PT-2026-71220

ScadaLTS 2.7.8.1 exposes a server-side method that lacks authorization checks, allowing any authenticated user including one holding only low-privilege, read-only permissions to execute arbitrary operating system commands on the host. Successful exploitation results in code execution in the conte...

PT-2026-71112

A user with access to a valid SAML response may impersonate another user under specific conditions...

PT-2026-71025

The WooCommerce Subscriptions WordPress plugin before 9.1.0 does not validate user input before unserializing it on stores with High-Performance Order Storage enabled, leading to a PHP Object Injection issue which unauthenticated users can escalate to Remote Code Execution via a gadget chain...

PT-2026-71356

Name of the Vulnerable Software and Affected Versions etcd versions prior to 3.5.33 etcd versions prior to 3.6.14 etcd versions prior to 3.7.1 Description A network attacker capable of reaching an etcd TLS listener can initiate numerous TCP connections without sending a ClientHello. Within the fi...

PT-2026-71201

Budibase is an open-source low-code platform. Prior to 3.40.0, the MySQL integration component in Budibase is configured with multipleStatements: true, enabling execution of multiple SQL statements in a single query. Attackers can inject malicious SQL commands through user input fields, leading t...

PT-2026-71292

Shescape is a simple shell escape library for JavaScript. Prior to 2.1.14 and 3.0.1, getEscapeFunction in src/internal/win/cmd.js does not escape and when applications use the escape or escapeAll APIs on Windows with shell set to cmd.exe, or with shell set to true when CMD is the default. An...

PT-2026-71364

Name of the Vulnerable Software and Affected Versions OpenStack Designate versions prior to 22.0.2 Description The mDNS handler performs pool-blind lookups when resolving record queries and NOTIFY requests. If two zones with the same name exist across different pools, the lookup fails, leading th...

PT-2026-71277

An out-of-bounds write issue in the Base64 decoder in Amazon aws-sdk-cpp before 1.11.862 might allow a remote authenticated user to cause a crash or heap memory corruption in an application that processes crafted Base64-encoded input. To remediate this issue, users should upgrade to version...

PT-2026-71362

The web interface of the affected device relies on the HTTP referrer header as part of request validation. Requests containing empty Referer value, or omitting the Referer header entirely, may be accepted and processed due to insufficient validation logic. Successful exploitation may allow an...

PT-2026-75937

Summary An authenticated SQL LIKE wildcard injection vulnerability in phpMyFAQ’s chat user search allows any logged-in user to bypass the intended display-name search filter and enumerate active users. The endpoint escapes SQL string syntax but does not escape % and , which remain active LIKE...

PT-2026-71340

Astro is a web framework for content-driven websites. Prior to 8.1.2, the Astro Netlify adapter converts each image.remotePatterns entry into a regular expression written to .netlify/v1/config.json under images.remote images for Netlify's Image CDN allowlist. In...

PT-2026-71068

CPSD CryptoPro Secure Disk for Bitlocker before v7.7.4 stores TPM2.0 secrets in a serialized format within unused disk sectors. An unauthenticated attacker with physical access to the system disk can recover this information and craft an environment to unseal the TPM...

PT-2026-71335

vinny/views.py: ModifyEmailNotifications IDOR: view fetches VinceCommEmail by raw pk from URL and toggles email function/name without checking the record's contact belongs to the requesting group-admin. Lets a vendor admin flip notification routing or read email/name for another vendor's contact...

PT-2026-71174

Pingvin Share X is a secure and easy self-hosted file sharing platform. A vulnerability in versions 1.5.0 through 1.18.0 allow an attacker to bypass password verification when managing Time-based One-Time Password TOTP settings. The root cause is a missing await keyword on calls to the asynchrono...

PT-2026-71171

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote unauthenticated attacker to harvest credentials due to spoofing of Navigator for i...

PT-2026-71085

Prowler is a cloud security platform. Prior to 5.33.1, an authenticated user with Lighthouse provider configuration access could supply an unvalidated base url for the openai compatible provider through POST /api/v1/lighthouse/providers and POST /api/v1/lighthouse/providers/id/connection, causing...

