernel/cbb/utils/hll/hll.cpp 中，内置函数 HllObjectUnpack 存在长度校验缺陷。该函数从用户提供的 packed HLL 解析 lenUsed 与 lenTotal 后，仅检查输入长度足以覆盖 HLL HEAD SIZE + lenUsed，随后按 lenTotal 分配缓冲区、按 lenUsed 调用 memcpy s 拷贝输入，既未校验 lenTotal = lenUsed，也将 memcpy s 目标大小写成 lenUsed 而非实际分配的...