PT-2026-72136

Content removed...

PT-2026-71049

Description Cloudflare was recently notified by external researchers of vulnerabilities in this archived repository, including a remote code execution issue in src/index.ts reachable from certain GitHub Actions workflow configurations. Successful exploitation may expose workflow secrets such as...

PT-2026-71216

GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.1.4 and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user to modify project settings restricted to higher-privileged roles, due to missing authorization checks on a proje...

PT-2026-71276

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information due to a race condition...

PT-2026-71079

Joomla Extension - joomshaper.com - Unauthenticated arbitrary directory creation and file write in SP Page Builder 6.8.0 - An unauthenticated attacker can create arbitrary directories and files with a predefined name...

PT-2026-71304

MongoDB SQL Schema Builder CLI records its startup configuration to standard output and, when file logging is enabled, to a log file on disk. Certain connection settings were written without redaction, so authentication material supplied by the operator could appear in plaintext in that diagnosti...

PT-2026-71322

IBM i Access Client Solutions 1.1.2.0 through 1.1.9.13 is vulnerable to zip slip path traversal exploit when importing a configuration...

PT-2026-71330

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 for Linux, UNIX and Windows includes DB2 Connect Server could allow a local attacker to obtain sensitive information due to the logging of plain text passwords in trace files...

PT-2026-70958

In the Linux kernel, the following vulnerability has been resolved: firmware: arm ffa: Fix NULL dereference in ffa partition info get ffa partition info get passes uuid str directly to uuid parse without a NULL check. When a caller passes NULL, uuid parse - uuid parse - uuid is valid dereferences...

PT-2026-70960

In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: Validate vmw surface metadata::array size This field comes from userspace and should be validated against specific limits depending on which Shader Model SM is available...

PT-2026-70957

In the Linux kernel, the following vulnerability has been resolved: hwmon: gigabyte waterforce Stop device IO before calling hid hw stop Calling hid hw stop does not stop the device IO. This results in a race condition between hid input report and the point immediately following the execution of...

PT-2026-70947

In the Linux kernel, the following vulnerability has been resolved: libceph: bound get version reply decode to front len handle get version reply uses msg-front alloc len as the decode boundary for MON GET VERSION REPLY. That is the size of the reused reply buffer, not the number of bytes actuall...

PT-2026-71343

Name of the Vulnerable Software and Affected Versions Russh versions prior to 0.62.4 Description An unauthenticated SSH client can trigger a denial of service by sending an SSH MSG KEX ECDH INIT message containing a 32-byte all-zero Q C value. The Curve25519Kex::server dh function in...

PT-2026-71274

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary script code due to improper neutralization of user-controlled input...

PT-2026-71264

Budibase is an open-source low-code platform. Prior to 3.40.1, RestIntegration. req in packages/server/src/integrations/rest.ts attached credentials from getAuthHeaders and defaultHeaders without requiring the final request destination to match the datasource origin. An unauthenticated caller of ...

PT-2026-76554

Impact Affected versions of Winter CMS did not enforce per-template-type permission checks in the CMS section's AJAX handlers. The CMS controller CmsControllersIndex used OR-logic across its five permissions cms.manage pages, cms.manage partials, cms.manage layouts, cms.manage content, cms.manage...

PT-2026-71238

SiYuan before v3.7.4 contains an access control bypass vulnerability where static-file routes in the server mux bypass publish-access controls enforced on the REST API. Attackers with publish reader tokens or anonymous access in disabled-auth mode can read templates, snippets, and export artifact...

PT-2026-71182

IBM i 7.6, and 7.5 could allow a remote authenticated attacker to execute arbitrary commands with elevated privileges due to improper neutralization of special elements used in an OS command...

PT-2026-71074

Name of the Vulnerable Software and Affected Versions CryptoPro Secure Disk for Bitlocker versions prior to 7.7.4 Description The software fails to enforce Integrity Measurement Architecture IMA policy protections across temporary file systems. IMA is a kernel-based mechanism that maintains a...