PT-2026-71312

The MongoDB BI Connector ODBC Driver converts floating point column values into text without checking that the result fits within the destination buffer. When an application reads a sufficiently large floating point value as text, the driver may write beyond the end of that buffer and corrupt...

PT-2026-71001

Name of the Vulnerable Software and Affected Versions KiviCare WordPress plugin versions prior to 4.5.2 Description An issue exists where the software fails to verify if the requesting user owns the records they are attempting to access. This allows authenticated users with patient-level privileg...

PT-2026-71119

In WhatsUp Gold versions released before 2026.0.2, an improper authorization vulnerability in the Scheduled Reports API allows any authenticated user to invoke restricted actions...

PT-2026-71359

A flaw was found in acm-search-v2-rhel9. An attacker with administrative privileges on the hub cluster, specifically with patch access to the Search Custom Resource CR, could exploit a vulnerability in the Collector.ImageOverride field. This allows the attacker to deploy an arbitrary container...

PT-2026-71315

An application using the MongoDB BI Connector ODBC Driver may experience a memory-safety issue when processing output parameters from a stored procedure. Triggering this issue requires connecting to an untrusted or impersonated database server that returns crafted metadata. This may result in...

PT-2026-71075

Name of the Vulnerable Software and Affected Versions CryptoPro Secure Disk for Bitlocker versions prior to 7.7.4 Description The bootxsa.efi component fails to properly validate LUKS Linux Unified Key Setup encryption. When encryption is detected, the system skips all CryptoPro file integrity...

PT-2026-70962

A vulnerability was identified in Open5GS up to 2.7.1. This issue affects the function pcrf rx aar cb of the file src/pcrf/pcrf-rx-path.c of the component Diameter Rx Handler. The manipulation of the argument num of media component/num of sub leads to buffer overflow. The attack can be initiated...

PT-2026-71251

SiYuan versions = v3.7.2 patched in v3.7.4 contain an authentication bypass vulnerability in the kernel's CheckAuth function, which grants the administrator role RoleAdministrator to any request whose RemoteAddr is loopback 127.0.0.1 for a specific set of endpoints including /api/system/exit,...

PT-2026-72135

Уязвимость движка Microsoft Malware Protection Engine Защитника Microsoft Windows Defender операционных систем Windows связана с ошибками синхронизации при использовании общего ресурса. Эксплуатация уязвимости может позволить нарушителю раскрыть защищаемую информацию и получить полный контроль на...

PT-2026-71213

GitLab has remediated an issue in GitLab EE affecting all versions from 15.6 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed a user with a pending membership to receive permissions granted by a custom role, due to incorrect privilege...

PT-2026-71013

The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.17.1 does not validate one of its Podcast Episode URL settings before performing a server-side request with it, allowing users with a role as low as Contributor to perform Server-Side Request Forgery attacks that can target...

PT-2026-71225

An authorization bypass vulnerability in LXD allows an authenticated user to bypass project-level disk and volume limits. Two related code paths fail to verify resource limits during volume operations: the storagePoolVolumeTypePostMove function omits the limits.AllowVolumeCreation check before...

PT-2026-71131

Name of the Vulnerable Software and Affected Versions Apache Airflow versions prior to 3.3.1 Description Sensitive data, including Variable values and Connection extra contents, are written to the audit log in cleartext when submitted via the bulk endpoints PATCH /api/v2/variables and PATCH...

PT-2026-71363

Name of the Vulnerable Software and Affected Versions OpenStack Designate versions prior to 22.0.1 Description An authenticated user can bypass zone creation checks by scheduling a zone to a different pool using the AttributeFilter scheduler. This occurs because the is subzone and is superzone...

PT-2026-71211

Missing authorization in the Execute Monitor API in Amazon OpenSearch Alerting plugin might allow an authenticated remote user to read, modify, or delete arbitrary index data via a crafted inline monitor request with unintentional data source and input index parameters...

PT-2026-71121

In WhatsUp Gold versions released before 2026.0.2, a privileged attacker can write arbitrary files to a web-accessible location on the host server...

