Lucene search
+L
PtsecurityMost viewed

200310 matches found

Positive Technologies
Positive Technologies
•added 2026/06/20 12:0 a.m.•44 views

PT-2026-51175

Name of the Vulnerable Software and Affected Versions AVideo versions prior to 29.0 Description An authorization bypass exists in the Meet plugin's 'uploadRecordedVideo.json.php' endpoint. The system derives the target users id from the uploaded filename without proper verification. An attacker w...

9.2CVSS6AI score0.00453EPSS
SaveExploits0References9
Positive Technologies
Positive Technologies
•added 2026/06/19 12:0 a.m.•44 views

PT-2026-50874

Name of the Vulnerable Software and Affected Versions JetBrains GoLand versions prior to 2026.1.3 Description Remote code execution is possible through the use of untrusted project configuration. Recommendations Update JetBrains GoLand to version 2026.1.3 or later...

8.8CVSS6.3AI score0.00288EPSS
SaveExploits0References7
Positive Technologies
Positive Technologies
•added 2026/06/19 12:0 a.m.•44 views

PT-2026-50961

Name of the Vulnerable Software and Affected Versions Joomla Component Myportfolio version 3.0.2 Description An SQL injection allows unauthenticated attackers to manipulate database queries by injecting SQL code. This is achieved by sending GET requests to the 'index.php' endpoint using the...

8.8CVSS5.9AI score0.00394EPSS
SaveExploits1References6
Positive Technologies
Positive Technologies
•added 2026/06/19 12:0 a.m.•44 views

PT-2026-50828

Name of the Vulnerable Software and Affected Versions Mitsubishi Electric MELSEC iQ-F Series FX5-EIP EtherNet/IP module versions 1.000 and prior Description An integer overflow or wraparound in the EtherNet/IP function allows a remote attacker to cause a denial-of-service DoS condition. By rapidl...

8.7CVSS6AI score0.00637EPSS
SaveExploits0References8
Positive Technologies
Positive Technologies
•added 2026/06/18 12:0 a.m.•44 views

PT-2026-50804

Name of the Vulnerable Software and Affected Versions Chef 360 versions prior to 1.7.0 Description A static credential embedded in the software allows unauthenticated access to internal message queues. These queue messages contain tenant-specific identifiers. Recommendations Update to version 1.7...

5.1CVSS5.9AI score0.00271EPSS
SaveExploits0References3
Positive Technologies
Positive Technologies
•added 2026/06/18 12:0 a.m.•44 views

PT-2026-50712

Name of the Vulnerable Software and Affected Versions Webmin affected versions not specified Description Unauthenticated attackers can read the contents of any file ending in .conf within module directories. This is caused by a bypassable regex pattern, which is a sequence of characters used to...

6.9CVSS5.8AI score0.00476EPSS
SaveExploits0References11
Positive Technologies
Positive Technologies
•added 2026/06/18 12:0 a.m.•44 views

PT-2026-50705

Name of the Vulnerable Software and Affected Versions U.S. GAO Electronic Protest Docketing System EPDS affected versions not specified U.S. CBCA Electronic Docketing System EDS affected versions not specified Description The U.S. Government Accountability Office GAO Electronic Protest Docketing...

6.9CVSS5.9AI score0.00505EPSS
SaveExploits0References8
Positive Technologies
Positive Technologies
•added 2026/06/17 12:0 a.m.•44 views

PT-2026-50312

Subscriber Broken Access Control in Bricks Builder = 2.1.4 versions...

4.3CVSS5.2AI score0.00243EPSS
SaveExploits0References1
Positive Technologies
Positive Technologies
•added 2026/06/17 12:0 a.m.•44 views

PT-2026-50369

Missing Authorization vulnerability in Avirtum iPages Flipbook allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects iPages Flipbook: from n/a through 1.5.1...

5.3CVSS5.2AI score0.00249EPSS
SaveExploits0References1
Positive Technologies
Positive Technologies
•added 2026/06/16 12:0 a.m.•44 views

PT-2026-49958

Name of the Vulnerable Software and Affected Versions MySQL Shell Shell for VS Code version 2026.2.0+9.6.1 Description An issue in the Shell for VS Code component of MySQL Shell allows a low-privileged attacker with network access via HTTP to compromise the software. Successful exploitation can...