PT-2026-70971

A flaw was found in the multicloud-operators-channel component of Red Hat Advanced Cluster Management RHACM. This vulnerability allows a compromised agent from a managed cluster to gain unauthorized access to sensitive information. Specifically, the agent can read all Secrets and ConfigMaps withi...

PT-2026-71196

The Microsoft Container Migration Solution Accelerator is a multi-service application that provides a multi-agent, AI-driven migration solution for moving container service configurations to Azure Kubernetes Service. In version 2.1.2 and earlier, a security vulnerability was identified in the...

PT-2026-71354

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service and obtain sensitive information due to an integer underflow...

PT-2026-71252

A flaw was found in the cluster-curator-controller component of multicluster engine MCE. A tenant with create or update permissions on ClusterCurator resources can inject an arbitrary Job specification. This is possible because the CreateJob function does not validate user-controlled input when...

PT-2026-71294

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 and IBM Verify Identity Access Container 11.0 through 11.0.3 is vulnerable to a denial of service attack...

PT-2026-71321

IBM i Access Client Solutions 1.1.2.0 through 1.1.9.13 is vulnerable to arbitrary code execution on Windows when installed for all users due to publicly writeable configuration file...

PT-2026-71073

CPSD CryptoPro Secure Disk for Bitlocker before v7.7.4 fails to encrypt the initramfs contents, allowing for the offline recovery of secrets and cryptographic details...

PT-2026-71324

IBM i Access Client Solutions 1.1.2.0 through 1.1.9.13 ACS is vulnerable to downloading unverified product code when configured to update from an IBM i. A bad actor could use this vulnerablity to run compromised code on the ACS user's workstation...

PT-2026-71265

A flaw was found in GStreamer gst-plugins-good avidemux. When parsing FUJIFILM metadata in an AVI strd chunk, gst avi demux parse strd decrements a remaining-length counter by fixed offsets 98 and 10 bytes without verifying sufficient data remains. For crafted strd payloads of exactly 106 or 107...

PT-2026-71266

A flaw was found in GStreamer gst-plugins-good avidemux. In gst avi demux riff parse vprp, the number of available gst riff vprp video field desc entries is calculated by dividing the remaining buffer size by the attacker-controlled vprp-fields value, rather than by sizeofgst riff vprp video fiel...

PT-2026-75987

Impact The Backend Filter widget BackendWidgetsFilter is vulnerable to SQL injection through the numberrange scope type when the scope is configured with a conditions key. An authenticated backend user with access to a list view containing a vulnerable filter scope can inject arbitrary SQL via th...

PT-2026-71098

Docker Sandboxes sbx applies the read-only intent of a runtime host mount to the in-guest container bind only: the underlying virtio-fs host-edge grant is added to the sandbox's policy-share allowlist with no access mode. The directory stays writable at its shared-export path, so unprivileged cod...

PT-2026-71053

The Kirki WordPress plugin before 6.2.1 does not properly authorise its front-end form submission REST routes and passes attacker-controlled input through shortcode execution, allowing unauthenticated users to run any shortcode registered on the site, which on a default install leads to disclosur...

PT-2026-70969

A flaw was found in multicloud-integrations, a component of Red Hat Advanced Cluster Management RHACM. This vulnerability allows an authenticated user, referred to as a tenant, to manipulate the GitOpsCluster controller. By exploiting this, a tenant can redirect sensitive spoke cluster bearer...

PT-2026-71317

NextAuth.js provides authentication for Next.js. Prior to@auth/core 0.41.3 and next-auth 4.24.15 and 5.0.0-beta.32, Auth.js stores the OAuth/OIDC anti-CSRF checks state, nonce, and the PKCE verifier in global cookies that are not bound to the provider that created them. On callback, a check value...

PT-2026-71070

Name of the Vulnerable Software and Affected Versions CryptoPro Secure Disk for Bitlocker versions prior to 7.7.4 Description The software fails to properly handle decryption errors, which allows encrypted volumes to be mounted as plaintext. Recommendations Update to version 7.7.4 or later...

