PT-2026-44093

When processing a request with a URL path starting with /status or /sysinfo, WOSHttpStatusModule.dll is to be loaded to handle such URL patterns. The WOSBin LoadHttpModule function in the dll would be called to set up a "module" object for that module. However, WOSHttpStatusModule.dll is not...

PT-2026-44076

Pi.Alert is a WIFI / LAN intruder detector with web service monitoring. Prior to 2026-05-07, Pi.Alert's SaveConfigFile endpoint writes user-supplied numeric config values e.g., SMTP PORT directly into pialert.conf without validation. Since pialert.conf is loaded via Python's exec every 3–5 minute...

PT-2026-43588

A vulnerability in Active Backup for Business allows unauthorized remote attackers to read arbitrary files...

PT-2026-44094

Function calls to WOSCommonUtil.dll!WOSSysInfoGetDeviceInterface in various DLLs i.e., WOSProfileMgrModule.dll, WOSWebDavModule.dll can return a NULL pointer i.e., when no user is logged into the Triofox Server Agent Management Console. The returned NULL pointer is not checked before being...

PT-2026-44055

Name of the Vulnerable Software and Affected Versions Budibase versions prior to 3.38.3 Description The removeSecrets function in the server SDK fails to mask datasource configuration fields unless their schema type is DatasourceFieldType.PASSWORD. Because the Snowflake integration defines the...

PT-2026-43607

An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the getProjectTags function due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality...

PT-2026-43623

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Averta Master Slider allows DOM-Based XSS. This issue affects Master Slider: from n/a through 3.10.8...

PT-2026-44048

Insecure Permissions vulnerability in kvf-admin v1.0.0 allows a remote attacker to escalate privileges via the UserController.java component...

PT-2026-44006

Agent Zero before version 1.15 contains a stored cross-site scripting vulnerability that allows attackers to execute arbitrary JavaScript in the application origin by serving SVG files through the image get API endpoint without Content-Security-Policy, X-Content-Type-Options, or Content-Dispositi...

PT-2026-43506

Name of the Vulnerable Software and Affected Versions Login with OTP plugin for WordPress versions prior to 1.7 Description An authentication bypass exists due to an incomplete fix in the otpl login action function. The rate-limit and lockout checks are only applied during the OTP generation phas...

PT-2026-43982

Name of the Vulnerable Software and Affected Versions IBM OPENBMC versions FW1110.00 through FW1110.11 Description Unauthenticated network users can perform denial of service attacks against the system. Recommendations At the moment, there is no information about a newer version that contains a f...

PT-2026-43531

The Auto Thumbnail plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'thumbnails' shortcode in all versions up to, and including, 1.0. This is due to insufficient input sanitization and output escaping on the shortcode's 'width' and 'height' attributes in the athn thumbnai...

PT-2026-43780

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the bridge multicast component where the mdb n entries count for VLAN contexts is updated conditionally. This can lead to a state where a decrease operation is perform...

PT-2026-43828

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description Memory leaks occur in the gfs2 fill super error handling path when transitioning a filesystem to read-write mode fails. The first leak involves kthread objects, such as thread struct and...

PT-2026-44122

Name of the Vulnerable Software and Affected Versions Microsoft UFO version 3.0.1-4-ge2626659 Description Microsoft UFO is an open-source framework for intelligent automation across devices and platforms. The software accepts client-supplied session id values in WebSocket task messages and reuses...

PT-2026-44029

Name of the Vulnerable Software and Affected Versions Facebook for WooCommerce versions prior to 3.7.1 Description An Open Redirect issue exists, which is a type of vulnerability that allows an application to redirect a user to an untrusted external site. This can be leveraged to facilitate...

PT-2026-43844

In the Linux kernel, the following vulnerability has been resolved: fbnic: close fw log race between users and teardown Fixes a theoretical race on fw log between the teardown path and fw log write functions. fw log is written inside fbnic fw log write and can be reached from the mailbox handler...

PT-2026-43726

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A regression in the netfilter nfnetlink queue component causes UDP packets to be dropped instead of queued. This occurs when an application has not set the F GSO capability flag and a...

PT-2026-43983

Name of the Vulnerable Software and Affected Versions IBM Operations Analytics - Log Analysis affected versions not specified IBM SmartCloud Analytics - Log Analysis affected versions not specified Description These products use default passwords from the manufacturing process during the...

PT-2026-43795

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A memory leak occurs in the wave5 VPU driver. In the functions wave5 vpu open enc and wave5 vpu open dec, a VPU instance is allocated using kzalloc. If the subsequent allocation for the...

PT-2026-43791

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the ksmbd module where the function ksmbd vfs kern path end removing is not called on certain error paths. This failure to balance the corresponding ksmbd vfs kern pat...

PT-2026-43516

The Single Mailchimp plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'single-mailchimp' shortcode in all versions up to, and including, 1.4. This is due to insufficient input sanitization and output escaping on user-supplied shortcode attributes autocomplete, label,...

PT-2026-44095

A path traversal vulnerability exists in WOSDefaultHttpModule.dll when processing a URL path starting with /woshome...

PT-2026-44110

Name of the Vulnerable Software and Affected Versions pam usb versions prior to 0.8.7 Description In src/device.c, the return values of the functions udisks drive get serial, udisks drive get vendor, and udisks drive get model are passed directly to strcmp without NULL checks. According to...

