PT-2026-116607

ProjectSend 2.0.0 before 2.7.0 contains a path validation flaw in OrphanFileScanner::isOrphan that allows staff with import orphans permission to treat tracked files as orphans. Attackers can submit ./ path aliases to the orphans import or delete endpoints, deleting or adopting other owners' file...

PT-2026-116597

Improper Control of Generation of Code 'Code Injection' vulnerability in HivePress HivePress hivepress allows Code Injection.This issue affects HivePress: from n/a through 1.7.32...

PT-2026-116611

Schism Tracker through 20260524 contains a heap out-of-bounds write vulnerability in fmt ult load song in fmt/ult.c that fails to clamp the one-byte sample count to MAX SAMPLES. Attackers can supply a crafted .ult module that overwrites the instruments pointer array, causing csf destroy to free...

PT-2026-116598

Deserialization of Untrusted Data vulnerability in QuantumCloud Conversational Forms for ChatBot conversational-forms allows Object Injection.This issue affects Conversational Forms for ChatBot: from n/a through 1.5.1...

PT-2026-116609

WhoDB 0.104.0 before 0.135.0 contains a path traversal vulnerability that allows remote attackers to read and write arbitrary host files by running DuckDB filesystem functions through the query editor. Attackers can log in to a DuckDB file without credentials and use read text, read blob, COPY...

PT-2026-116602

Vanus 0.8.0 through 0.9.0 contains a default credentials vulnerability that allows unauthenticated remote attackers to gain cluster-admin access by using the hardcoded admin token. Attackers can send the fixed Bearer token to the gateway gRPC proxy port to manage namespaces, eventbuses, users,...

PT-2026-116613

smpeg through 2.0.0 contains a heap out-of-bounds read vulnerability in MPEGsystem::FillBuffer that allows attackers to read past the 16384-byte buffer by supplying a crafted system header stream table. Attackers can provide an MPEG file whose stream table bytes all set the high bit, which crashe...

PT-2026-116596

Authentication Bypass by Primary Weakness vulnerability in VideoWhisper.com 2Way VideoCalls and Random Chat webcam-2way-videochat allows Authentication Abuse.This issue affects 2Way VideoCalls and Random Chat: from n/a through 6.1.5...

PT-2026-117119

A flaw has been found in Soarkey StudentManagement up to e08f7f1d5015af407aa4cca0ada3dea189b4937e. Impacted is the function UserDao.login of the file code/src/service/AdminDao.java. This manipulation of the argument Password causes cleartext storage of sensitive information. The attack is...

PT-2026-116592

Incorrect Privilege Assignment vulnerability in Hamid Alinia Login with phone number login-with-phone-number allows Privilege Escalation.This issue affects Login with phone number: from n/a through 1.8.77...

PT-2026-116605

ProjectSend 2.0.0 before 2.7.0 contains an incorrect authorization vulnerability that allows restricted API token holders to change the token owner's credentials via PATCH /api/v1/users/user. Attackers with a token limited to manage users and edit users can set a new owner password, clear...

PT-2026-116640

Name of the Vulnerable Software and Affected Versions libdvdnav versions prior to 7.0.0 Description A heap out-of-bounds read occurs in the dvdnav describe title chapters function. This happens when an attacker provides a crafted DVD or disc image with an oversized vts ttn value that exceeds the...

PT-2026-116535

A vulnerability was identified in makeplane plane up to 1.4.2. Impacted is an unknown function of the component API Endpoint. Such manipulation of the argument X-Forwarded-For leads to reliance on untrusted inputs in a security decision. It is possible to launch the attack remotely. The exploit i...

PT-2026-116547

The Salon Booking System WordPress plugin before 10.31.11 does not prevent users holding its custom salon staff role from assigning arbitrary capabilities to other accounts when editing a customer, allowing them to escalate any account to administrator and take over the site...

PT-2026-116586

CVE-2026-107436 CVSS 8.8: Deserialization vulnerability in Strong Testimonials plugin WP Chill through v3.3.12. WordPress sites should check for updates. https://t.co/NKfc4BIlfd… via NVD Recent High CVSS CyberSecurity InfoSec Vulnerability AI MachineLearning https://t.co/q59xLTIjlq...