PT-2026-75979

Impact Affected versions of Winter CMS did not validate the handler name submitted through the form postback mechanism handler POST field in the same way as AJAX requests X WINTER REQUEST HANDLER header. The AJAX path validates that handler names match the onA-Zw+ pattern, but the postback path...

PT-2026-71141

Name of the Vulnerable Software and Affected Versions Apache Airflow versions prior to 3.3.1 Description The secrets masker fails to mask var.json Variable values when the value is a dictionary within the Rendered Templates UI. This occurs because the dictionary value fails an isinstancestr guard...

PT-2026-75981

Summary LegacyController.php:75 writes the page title into a document.title JS assignment using string interpolation. apps/proxmox.inc.php pushes $vars'instance' and $vars'vmid' GET params, only strip tags applied directly into $pagetitle. A single quote terminates the JS string, executing...

PT-2026-76569

Stata Command Injection via Unsanitized package in ado package install Summary The ado package install MCP tool in stata-mcp concatenates user-controlled input directly into a Stata command string without any validation or sanitization. An attacker who can invoke the MCP tool or the equivalent...

PT-2026-71127

Name of the Vulnerable Software and Affected Versions Apache Airflow versions prior to 3.3.1 Description The environment-variable secrets backend incorrectly resolves team-scoped Connections or Variables from the wrong team's scope. This occurs because the security guard intended to prevent this...

PT-2026-71130

Name of the Vulnerable Software and Affected Versions Apache Airflow versions prior to 3.3.1 Description An authorization flaw exists in the Backfill API where a discrepancy in how the backfill id path segment is parsed allows an authenticated user with edit permissions on any single Dag to perfo...

PT-2026-71349

Name of the Vulnerable Software and Affected Versions MCP Atlassian versions prior to 0.22.0 Description The software fails to call validate safe path when processing the file path variable within the confluence upload attachment tool. This occurs in the upload attachment direct function located ...

PT-2026-72878

CVE-2026-15424 - Rejected reason: This CVE ID has been rejected or CVE ID :CVE-2026-15424 Published : Aug. 12, 2026, 11:17 p.m. | 21 minutes ago Description :Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. Severity: 0.0 | NA Visit the link for more...

PT-2026-71208

In Kong Mesh running in universal mode with a MeshIdentity whose SPIFFE ID path template derives from the dataplane's kuma.io/workload label, the XDS authenticator in kuma-cp validates that label only when the dataplane token is bound to a workload. Workload binding is optional, so a dataplane...

PT-2026-71309

Deserialization of Untrusted Data vulnerability in ash-project ash allows an unauthenticated attacker to inject a filter expression through a forged keyset pagination cursor, resulting in SQL injection or code execution depending on the data layer. Read actions with keyset pagination decode the...

PT-2026-76563

Summary compliance-trestle 4.0.3 latest ships an URLSecurityValidator in trestle/core/remote/security.py to block SSRF to loopback / link-local / cloud-metadata endpoints from the HTTPSFetcher and SFTPFetcher remote-fetch paths. The allowlist is incomplete and can be bypassed by four equivalent...

PT-2026-70823

Cap v0.3.1 contains a broken access control vulnerability in the POST /api/video/comment endpoint that allows authenticated users to post comments on any private video without permission by supplying an arbitrary videoId in the request body. Attackers can inject comments into private video...

PT-2026-70280

Name of the Vulnerable Software and Affected Versions IntelR XeonR processors affected versions not specified Description An always-incorrect control flow implementation in the firmware may allow a system software adversary with privileged user access to escalate privileges. This issue requires a...

PT-2026-70212

Name of the Vulnerable Software and Affected Versions Velociraptor affected versions not specified Description The NTFS parsing library contains multiple out-of-bounds and memory exhaustion bugs. These issues can be triggered when the software processes maliciously crafted NTFS images, such as...

PT-2026-70240

Fooocus is an image generating software. In versions 2.5.5 and prior, the Fooocus web UI is vulnerable to remote code execution due to the unsafe use of eval when processing metadata JSON. An attacker with access to the Fooocus web UI may be able to execute arbitrary code on the instance. As of...