PT-2026-44039

A stored cross-site scripting XSS vulnerability in the /admin/config-module.php component of creatorsofcode simplephp GitHub commit 5184cff Latest as of 2026-02-27 via injecting a crafted payload...

PT-2026-44025

Name of the Vulnerable Software and Affected Versions DearFlip versions prior to 2.4.28 Description A missing authorization issue in DearHive DearFlip allows for the exploitation of incorrectly configured access control security levels. This is a broken access control flaw where the system fails ...

PT-2026-43493

The ShopLentor - WooCommerce Builder for Elementor & Gutenberg plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'blockUniqId' block attribute in multiple Product Gride blocks in versions up to, and including, 3.3.8 due to insufficient input sanitization and output escapin...

PT-2026-44066

Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 17.1 through 18.10.6 GitLab CE/EE versions 18.11 through 18.11.3 GitLab CE/EE versions 19.0 through 19.0.0 Description An issue exists where an authenticated user can cause a denial of service due to insufficient validati...

PT-2026-43544

The Gutenverse plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 's' parameter in all versions up to, and including, 3.4.6 due to insufficient input sanitization and output escaping. Specifically, the render content method in class-search-result-title.php outputs the...

PT-2026-43773

In the Linux kernel, the following vulnerability has been resolved: power: supply: pf1550: Fix use-after-free in power supply changed Using the devm variant for requesting IRQ before the devm variant for allocating/registering the power supply handle, means that the power supply handle will be...

PT-2026-43547

The WPBakery Page Builder Addons by Livemesh plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the lvca admin ajax AJAX action in all versions up to, and including, 3.9.4 due to missing authorization checks and insufficient input sanitization. The AJAX handler verifies a nonce...

PT-2026-44014

Name of the Vulnerable Software and Affected Versions Jenkins Pipeline: Groovy Libraries Plugin versions prior to 797.v90ea a 9b e45a 0 Description The plugin does not prohibit symbolic links in shared libraries. This allows attackers who can control the content of a library used by a Pipeline jo...

PT-2026-43700

In Slican telephone exchanges secure key is generated in a predictable manner using properties of the telephone exchange which can be obtained without authentication. An unauthenticated attacker can deduce the secure key and obtain admin credentials. This issue was fixed in versions below: - IPx...

PT-2026-44111

Name of the Vulnerable Software and Affected Versions pam usb versions prior to 0.8.7 Description pam usb provides hardware authentication for Linux using ordinary removable media. Symlink attacks on the pad directory and pad files allow for authentication bypass and corruption of root files...

PT-2026-43753

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the Linux kernel where the prototype for the bpf xdp store bytes function is incorrect. The verifier incorrectly expects the third argument to be of type ARG PTR TO...

PT-2026-43593

A high privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the RemoveRequest function due to improper neutralization of special elements in a SQL DELETE command allowing for reading the whole database and deleting entries in a non critical table. This can resu...

PT-2026-47220

Unknown description...

PT-2026-45980

BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Prior to 1.4.39, a malicious bentofile.yaml containing a newline-injected value in envs.name produces unquoted RUN directives in the BentoML-generated Dockerfile. When the victim runs bentom...

PT-2026-47221

Unknown description...

PT-2026-43609

An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the alarming view due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality...

PT-2026-43807

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the stmmac driver for GMAC4 when split header is enabled. In certain rare cases, the hardware fails to fill buf2 of the first descriptor with payload. Because the syst...

PT-2026-43532

The Two-factor authentication formerly IP Vault plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.1. This is due to missing or incorrect nonce validation on the ipv save changes function. This makes it possible for unauthenticated attackers t...

PT-2026-43778

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A NULL pointer dereference occurs in the cdns3 driver when a role switch to host mode happens during the system resume process. The start operation of the host role registers a xhci-hcd...

PT-2026-44017

Name of the Vulnerable Software and Affected Versions Jenkins Bitbucket OAuth Plugin versions prior to 0.18 Description The plugin fails to restrict the redirect URL after the login process, which enables attackers to conduct phishing attacks via open redirection. Recommendations Update to a...

PT-2026-43541

Name of the Vulnerable Software and Affected Versions PLCnext Control affected versions not specified Description The Web-based Management interface lacks a data verification mechanism when installing additional APPs downloaded from the PLCnext Store. This allows a remote low-privileged Engineer...

PT-2026-47218

Unknown description...

PT-2026-44633

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 148.0.7778.216 Description A use after free issue exists in ANGLE. This allows a remote attacker who has already compromised the renderer process to potentially achieve a sandbox escape by using a specially...

PT-2026-44586

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 148.0.7778.216 Description A use after free issue in ANGLE allows a remote attacker who has compromised the renderer process to potentially perform a sandbox escape by using a crafted HTML page. Use after free i...

PT-2026-44572

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 148.0.7778.216 Description A use after free issue in the Document Object Model DOM, which is the programming interface for web documents, allows a remote attacker to execute arbitrary code within a sandbox by...

PT-2026-44691

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 148.0.7778.216 Description A type confusion issue exists in Skia, a graphics library. This allows a remote attacker to execute arbitrary code within a sandbox by inducing the user to open a specially crafted HTM...