9.9CVSS5.8AI score0.00521EPSS
SaveExploits0References4
Positive Technologies
Positive Technologies
•added 2026/06/16 12:0 a.m.•44 views

PT-2026-49876

Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware component: Centralized Third Party Jars. The supported version that is affected is 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Coherence...

9.3CVSS5.2AI score0.00338EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
•added 2026/06/16 12:0 a.m.•44 views

PT-2026-49942

Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware component: WebCenter Sites. Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle...

9.1CVSS5.1AI score0.00405EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
•added 2026/06/15 12:0 a.m.•44 views

PT-2026-49301

Name of the Vulnerable Software and Affected Versions Kandji Agent versions prior to 4.7.55374 Description A client validation gap in the software allows a local attacker to escalate privileges and invoke restricted agent functionality. Recommendations Update to version 4.7.55374 or later...

8.4CVSS5.2AI score0.00118EPSS
SaveExploits0References10
Positive Technologies
Positive Technologies
•added 2026/06/12 12:0 a.m.•44 views

PT-2026-48909

Name of the Vulnerable Software and Affected Versions Aqara Board service affected versions not specified Description The Aqara Board service at the endpoint "op-test.aqara.com" accepts arbitrary MQTT command payloads and forwards them to the platform's HiveMQ broker without authentication. This...

9.8CVSS5.4AI score0.00412EPSS
SaveExploits1References6
Positive Technologies
Positive Technologies
•added 2026/06/12 12:0 a.m.•44 views

PT-2026-49055

Name of the Vulnerable Software and Affected Versions Fabric.js versions prior to 7.4.0 Description Improper escaping of user-controlled input during SVG serialization via the toSVG method can lead to Cross-Site Scripting XSS. Specifically, the color field within the colorStops array of a...

6.1CVSS6AI score0.00228EPSS
SaveExploits1References8
Positive Technologies
Positive Technologies
•added 2026/06/12 12:0 a.m.•44 views

PT-2026-48826

Name of the Vulnerable Software and Affected Versions phpBB versions prior to 3.3.17 Description Improper authentication checks in the OAuth implementation allow for account hijacking and unauthorized access in default installations, even if OAuth is not configured or enabled. This authentication...

9.8CVSS8.4AI score0.0386EPSS
SaveExploits2References20
Positive Technologies
Positive Technologies
•added 2026/06/12 12:0 a.m.•44 views

PT-2026-48919

A lack of authorization validation in version 1.0.0 or later of the ChromaDB Rust project allows any authenticated users to arbitrarily read, write, update, or delete data in any tenant's collection regardless of which tenant they belong to...

8.8CVSS5.2AI score0.00279EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
•added 2026/06/12 12:0 a.m.•44 views

PT-2026-48898

Name of the Vulnerable Software and Affected Versions ChromaDB versions 0.4.17 through 0.4.16 Description An authenticated attacker with the UPDATE COLLECTION permission can execute arbitrary code on the server. This occurs by sending a malicious model repository and setting the trust remote code...

9.4CVSS5.9AI score0.00342EPSS
SaveExploits0References11
Positive Technologies
Positive Technologies
•added 2026/06/12 12:0 a.m.•44 views

PT-2026-50785

Name of the Vulnerable Software and Affected Versions OpenBSD versions prior to commit 6a23123 Description An out-of-bounds read exists in the mpls do error function within sys/netmpls/mpls input.c. Remote attackers can disclose kernel stack memory by sending crafted MPLS frames containing 16...

6.9CVSS5.8AI score0.00423EPSS
SaveExploits2References23
Positive Technologies
Positive Technologies
•added 2026/06/11 12:0 a.m.•44 views

PT-2026-48613

Name of the Vulnerable Software and Affected Versions Spring Web Flow version 4.0.0 Spring Web Flow versions 3.0.0 through 3.0.1 Spring Web Flow versions 2.5.0 through 2.5.1 Description Applications that configure the WebFlowELExpressionParser are susceptible to the use of malicious Unified EL...

6.4CVSS5.8AI score0.00225EPSS
SaveExploits0References5
Positive Technologies
Positive Technologies
•added 2026/06/11 12:0 a.m.•44 views

PT-2026-48791

ClipBucket v5 is an open source video sharing platform. Prior to version 5.5.3 - 129, the actions/progress video.php endpoint is vulnerable to blind SQL injection. Any unauthenticated user can exploit the ids parameter to execute SQL queries and exfiltrate sensitive data. This issue has been...

