Lucene search
+L
PtsecurityMost viewed

200190 matches found

Positive Technologies
Positive Technologies
•added 2026/06/17 12:0 a.m.•44 views

PT-2026-50369

Missing Authorization vulnerability in Avirtum iPages Flipbook allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects iPages Flipbook: from n/a through 1.5.1...

5.3CVSS5.2AI score0.00249EPSS
SaveExploits0References1
Positive Technologies
Positive Technologies
•added 2026/06/16 12:0 a.m.•44 views

PT-2026-49958

Name of the Vulnerable Software and Affected Versions MySQL Shell Shell for VS Code version 2026.2.0+9.6.1 Description An issue in the Shell for VS Code component of MySQL Shell allows a low-privileged attacker with network access via HTTP to compromise the software. Successful exploitation can...

9.9CVSS5.8AI score0.00521EPSS
SaveExploits0References4
Positive Technologies
Positive Technologies
•added 2026/06/16 12:0 a.m.•44 views

PT-2026-49942

Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware component: WebCenter Sites. Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle...

9.1CVSS5.1AI score0.00405EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
•added 2026/06/15 12:0 a.m.•44 views

PT-2026-49301

Name of the Vulnerable Software and Affected Versions Kandji Agent versions prior to 4.7.55374 Description A client validation gap in the software allows a local attacker to escalate privileges and invoke restricted agent functionality. Recommendations Update to version 4.7.55374 or later...

8.4CVSS5.2AI score0.00118EPSS
SaveExploits0References10
Positive Technologies
Positive Technologies
•added 2026/06/12 12:0 a.m.•44 views

PT-2026-48909

Name of the Vulnerable Software and Affected Versions Aqara Board service affected versions not specified Description The Aqara Board service at the endpoint "op-test.aqara.com" accepts arbitrary MQTT command payloads and forwards them to the platform's HiveMQ broker without authentication. This...

9.8CVSS5.4AI score0.00412EPSS
SaveExploits1References6
Positive Technologies
Positive Technologies
•added 2026/06/12 12:0 a.m.•44 views

PT-2026-49055

Name of the Vulnerable Software and Affected Versions Fabric.js versions prior to 7.4.0 Description Improper escaping of user-controlled input during SVG serialization via the toSVG method can lead to Cross-Site Scripting XSS. Specifically, the color field within the colorStops array of a...

6.1CVSS6AI score0.00228EPSS
SaveExploits1References8
Positive Technologies
Positive Technologies
•added 2026/06/12 12:0 a.m.•44 views

PT-2026-48826

Name of the Vulnerable Software and Affected Versions phpBB versions prior to 3.3.17 Description Improper authentication checks in the OAuth implementation allow for account hijacking and unauthorized access in default installations, even if OAuth is not configured or enabled. This authentication...

9.8CVSS8.4AI score0.0386EPSS
SaveExploits2References20
Positive Technologies
Positive Technologies
•added 2026/06/12 12:0 a.m.•44 views

PT-2026-48919

A lack of authorization validation in version 1.0.0 or later of the ChromaDB Rust project allows any authenticated users to arbitrarily read, write, update, or delete data in any tenant's collection regardless of which tenant they belong to...

8.8CVSS5.2AI score0.00279EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
•added 2026/06/12 12:0 a.m.•44 views

PT-2026-48898

Name of the Vulnerable Software and Affected Versions ChromaDB versions 0.4.17 through 0.4.16 Description An authenticated attacker with the UPDATE COLLECTION permission can execute arbitrary code on the server. This occurs by sending a malicious model repository and setting the trust remote code...

9.4CVSS5.9AI score0.00342EPSS
SaveExploits0References11
Positive Technologies
Positive Technologies
•added 2026/06/11 12:0 a.m.•44 views

PT-2026-48613

Name of the Vulnerable Software and Affected Versions Spring Web Flow version 4.0.0 Spring Web Flow versions 3.0.0 through 3.0.1 Spring Web Flow versions 2.5.0 through 2.5.1 Description Applications that configure the WebFlowELExpressionParser are susceptible to the use of malicious Unified EL...

6.4CVSS5.8AI score0.00225EPSS
SaveExploits0References5
Positive Technologies
Positive Technologies
•added 2026/06/10 12:0 a.m.•44 views

PT-2026-48398

Name of the Vulnerable Software and Affected Versions Newsletters plugin for WordPress versions prior to 4.14 Description The plugin is susceptible to time-based SQL Injection, a technique where an attacker sends queries that force the database to wait a specific amount of time before responding,...

7.5CVSS5.6AI score0.01382EPSS
SaveExploits0References7
Positive Technologies
Positive Technologies
•added 2026/06/09 12:0 a.m.•44 views

PT-2026-47991

Name of the Vulnerable Software and Affected Versions Windows DHCP Server affected versions not specified Description An issue in Windows DHCP Server allows an unauthorized attacker to perform tampering over a network, potentially compromising trust within a local area network LAN. Recommendation...

