PT-2026-117371

A vulnerability has been found in subhajitkhan online-clinic-management-system up to e9ee77a8827a1446220fa07ee693dc4d9a29a578. This affects an unknown function of the file admindocview.php of the component Administrative Mutation Handler. The manipulation of the argument docid leads to sql...

PT-2026-117644

A weakness has been identified in kiwilan php-archive up to 2.3.02. This affects the function ArchiveZip::extract of the file src/Readers/ArchiveZip.php of the component Extraction. This manipulation causes path traversal. The attack is possible to be carried out remotely. The exploit has been ma...

PT-2026-117546

IBM Cloud Pak System 2.3.6.0, and 2.3.6.1 is vulnerable to HTML injection. A remotely authenticated attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site...

PT-2026-117320

vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. Missing authorization checks allowed authenticated users to perform actions on non-public content they were not permitted to access. Users are recommended to upgrade to version 2.0.3, which fixes the issue...

PT-2026-117661

Name of the Vulnerable Software and Affected Versions MLflow versions prior to 3.17.2 Description The FileStore tracking backend contains a path traversal issue. Unauthenticated attackers can control filesystem paths by submitting a crafted trace ID containing traversal sequences to the 'POST...

PT-2026-117569

Cognition before 0.13.0 contains an unauthenticated remote code execution vulnerability due to defaulting its agent sandbox backend to local execution and shipping no authentication on its REST/SSE API. Attackers can create a session via POST /sessions and post a message via POST...

PT-2026-117317

vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. Unauthenticated attackers could access comments associated with non-public content through public user profiles. Users are recommended to upgrade to version 2.0.3, which fixes the issue...

PT-2026-122236

Name of the Vulnerable Software and Affected Versions Wasmtime versions prior to 36.0.19 Wasmtime versions prior to 43.0.0 Description The Cranelift compiler backend bit-packs SSA Static Single Assignment value indices in a manner that can silently overflow in release builds. This occurs when...

PT-2026-117307

MISP contains a reflected cross-site scripting XSS vulnerability in the workflow module interface. Parameter names returned by the misp-modules service are rendered as raw HTML form labels on the workflow module page without output encoding. An attacker who can influence the parameter names...

PT-2026-117419

Netpbm through 11.16.00 contains a heap out-of-bounds write vulnerability in the rasttopnm Sun rasterfile run-length decoder pr load image in converter/other/rast.c. Attackers can supply a byte-encoded rasterfile with tiny dimensions and a long run-length body to write controlled bytes past md...

PT-2026-117667

A security vulnerability has been detected in Netis EAP930 1.250905.115454. This issue affects the function return200 of the file /cgi-bin/debug of the component CGI Endpoint. The manipulation of the argument SIGNATURE leads to backdoor. The attack may be initiated remotely. A high degree of...

PT-2026-117656

Name of the Vulnerable Software and Affected Versions Pillow versions prior to 13.0.0 Description The FlashPix JPEG-tile decoder in the Pillow imaging library contains a flaw where decoded scanlines can be written beyond the allocated tile buffer. This occurs because FlashPix FPX JPEG decoding...

PT-2026-117649

Name of the Vulnerable Software and Affected Versions Pillow versions 8.2.0 through 12.x.x Description The tiled-TIFF decoder in the libImaging module contains a memory corruption issue. When processing tiled TIFF images, the decodeTile function allocates a buffer based on the tile size reported ...

PT-2026-117628

Craft CMS 4.x before 4.18.8 and 5.x before 5.11.0 contains a blocklist bypass in the Twig create function because its class-name checks are case-sensitive while PHP class resolution is not. Attackers with template-execution rights, such as Control Panel administrators, can instantiate SplFileObje...

PT-2026-117683

Name of the Vulnerable Software and Affected Versions Pillow versions prior to 13.0.0 Description The TIFF encoder in Pillow can perform an out-of-bounds read when processing images with retained TIFF metadata where the plane size is inconsistent with BitsPerSample. An attacker can provide a...

PT-2026-122238

Name of the Vulnerable Software and Affected Versions Wasmtime versions prior to 36.0.19 Wasmtime versions prior to 48.0.7 Wasmtime versions prior to 49.0.4 Description The Cranelift compiler backend on aarch64 architectures can incorrectly compile a Wasm br table instruction when it contains mor...

