200310 matches found
PT-2026-76431
These are all security issues fixed in the jetty-annotations-9.4.58-5.1 package on the GA media of openSUSE Tumbleweed...
PT-2026-71552
Subscriber Sensitive Data Exposure in WPJAM Basic = 7.0.2.1 versions...
PT-2026-71735
TypeORM is a TypeScript and JavaScript ORM for Node.js that supports PostgreSQL, MySQL, MariaDB, SQLite, SQL Server, Oracle, and other databases. Prior to versions 0.3.31 and 1.1.0, typeorm migration:generate embeds database schema metadata into JavaScript or TypeScript template literals in...
PT-2026-71694
Name of the Vulnerable Software and Affected Versions Data::MuForm::Localizer versions prior to 0.06 Description Remote code execution is possible because the load lexicon function interpolates the language attribute into the catalog filename without validating that it is a bare locale tag. An...
PT-2026-71789
Elasticsearch does not apply its configurable input length restriction to a user-supplied pattern accepted by an intervals query. Compiling a deeply nested pattern drives unbounded recursion that exhausts the thread stack and raises a fatal error, terminating the Elasticsearch node process and...
PT-2026-71779
The state that Kibana stores for an Observability Onboarding flow is not bound to the user who created the flow, and the routes that read and update that state do not verify ownership. An authenticated user who holds only generic read access to the space can therefore discover the onboarding flow...
PT-2026-71837
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to improper processing of DRDA and DDM resynchronization requests...
PT-2026-71852
IBM Documentation Offline 1.0.0 through 1.4.1 could allow a remote attacker to execute arbitrary code due to improper control of file paths...
PT-2026-71522
Customer Arbitrary Content Deletion in WP Event SOlution = 4.1.19 versions...
PT-2026-71454
JupyterLab versions =4.6.0,=4.6.1 and =4.5.9 contain an allowlist/blocklist enforcement gap in PyPIExtensionManager.install. A missing 'await' caused the is install allowed coroutine to never execute, so the extension allowlist/blocklist check was not enforced for direct callers of install. The...
PT-2026-71401
The Link Factory WordPress plugin is a backdoor. Distributed as a "homepage sentence publisher", it exposes an operator-controlled REST API under /wp-json/link-factory/v1/ - authenticated by a detached Ed25519 signature verified against a hardcoded operator public key except for the health check...
PT-2026-71794
A flaw in Elasticsearch allows a low-privileged authenticated user who can index documents to submit a single small document containing a crafted user-supplied input. Processing one such document occupies a worker thread from a bounded pool for a disproportionate amount of time, degrading the...
PT-2026-71877
dua-cli fails to filter terminal escape sequences when printing marked file paths after exiting the TUI interface. Attackers can craft file names containing OSC/CSI escape sequences that are interpreted by the terminal emulator when printed, enabling title spoofing, clipboard manipulation, or oth...
PT-2026-71700
Email Management API Bypasses ManageCredentials Feature Restrictions...
PT-2026-71545
Unauthenticated Cross Site Scripting XSS in Agrion = 1.0.0 versions...
PT-2026-71416
CWE-306: Missing Authentication for Critical Function...
PT-2026-71538
Unauthenticated Privilege Escalation in miniorange otp verification = 5.5.1 versions...
PT-2026-71648
A malformed Bluetooth connection request message can cause the BT122 to leak potentially sensitive information. See vulnerability B-E4 in the related paper below...
PT-2026-71917
jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From 4.5.0 until 4.5.10 and 4.6.2, in jupyterlab/extensions/manager.py and jupyterlab/extensions/pypi.py, JupyterLab's PyPI extension manager enforces blocked extensions...
PT-2026-71642
During an internal security assessment, a potential vulnerability was discovered in Lenovo Accessories and Display Manager for Enterprise for Windows that could allow a local authenticated user to execute arbitrary code with elevated privileges...
PT-2026-71577
Unauthenticated SQL Injection in Everest Backup = 2.3.12 versions...
PT-2026-71775
Missing Authorization CWE-862 in Kibana can lead to unauthorized execution of Elastic Defend response actions on managed hosts via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. A Kibana user who holds only detection rule authoring privileges for the Elastic Security solution c...
PT-2026-71485
Name of the Vulnerable Software and Affected Versions PostgreSQL versions prior to 18.5 PostgreSQL versions prior to 17.11 PostgreSQL versions prior to 16.15 PostgreSQL versions prior to 15.19 PostgreSQL versions prior to 14.24 Description A heap buffer overflow occurs in the pg dump utility when...
PT-2026-71510
Unauthenticated Broken Authentication in OAuth Single Sign On – SSO OAuth Client = 7.0.0 versions...