PT-2026-116549

The Salon Booking System WordPress plugin before 10.31.11 does not validate a user-supplied image URL before fetching it server-side and writing the response to a publicly accessible location under an attacker-chosen filename, allowing users with the Salon Staff role or higher to force the server...

PT-2026-116587

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in ThemeGrill eStore estore allows Reflected XSS.This issue affects eStore: from n/a through 1.6.13...

PT-2026-116588

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Arraytics Booktics booktics allows SQL Injection.This issue affects Booktics: from n/a through 1.0.29...

PT-2026-116591

Name of the Vulnerable Software and Affected Versions OttoKit suretriggers versions prior to 1.1.41 Description An incorrect privilege assignment issue allows for privilege escalation. Recommendations Update to version 1.1.41 or later...

PT-2026-117596

These are all security issues fixed in the ImageMagick-7.1.2.34-1.1 package on the GA media of openSUSE Tumbleweed...

PT-2026-117019

In the Linux kernel, the following vulnerability has been resolved: bpf: Wait for an RCU tasks grace period before freeing trampoline progs When a prog is detached from a trampoline, it is freed after an RCU grace period, or an RCU tasks trace one if it is sleepable. This covers the tasks that ar...

PT-2026-117607

These are all security issues fixed in the hashcat-7.1.2+git942-1.1 package on the GA media of openSUSE Tumbleweed...

PT-2026-116625

snac2 before 2.93 contains a heap-based buffer overflow vulnerability in xs json load lexer that allows unauthenticated remote attackers to corrupt heap memory by sending JSON strings containing a u0000 escape. Attackers can send a single crafted application/activity+json POST to activitypub post...

PT-2026-117606

These are all security issues fixed in the fuseiso-20260614-1.1 package on the GA media of openSUSE Tumbleweed...

PT-2026-117608

These are all security issues fixed in the in-toto-3.1.0-1.1 package on the GA media of openSUSE Tumbleweed...

PT-2026-116922

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: minstrel ht: validate fixed rate index The fixed rate idx debugfs file is a plain u32 attribute, so any value can be written to it. minstrel ht update stats then copies the value into mi-max tp rate and mi-max pro...

PT-2026-116872

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: Fix gaccess shadow fault In some circumstances, it is possible that the page of nested guest memory that is being shadowed is not present at all in the parent guest gmap. dat entry walk will not find any leaf entry and...

PT-2026-116996

In the Linux kernel, the following vulnerability has been resolved: binder: fix leaked fd fixups on TF UPDATE TXN supersede When a TF UPDATE TXN transaction supersedes a pending async transaction in a frozen process, the outdated transaction is freed with kfree directly. This skips binder free tx...

PT-2026-116905

In the Linux kernel, the following vulnerability has been resolved: smb: client: discard post-EOF pagecache when extending a file via zero range smb3 zero range removed the pagecache only for the range being zeroed, so when it extends the file the folio straddling the old EOF - which may hold dat...

PT-2026-116639

wvWare wv through 1.2.9 contains a heap-based out-of-bounds read vulnerability in wvGetSTSH in stylesheet.c that allows attackers to crash applications by supplying crafted Word stylesheets. Attackers can provide a .doc file with ten or fewer styles or out-of-range style base indexes to read past...

PT-2026-116633

Gitify before 7.10.0 contains a login cross-site request forgery vulnerability that allows remote attackers to bind a victim's client to their account because performGitHubWebOAuth omits OAuth state validation. Attackers can get a gitify://oauth?code= link with their own authorization code opened...

PT-2026-116678

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: balance the parent hold in hci bind bis hci conn link takes a lifetime reference to its parent with hci conn get, but only takes an operational hold on the child. hci conn unlink later balances both a hold and a...

PT-2026-117012

In the Linux kernel, the following vulnerability has been resolved: netfilter: bpf: reject invalid NAT manipulation types As bpf ct set nat info is not validating the NAT manipulation type a wrong value can be passed directly to nf nat setup info. This triggers the WARN ON at nf nat setup info an...

PT-2026-117160

A vulnerability was detected in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. Affected by this vulnerability is the function file exists of the file Public/Home/js/uploadify/check-exists.php of the component Uploadify. The manipulation of the...

PT-2026-116669

In the Linux kernel, the following vulnerability has been resolved: smb: client: close completed creates on compound wait errors compound send recv waits for responses in order. If a later wait is interrupted, or if a later MID fails during response synchronization, an earlier CREATE may already...