PT-2026-117653

Name of the Vulnerable Software and Affected Versions Pillow versions prior to 13.0.0 Description Rank-based filters in the Pillow Python imaging library can dereference invalid image storage when processing a zero-size image. The ImagingExpand function allocates a non-empty output but faults...

PT-2026-117528

IBM Concert 1.0 through 3.0.0 allows web page cache to be stored locally which can be read by another user on the system...

PT-2026-117479

Name of the Vulnerable Software and Affected Versions FOSSBilling versions 0.1.0 through 0.8.6 Description The unauthenticated endpoint "/api/guest/client/create" reveals whether a submitted email belongs to a registered client. This occurs because the guest signup process returns a distinct,...

PT-2026-117486

Name of the Vulnerable Software and Affected Versions WSO2 Identity Server affected versions not specified Description An authorization flaw exists in the SCIM 2.0 and SCIM 1.1 endpoints where the system fails to sufficiently validate authorization for federated users interacting with the local...

PT-2026-118072

Nginx UI: MCP configuration tools bypass restricted directive validation and allow secondary authenticated users to execute NJS in Nginx worker context in github.com/0xJacky/Nginx-UI...

PT-2026-117692

Name of the Vulnerable Software and Affected Versions H3C Magic NX15 version NX15V100R017 Description A remote code injection issue exists within the RPC Interface component. The problem occurs in the write function of the '/api/esps' endpoint, where manipulating the path argument allows an...

PT-2026-117534

A use-after-free in the gf filter pid get packet function filter core/filter pid.c of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service DoS via supplying a crafted file...

PT-2026-117506

IBM MQ could allow an authenticated attacker to cause a limited denial of service and obtain very limited information about process memory layout due to an out-of-bounds read when processing a specially crafted client request...

PT-2026-117575

Name of the Vulnerable Software and Affected Versions Cpanel::JSON::XS versions 4.28 through 4.79 Description A memory leak occurs when decoding JSON with duplicate keys while using the dupkeys as arrayref option in the decode hv function. In this scenario, values for duplicate object keys are...

PT-2026-117582

Name of the Vulnerable Software and Affected Versions Cpanel::JSON::XS versions prior to 4.80 Description An issue exists in the decode hv function where freed filter callbacks are used when a filter removes itself during the decoding process. The decode process copies the filter json object and...

PT-2026-117401

Frappe Helpdesk before 1.26.0 contains an authorization bypass vulnerability that allows authenticated portal users to create tickets impersonating other customers by supplying a raised by value. Attackers can call the hd ticket.api.new endpoint with a victim's email to plant phishing tickets in...

PT-2026-117333

Name of the Vulnerable Software and Affected Versions Apache Camel versions 4.2.0 through 4.18.4 Apache Camel versions 4.19.0 through 4.22.0 Description A path traversal issue exists in the Apache Camel SMB component. The remote-file consumers build absolute remote paths by concatenating a...

PT-2026-117358

Improper Authentication vulnerability in Apache Camel Keycloak component. This issue affects Apache Camel: from 4.15.0 before 4.18.5, from 4.19.0 before 4.22.1. The security processor validated the issuer of an introspected token only when the introspection response actually carried an iss claim...

PT-2026-117623

Craft CMS from 5.0.0 before 5.11.0 contains a remote code execution vulnerability that allows authenticated Control Panel users to escape the Twig sandbox via Asset::getMimeType transforms. Attackers can supply 'as' or 'on' keys passed unfiltered to Craft::createObject, attaching malicious...

PT-2026-117586

🚨 Dell Wyse Management Suite XSS Flaws CVE-2026-82158 to CVE-2026-82161 Fixed in 2609.0.0.155 Critical Vulnerability Alert! Dell Wyse Management Suite is affected by CVE-2026-82158. 🔍 Identify Targets via ZoomEye: Search Dork: title="Wyse Management Suite" Exposure: 767 instances identified...

PT-2026-118263

CVE-2026-108519 - Rejected reason: This CVE ID has been rejected or CVE ID :CVE-2026-108519 Published : Oct. 18, 2026, 11:16 p.m. | 2 hours, 13 minutes ago Description :Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. Severity: 0.0 | NA Visit the link fo...

PT-2026-117532

IBM Cloud Pak System 2.3.6.0, and 2.3.6.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session...

PT-2026-117265

在 openGauss-server 的 src/common/backend/libpq/hba.cpp 中，复制连接认证存在访问控制绕过。hba getauthmethod 在处理 HADR/SW 复制发送方时，不要求 is node internal connection，直接调用 check hba replication。check hba replication 仅按 replication 标记做弱匹配，缺少普通 check hba 中的远程 trust 禁止等完整校验。因此，非内部网络的 HADR/SW 复制连接可绕过内部连接限制和完整 pg hba...