PT-2026-71616
In the Linux kernel, the following vulnerability has been resolved: KVM: s390: pci: Fix handling of AIF enable without AISB When a guest seeks to register IRQs without a summary bit specified, ensure that the associated GAITE then stores 0 for the guest AISB location instead of virt to physpage...
PT-2026-71428
Flowise versions before 3.1.3 contain an insecure direct object reference vulnerability in the GET /api/v1/organization/customer-default-source endpoint that allows authenticated attackers to access other customers' payment and profile data by manipulating the customerId parameter. Attackers can...
PT-2026-76573
Name of the Vulnerable Software and Affected Versions Etherpad versions 2.1.0 through 3.0.0 Description Etherpad fails to properly sanitize the x-proxy-path request header, leading to two distinct issues when client-supplied headers reach the server. First, in src/node/hooks/express/admin.ts, the...
PT-2026-71504
Unauthenticated Remote Code Execution RCE in QA Analytics = 5.2.0.0 versions...
PT-2026-71539
Unauthenticated SQL Injection in Listdom = 5.6.0 versions...
PT-2026-71601
Administrator SQL Injection in MailChimp For WooCommerce 6.2 versions...
PT-2026-71523
Customer Sensitive Data Exposure in WP Event SOlution = 4.1.18 versions...
PT-2026-71443
Network-AI versions before 5.15.1 contain a security matcher bypass vulnerability where SandboxPolicy evaluates raw command strings with quotes preserved while the executor tokenizes commands by stripping quotes before execution. Attackers can craft quoted commands that evade blocklist checks and...
PT-2026-71392
The Booking for Appointments and Events Calendar WordPress plugin before 2.4.6 does not verify that an authenticated employee provider is assigned to the appointment being accessed, allowing any employee to read any appointment by its identifier and disclose the booked customer's personal data...
PT-2026-71532
Unauthenticated Broken Access Control in Hydra Booking = 1.2.2 versions...
PT-2026-71914
Budibase is an open-source low-code platform. Prior to 3.39.25, GET /api/users/metadata and GET /api/users/metadata/:id returned user objects processed by packages/server/src/utilities/global.ts without removing oauth2.accessToken or oauth2.refreshToken. A user with the POWER role could retrieve...
PT-2026-71554
Unauthenticated Broken Access Control in MultiVendorX = 5.0.10 versions...
PT-2026-73141
CVE-2026-3883 - Rejected reason: This CVE ID has been rejected or CVE ID :CVE-2026-3883 Published : Aug. 13, 2026, 11:17 p.m. | 25 minutes ago Description :Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. Severity: 0.0 | NA Visit the link for more detail...
PT-2026-71883
FreePBX is an open source IP PBX. From 17.0.1 until 17.0.7, the FreePBX Music on Hold module permits dangerous command-line options for /usr/bin/mpg123 and other allowed players in validateCustomConfiguration in Music.class.php. An authenticated administrator can use options that write files, ope...
PT-2026-76428
These are all security issues fixed in the 7zip-26.02-2.1 package on the GA media of openSUSE Tumbleweed...
PT-2026-71809
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service and potentially obtain sensitive information due to a stack-based buffer overflow...
PT-2026-76434
These are all security issues fixed in the pgadmin4-9.17-1.1 package on the GA media of openSUSE Tumbleweed...
PT-2026-71710
Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Prior to 6.13.10, 7.8.10, 8.24.1, and 9.7.2, passing a user-controlled update such as MyModel.updateOnefilter, req.body can exploit Mongoose update casting with a proto .x dotted path under $set...
PT-2026-71393
The WP Helper Premium WordPress plugin before 4.7.6 does not verify the order key when rendering its custom order confirmation page or when handling the related AJAX actions, allowing unauthenticated users to view other customers' order details, including personal information, as well as change t...
PT-2026-71902
filebrowser through 2.63.16 fails to properly restrict scope and permissions when self-signup is enabled with default CreateUserDir setting. Unauthenticated attackers can register accounts that inherit the server root scope with full create, modify, delete, rename, share, and download permissions...
PT-2026-71894
Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description Stack exhaustion can occur during the parsing of deeply-nested, recursive structures due to the lack of a recursion limit in the Unmarshal function...
PT-2026-71658
rsync 3.0.0 before 3.5.0 contains an out-of-bounds write vulnerability that allows attackers to corrupt memory by triggering HLINK BUMP processing on file entries with the FLAG HLINKED flag set while the hard-link preservation option is inactive. Attackers can exploit the missing F SUM field in t...
PT-2026-71600
Author Cross Site Scripting XSS in WP Data Access = 5.5.79 versions...
PT-2026-71572
Unauthenticated Broken Access Control in StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart = 2.1.1 versions...