9.8CVSS5.7AI score0.00364EPSS
SaveExploits0References3
Positive Technologies
Positive Technologies
•added 2026/06/10 12:0 a.m.•44 views

PT-2026-48398

Name of the Vulnerable Software and Affected Versions Newsletters plugin for WordPress versions prior to 4.14 Description The plugin is susceptible to time-based SQL Injection, a technique where an attacker sends queries that force the database to wait a specific amount of time before responding,...

7.5CVSS5.6AI score0.01382EPSS
SaveExploits0References7
Positive Technologies
Positive Technologies
•added 2026/06/09 12:0 a.m.•44 views

PT-2026-47991

Name of the Vulnerable Software and Affected Versions Windows DHCP Server affected versions not specified Description An issue in Windows DHCP Server allows an unauthorized attacker to perform tampering over a network, potentially compromising trust within a local area network LAN. Recommendation...

9.4CVSS5.2AI score0.00366EPSS
SaveExploits0References11
Positive Technologies
Positive Technologies
•added 2026/06/09 12:0 a.m.•44 views

PT-2026-48313

Name of the Vulnerable Software and Affected Versions Spring Data Relational/JDBC/R2DBC versions 4.0.0 through 4.0.5 Spring Data Relational/JDBC/R2DBC versions 3.5.0 through 3.5.11 Spring Data Relational/JDBC/R2DBC versions 3.4.0 through 3.4.14 Spring Data Relational/JDBC/R2DBC versions 3.3.0...

4.8CVSS5.8AI score0.00227EPSS
SaveExploits0References3
Positive Technologies
Positive Technologies
•added 2026/06/09 12:0 a.m.•44 views

PT-2026-48276

Format Plugins versions 1.1.2 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file...

7.8CVSS6.2AI score0.00281EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
•added 2026/06/09 12:0 a.m.•44 views

PT-2026-47684

Name of the Vulnerable Software and Affected Versions 6Storage Rentals versions prior to 2.22.1 Description An authorization bypass exists in the 6Storage Rentals plugin for WordPress. Unauthenticated attackers can read and modify arbitrary tenant profile data, including names, email addresses,...

7.5CVSS5.3AI score0.00403EPSS
SaveExploits0References15
Positive Technologies
Positive Technologies
•added 2026/06/08 12:0 a.m.•44 views

PT-2026-47340

Name of the Vulnerable Software and Affected Versions OpenBullet2 versions prior to 0.3.3 Description An authentication bypass exists in the API key authentication middleware. Unauthenticated attackers can gain administrative access to the admin console and all API endpoints by providing an empty...

9.8CVSS5.3AI score0.01824EPSS
SaveExploits1References6
Positive Technologies
Positive Technologies
•added 2026/06/07 12:0 a.m.•44 views

PT-2026-47170

A security vulnerability has been detected in GL.iNet GL-MT3000 4.4.5. The impacted element is the function rpc sys of the file /cgi-bin/luci/rpc of the component LuCI JSON-RPC Interface. Such manipulation leads to command injection. The attack may be performed from remote. Upgrading to version...

6.5CVSS6.2AI score0.01102EPSS
SaveExploits0References7
Positive Technologies
Positive Technologies
•added 2026/06/06 12:0 a.m.•44 views

PT-2026-47123

Name of the Vulnerable Software and Affected Versions Integration for Freshsales – Contact Form 7, WPForms, Elementor, Gravity Forms and More plugin for WordPress versions prior to 1.0.16 Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform...

7.2CVSS5.5AI score0.00314EPSS
SaveExploits0References12
Positive Technologies
Positive Technologies
•added 2026/06/04 12:0 a.m.•44 views

PT-2026-46869

Summary An authenticated tenant can inject arbitrary SQL through the valueProperty or groupBy fields of POST /api/v1/meters. The injection passes the application's JSONPath validation check and executes against the shared ClickHouse database, which contains event data for all tenants with no...

5.3CVSS6.1AI score
SaveExploits0References6
Positive Technologies
Positive Technologies
•added 2026/06/01 12:0 a.m.•44 views

PT-2026-45564

Name of the Vulnerable Software and Affected Versions Dräger Infinity Delta affected versions not specified Dräger Infinity Delta XL affected versions not specified Dräger Infinity Kappa affected versions not specified Description A denial-of-service issue exists where remote attackers can cause...