PT-2026-71280

Draft List is a WordPress plugin to manage and promote unpublished content. Versions 2.6.3 and below are vulnerable to stored Cross-Site Scripting XSS in the drafts shortcode and Draft List widget when the documented custom template option places the draft placeholder inside an HTML attribute. Th...

PT-2026-71047

Joomla Extension - tabaoca.org - Improper ACL implementation allows file operations in Cotton Cloud 2.0.3 - Authenticated users could perform various file-related operations read, delete, overwrite, re-assign permissions on files owned by other users...

PT-2026-71123

Under specific self-hosted Helm configurations, generated TLS private keys may be retained in rendered manifests accessible to highly privileged local users...

PT-2026-71008

The Patterns Kit WordPress plugin through 1.0.3 does not escape a link attribute before its client-side script inserts it into the page, allowing users with a role as low as Contributor to store a payload that executes in the browser of a user who views the content and clicks the affected element...

PT-2026-70973

A flaw has been found in Open5GS up to 2.7.1. Affected by this vulnerability is an unknown functionality of the component freeDiameter. This manipulation causes memory corruption. The attack is possible to be carried out remotely...

PT-2026-71113

An unauthenticated user may bypass authentication under specific cache conditions...

PT-2026-75906

This module enables you to share content between sites in a hub - subscriber model. Certain inputs were not sufficiently validated, allowing an attacker to achieve server-side request forgery attacks...

PT-2026-71217

GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.1.4 and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user to read policy configuration belonging to a namespace they were not authorized to access, due to incorrect...

PT-2026-70975

The Social Login, Passkeys, Magic Link & Email OTP – Passwordless Login by VentraConnect plugin for WordPress is vulnerable to Authentication Bypass via Unverified Provider Email in all versions up to, and including, 1.4.3. This is due to the plugin trusting the unverified email field returned by...

PT-2026-76591

This module enables you to display content in tabs, where each tab renders a block, a node, a view, or another Quick Tabs instance. The module did not correctly enforce access when rendering node and block tabs. It treated a neutral access result as a grant for node tabs and block plugins, and...

PT-2026-71288

Budibase is an open-source low-code platform. Prior to 3.40.1, packages/server/src/integrations/mongodb.ts passed builder-controlled tlsCertificateKeyFile and tlsCAFile values directly to MongoClient on Budibase Cloud. A builder could submit absolute server paths through /api/datasources/verify a...

PT-2026-71247

SiYuan versions before v3.7.4 fail to enforce publish-access checks on getBlockBreadcrumb, getRefText, and getBlockTreeInfos endpoints, allowing disclosure of protected document content and metadata. Anonymous readers or publish RoleReader accounts can retrieve document titles, ancestor block...

PT-2026-71199

Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 19.2 through 19.2.1 Description An issue exists where an authenticated user with developer-role permissions could escalate privileges. This occurs due to improper sanitization of HTML content rendered within a CI job moda...

PT-2026-71203

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.5 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an unauthenticated user to cause a denial of service due to improper input validation...

PT-2026-71198

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.0 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user with developer-role permissions to execute CI/CD pipelines on a protected branch without...

PT-2026-71137

Multiple Use-After-Free vulnerabilities were found in the add archive element function in ld/ldmain.c of the GNU linker ld, a component of binutils. The root cause is that plugin maybe claim in ld/plugin.c frees the original BFD object via bfd close/ bfd delete bfd when entry-the bfd-my archive =...

PT-2026-71177

Name of the Vulnerable Software and Affected Versions Apache Allura versions prior to 1.19.1 Description An Insecure Direct Object Reference IDOR exists due to missing permission checks for multiple Artifact types. IDOR is a type of access control vulnerability that occurs when an application...

PT-2026-71178

Name of the Vulnerable Software and Affected Versions Apache Allura versions prior to 1.19.1 Description Specifically crafted inputs may lead to git argument injection, a flaw where an attacker can insert unauthorized arguments into a git command executed by the application. Recommendations Upgra...