PT-2026-116944

In the Linux kernel, the following vulnerability has been resolved: nvmet-auth: fix out-of-bounds write in nvmet auth challenge nvmet auth challenge receives its output buffer as a void pointer. sizeofd therefore evaluates to one with GCC and undercounts the fixed challenge header by 15 bytes. A...

PT-2026-116629

OW2 ASM 9.11 before 9.11.1 contains an infinite loop vulnerability in Label.resolve caused by 16-bit forward-reference offsets truncating when rewritten methods exceed 64 KB. Attackers can supply crafted class files whose transformed code grows past 65535 bytes, hanging ClassReader.accept and...

PT-2026-117147

Requesting /username/-/repositories for an individual user instead of an organization made the organization home handler dereference a nil organization and panic. The request needs no authentication and no special configuration. The server answered with an HTTP 500 error and logged a panic for ea...

PT-2026-117050

In the Linux kernel, the following vulnerability has been resolved: of/overlay: don't leak fragment references when changeset init fails init overlay changeset stores the number of initialized fragments in ovcs-count only on full success. When find target or the symbols lookup fails partway...

PT-2026-116933

In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Update control fields on VMEXIT if and only if VMRUN succeeded Leave control.erap ctl and control.clean as-is in the VMCS if VMRUN fails, because as per AMD: there's no explicit architectural guarantee about the behavio...

PT-2026-116977

In the Linux kernel, the following vulnerability has been resolved: usb: typec: ucsi: glink: fix use-after-free of ucsi on remove The pmic glink client is released by the devres cleanup, which runs after pmic glink ucsi remove has returned, so its notification callbacks can queue work until then...

PT-2026-116750

In the Linux kernel, the following vulnerability has been resolved: ipv6: sr: enforce exact attribute length for SEG6 ATTR DST In seg6 genl policy, SEG6 ATTR DST is defined with .type = NLA BINARY and .len = sizeofstruct in6 addr. For NLA BINARY, .len only enforces the maximum payload length and...

PT-2026-116615

libtta through 2.3 contains an integer overflow vulnerability in tta decoder init get info that allows attackers to cause a heap buffer overflow on 32-bit builds via unvalidated header fields. Attackers can supply a crafted .tta file with a sample rate of 1 and large samples value, wrapping the...

PT-2026-116878

In the Linux kernel, the following vulnerability has been resolved: iio: pressure: rohm-bm1390: Return error when read fails The data reading function ignores the cached error value, and unconditionally returns 0. Return cached 'ret' -value after stopping the measurement so user knows if read...

PT-2026-116902

In the Linux kernel, the following vulnerability has been resolved: smb: client: flush dirty data before zeroing a range smb3 zero range emulates FALLOC FL ZERO RANGE by invalidating the page cache over the target range with truncate pagecache range and then issuing FSCTL SET ZERO DATA to the...

PT-2026-116643

librtmp in RTMPDump through 2.6 contains an out-of-bounds read and heap out-of-bounds write vulnerability because AMF3 Decode ignores AMF3 property decode failures. Malicious RTMP servers or man-in-the-middle attackers can send oversized AMF3 string lengths, and with the token option DecodeTEA...

PT-2026-116759

In the Linux kernel, the following vulnerability has been resolved: fprobe: Terminate the fgraph data list when the reservation is not filled fprobe fgraph entry reserves shadow stack space for every fprobe with an exit handler, but only fills it for those whose entry handler returns 0. fgraph...

PT-2026-116993

In the Linux kernel, the following vulnerability has been resolved: rust binder: cancel deferred work items in thread exit If there are deferred work items on the thread todo list, then they are not cleaned up in the Thread::release method. Thus, update the code to clean up the work items even if...

PT-2026-116895

In the Linux kernel, the following vulnerability has been resolved: iio: adc: ade9000: fix NULL pointer dereference in clkout registration ade9000 setup clkout passes NULL as the register address when registering a divider clock. During clock registration, the common clock framework calls clk...

PT-2026-116804

In the Linux kernel, the following vulnerability has been resolved: eth: fbnic: Avoid rounding zero ring sizes roundup pow of two is undefined for zero. ethtool permits a zero ring size to reach the driver, where the minimum-size check should reject it. Leave zero unchanged while rounding nonzero...