7.5CVSS5.6AI score0.00413EPSS
SaveExploits0References8
Positive Technologies
Positive Technologies
•added 2026/06/01 12:0 a.m.•44 views

PT-2026-45525

Name of the Vulnerable Software and Affected Versions Nextcloud Server versions 32.0.0 through 32.0.8 Nextcloud Server versions 33.0.0 through 33.0.2 Nextcloud Enterprise Server versions prior to 33.0.3 Nextcloud Enterprise Server versions prior to 32.0.9 Nextcloud Enterprise Server versions prio...

8.1CVSS5.8AI score0.00284EPSS
SaveExploits0References8
Positive Technologies
Positive Technologies
•added 2026/05/29 12:0 a.m.•44 views

PT-2026-44845

Name of the Vulnerable Software and Affected Versions Home Assistant Companion app for iOS versions prior to 2026.4.1 Home Assistant Companion app for Android versions prior to 2026.4.4 Description The Home Assistant Companion apps for Android and iOS expose a JavaScript bridge to the in-app...

8.3CVSS6AI score0.00136EPSS
SaveExploits0References4
Positive Technologies
Positive Technologies
•added 2026/05/29 12:0 a.m.•44 views

PT-2026-44908

Name of the Vulnerable Software and Affected Versions Froxlor versions 2.3.6 and earlier Description DNS record content is concatenated directly into bind9 zone files in the DnsEntry.php file, which allows for zone file injection. The issue stems from incomplete validation of LOC, RP, SSHFP, and...

8.6CVSS6AI score0.00269EPSS
SaveExploits0References7
Positive Technologies
Positive Technologies
•added 2026/05/28 12:0 a.m.•44 views

PT-2026-44218

The PDF Embedder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.9.3 via the enqueue block assets. This makes it possible for authenticated attackers, with contributor-level access and above, to extract configuration data. License key...

4.3CVSS5.8AI score0.00376EPSS
SaveExploits0References7
Positive Technologies
Positive Technologies
•added 2026/05/28 12:0 a.m.•44 views

PT-2026-44331

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description In the batman-adv module, TP meter sessions remain linked on bat priv-tp list after a netlink request finishes. When the mesh interface is removed, the batadv mesh free function tears do...

7.8CVSS6AI score0.00139EPSS
SaveExploits0
Positive Technologies
Positive Technologies
•added 2026/05/27 12:0 a.m.•44 views

PT-2026-43573

The WPCode - Insert Headers and Footers + Custom Code Snippets - WordPress Code Manager plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 2.3.5 This is due to the 'wpcode' custom post type being registered without a custom capability type or capability...

8.8CVSS5.8AI score0.01862EPSS
SaveExploits2References9
Positive Technologies
Positive Technologies
•added 2026/05/27 12:0 a.m.•44 views

PT-2026-43904

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified openSUSE Tumbleweed versions prior to kernel-devel-7.0.11-1.1 Description A flaw exists in the IPv4 ICMP implementation where the system fails to validate the reply type before accessing the icmp...

8.2CVSS6AI score0.00433EPSS
SaveExploits0
Positive Technologies
Positive Technologies
•added 2026/05/23 12:0 a.m.•44 views

PT-2026-42877

Name of the Vulnerable Software and Affected Versions omec-project amf versions prior to 2.1.2 Description A flaw in the PDUSessionResourceModifyIndication function within the /go/src/amf/ngap/handler.go file can lead to memory corruption. This issue allows for remote exploitation. Recommendation...

6.5CVSS6.6AI score0.00229EPSS
SaveExploits0
Positive Technologies
Positive Technologies
•added 2026/05/21 12:0 a.m.•44 views

PT-2026-42476

Name of the Vulnerable Software and Affected Versions Uncrustify version Uncrustify d-0.82.0-132-bcc41cbdc Description A buffer overflow allows a local attacker to cause a denial of service. This issue occurs within the uncrustify executable components, specifically involving the check template...

6.2CVSS6.1AI score0.00134EPSS
SaveExploits0References11
Positive Technologies
Positive Technologies
•added 2026/05/19 12:0 a.m.•44 views

PT-2026-42038

Name of the Vulnerable Software and Affected Versions Nuxt versions 3.1.0 through 3.21.5 Nuxt versions 4.0.0-alpha.1 through 4.4.5 @nuxt/nitro-server versions 3.20.0 through 3.21.5 @nuxt/nitro-server versions 4.0.0-alpha.1 through 4.4.5 Description The '/ nuxt island/' endpoint accepts...