PT-2026-117641

Plack::Middleware::ETag versions from 0.04 before 0.06 for Perl disclose file inode numbers in the default ETag header. When the response body is a filehandle and the file etag option is not set, the ETag is built from the file's inode number, modification time and size. Clients receiving affecte...

PT-2026-120338

Affected versions include emSign ECC Root CA - G3, which can allow certificate paths through distrusted emSign intermediates. Affected versions may accept certificate paths containing distrusted emSign intermediate public keys. The private keys corresponding to these intermediates are now well...

PT-2026-117643

A security flaw has been discovered in orbitale imagemagick-php up to 3.3.5. Affected by this issue is the function Command::font of the file src/Command.php. The manipulation of the argument fontFile results in os command injection. The attack can be executed remotely. The exploit has been...

PT-2026-117690

Name of the Vulnerable Software and Affected Versions IBM Storage TS4500 Library versions 1.1.1.6 through 1.12.0.3 Description The system fails to invalidate the session after a user logs out. This flaw allows an authenticated user to impersonate another user on the system. Recommendations Update...

PT-2026-118052

Vikunja: Read-only project members can obtain any link share's access hash via the single-share read endpoint v1 and v2 and escalate to the share's permission level in code.vikunja.io/api. NOTE: The source advisory for this report contains additional versions that could not be automatically mappe...

PT-2026-117639

Dell Application Store, versions prior to 26.05.0.7, contain a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker with adjacent network access could potentially exploit this vulnerability, leading to arbitrary code execution...

PT-2026-116915

In the Linux kernel, the following vulnerability has been resolved: USB: serial: fix driver deregistration order USB serial driver modules register one driver for the USB bus and one or more drivers for the ports on the USB serial bus. When unloading a driver module, the USB driver must be...

PT-2026-117063

In the Linux kernel, the following vulnerability has been resolved: netfs: clear post-EOF pagecache when extending a file via write Fix netfs to erase the contents of a hole created after the EOF by an ordinary write if dirty data has been previously left there by writes through an mmapped region...

PT-2026-116995

In the Linux kernel, the following vulnerability has been resolved: binderfs: fix UAF write in binder add device binderfs binder device create publishes the new dentry with d make persistent and then calls simple done creating, which drops the parent directory lock and the creator's dentry...

PT-2026-117146

The Gitea OpenID association callback in the security settings accepted a positive OpenID 2.0 assertion without checking that the signed-in user had started the linking. Because OpenID 2.0 allows unsolicited assertions, an attacker-controlled OpenID provider could attach the attacker's identity t...

PT-2026-116839

In the Linux kernel, the following vulnerability has been resolved: net: ethernet: mtk eth soc: unregister net devices in case of probe failure If register netdev fails for one of the MTK MAX DEVS devices in mtk probe, the error path jumps to err deinit ppe, skipping mtk unreg dev. The previously...

PT-2026-117000

In the Linux kernel, the following vulnerability has been resolved: drm/mediatek: Fix pdev reference leak in mtk drm bind When the device is not the mmsys master, mtk drm bind returns early after taking a reference on the disp-mutex device via of find device by node, without ever dropping it: mtk...

PT-2026-117148

The Gitea Actions artifact v4 Twirp handlers read the whole request body into memory without a size limit. A user who can run a workflow and obtains the runner token of that run could send an oversized request to the artifact service and exhaust the memory of the server, which terminates the Gite...

PT-2026-117149

POST /owner/repo/topics was registered without the sign-in middleware that provides the cross-origin protection, so a request issued by a third-party site was not rejected. A repository administrator who visited a malicious page could have the topics of their repository changed. No other reposito...

PT-2026-117062

In the Linux kernel, the following vulnerability has been resolved: netfs: zero gaps in read-gaps folio to avoid writing back stale data netfs read gaps leaves gaps around a streaming write's dirty region unread on the server side, so a short/EOF response there left stale folio content that later...

PT-2026-117072

In the Linux kernel, the following vulnerability has been resolved: net: gso: limit recursive IP-in-IP segmentation IP-in-IP GSO can re-enter inet gso segment or ipv6 gso segment for each nested IP header. encap level tracks header bytes, not callback depth, so a deep chain can exhaust the kernel...