5.4CVSS5.2AI score0.00091EPSS
SaveExploits0References8
Positive Technologies
Positive Technologies
•added 2026/05/14 12:0 a.m.•44 views

PT-2026-41157

Name of the Vulnerable Software and Affected Versions electerm versions prior to 3.8.9 Description Persistent local-pty code execution is possible through the import of bookmark JSON files or compromised synchronization targets such as gist or WebDAV. An attacker can inject exec fields or global...

9.4CVSS6.4AI score0.00234EPSS
SaveExploits0References7
Positive Technologies
Positive Technologies
•added 2026/05/13 12:0 a.m.•44 views

PT-2026-40839

Name of the Vulnerable Software and Affected Versions Date iCal versions 0.0.0 through 4.0.14 Description A missing authorization issue in the Date iCal module, which exports entity date fields as iCal feeds, allows forceful browsing. The module fails to sufficiently check entity or field access...

9.8CVSS5.8AI score0.00369EPSS
SaveExploits0References11
Positive Technologies
Positive Technologies
•added 2026/05/12 12:0 a.m.•44 views

PT-2026-40265

Name of the Vulnerable Software and Affected Versions FortiAuthenticator versions 8.0.0 through 8.0.2 FortiAuthenticator versions 6.6.0 through 6.6.8 FortiAuthenticator versions 6.5.0 through 6.5.6 Description An improper access control issue in API endpoints allows an unauthenticated remote...

9.8CVSS6.2AI score0.00551EPSS
SaveExploits0References27
Positive Technologies
Positive Technologies
•added 2026/05/12 12:0 a.m.•44 views

PT-2026-39992

Name of the Vulnerable Software and Affected Versions Solid Edge SE2026 versions prior to V226.0 Update 5 Description An issue exists where the application is susceptible to uninitialized pointer access during the parsing of specially crafted PAR files. This could allow an attacker to execute...

7.8CVSS7.5AI score0.00105EPSS
SaveExploits0References6
Positive Technologies
Positive Technologies
•added 2026/05/12 12:0 a.m.•44 views

PT-2026-40458

Name of the Vulnerable Software and Affected Versions ChurchCRM versions prior to 7.3.2 Description A pre-authentication remote code execution issue exists in the setup wizard. The flaw allows for remote code execution via the unsanitized DB PASSWORD variable. Recommendations Update to version...

10CVSS6.4AI score0.00576EPSS
SaveExploits0References4
Positive Technologies
Positive Technologies
•added 2026/05/11 12:0 a.m.•44 views

PT-2026-39880

Name of the Vulnerable Software and Affected Versions Mantis Bug Tracker MantisBT versions prior to 2.28.2 Description Flawed logic in the Update Issue page 'bug update page.php' causes improper escaping of textarea custom field contents. This allows an authenticated user with low-privilege bug...

5.4CVSS6.2AI score0.0023EPSS
SaveExploits0References6
Positive Technologies
Positive Technologies
•added 2026/05/08 12:0 a.m.•44 views

PT-2026-38912

Name of the Vulnerable Software and Affected Versions DrayTek Vigor 2960 versions prior to 1.5.1.4 Description An OS command injection issue exists in the CGI login handler. Unauthenticated remote attackers can execute arbitrary commands with web server privileges by injecting shell metacharacter...

9.2CVSS6.1AI score0.01432EPSS
SaveExploits0References5
Positive Technologies
Positive Technologies
•added 2026/05/07 12:0 a.m.•44 views

PT-2026-38610

Name of the Vulnerable Software and Affected Versions FacturaScripts affected versions not specified Description A flaw in the Plugins::add function allows for a Zip Slip attack. The system does not properly validate file paths within uploaded ZIP archives in the Plugins.php file. Although the...

7.2CVSS6.2AI score0.00522EPSS
SaveExploits0References8
Positive Technologies
Positive Technologies
•added 2026/05/01 12:0 a.m.•44 views

PT-2026-36543

Name of the Vulnerable Software and Affected Versions bandit versions 0.5.0 through 1.10.x Description An allocation of resources without limits or throttling allows unauthenticated remote denial of service via memory exhaustion. The fragment reassembly path in the handle frame/3 function within...

8.7CVSS5.8AI score0.00549EPSS
SaveExploits0References14
Total number of security vulnerabilities5000