9.4CVSS5.2AI score0.00366EPSS
SaveExploits0References11
Positive Technologies
Positive Technologies
•added 2026/06/09 12:0 a.m.•44 views

PT-2026-48313

Name of the Vulnerable Software and Affected Versions Spring Data Relational/JDBC/R2DBC versions 4.0.0 through 4.0.5 Spring Data Relational/JDBC/R2DBC versions 3.5.0 through 3.5.11 Spring Data Relational/JDBC/R2DBC versions 3.4.0 through 3.4.14 Spring Data Relational/JDBC/R2DBC versions 3.3.0...

4.8CVSS5.8AI score0.00227EPSS
SaveExploits0References3
Positive Technologies
Positive Technologies
•added 2026/06/09 12:0 a.m.•44 views

PT-2026-48276

Format Plugins versions 1.1.2 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file...

7.8CVSS6.2AI score0.00281EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
•added 2026/06/09 12:0 a.m.•44 views

PT-2026-47684

Name of the Vulnerable Software and Affected Versions 6Storage Rentals versions prior to 2.22.1 Description An authorization bypass exists in the 6Storage Rentals plugin for WordPress. Unauthenticated attackers can read and modify arbitrary tenant profile data, including names, email addresses,...

7.5CVSS5.3AI score0.00403EPSS
SaveExploits0References15
Positive Technologies
Positive Technologies
•added 2026/06/08 12:0 a.m.•44 views

PT-2026-47340

Name of the Vulnerable Software and Affected Versions OpenBullet2 versions prior to 0.3.3 Description An authentication bypass exists in the API key authentication middleware. Unauthenticated attackers can gain administrative access to the admin console and all API endpoints by providing an empty...

9.8CVSS5.3AI score0.01824EPSS
SaveExploits1References6
Positive Technologies
Positive Technologies
•added 2026/06/07 12:0 a.m.•44 views

PT-2026-47170

A security vulnerability has been detected in GL.iNet GL-MT3000 4.4.5. The impacted element is the function rpc sys of the file /cgi-bin/luci/rpc of the component LuCI JSON-RPC Interface. Such manipulation leads to command injection. The attack may be performed from remote. Upgrading to version...

6.5CVSS6.2AI score0.01102EPSS
SaveExploits0References7
Positive Technologies
Positive Technologies
•added 2026/06/06 12:0 a.m.•44 views

PT-2026-47123

Name of the Vulnerable Software and Affected Versions Integration for Freshsales – Contact Form 7, WPForms, Elementor, Gravity Forms and More plugin for WordPress versions prior to 1.0.16 Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform...

7.2CVSS5.5AI score0.00314EPSS
SaveExploits0References12
Positive Technologies
Positive Technologies
•added 2026/06/04 12:0 a.m.•44 views

PT-2026-46869

Summary An authenticated tenant can inject arbitrary SQL through the valueProperty or groupBy fields of POST /api/v1/meters. The injection passes the application's JSONPath validation check and executes against the shared ClickHouse database, which contains event data for all tenants with no...

5.3CVSS6.1AI score
SaveExploits0References6
Positive Technologies
Positive Technologies
•added 2026/06/01 12:0 a.m.•44 views

PT-2026-45564

Name of the Vulnerable Software and Affected Versions Dräger Infinity Delta affected versions not specified Dräger Infinity Delta XL affected versions not specified Dräger Infinity Kappa affected versions not specified Description A denial-of-service issue exists where remote attackers can cause...

7.5CVSS5.6AI score0.00413EPSS
SaveExploits0References8
Positive Technologies
Positive Technologies
•added 2026/06/01 12:0 a.m.•44 views

PT-2026-45525

Name of the Vulnerable Software and Affected Versions Nextcloud Server versions 32.0.0 through 32.0.8 Nextcloud Server versions 33.0.0 through 33.0.2 Nextcloud Enterprise Server versions prior to 33.0.3 Nextcloud Enterprise Server versions prior to 32.0.9 Nextcloud Enterprise Server versions prio...

8.1CVSS5.8AI score0.00284EPSS
SaveExploits0References8
Positive Technologies
Positive Technologies
•added 2026/05/29 12:0 a.m.•44 views

PT-2026-44845

Name of the Vulnerable Software and Affected Versions Home Assistant Companion app for iOS versions prior to 2026.4.1 Home Assistant Companion app for Android versions prior to 2026.4.4 Description The Home Assistant Companion apps for Android and iOS expose a JavaScript bridge to the in-app...

8.3CVSS6AI score0.00136EPSS
SaveExploits0References4
Positive Technologies
Positive Technologies
•added 2026/05/29 12:0 a.m.•44 views

PT-2026-44908

Name of the Vulnerable Software and Affected Versions Froxlor versions 2.3.6 and earlier Description DNS record content is concatenated directly into bind9 zone files in the DnsEntry.php file, which allows for zone file injection. The issue stems from incomplete validation of LOC, RP, SSHFP, and...

8.6CVSS6AI score0.00269EPSS
SaveExploits0References7
Positive Technologies
Positive Technologies
•added 2026/05/28 12:0 a.m.•44 views

PT-2026-44218

The PDF Embedder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.9.3 via the enqueue block assets. This makes it possible for authenticated attackers, with contributor-level access and above, to extract configuration data. License key...

4.3CVSS5.8AI score0.00376EPSS
SaveExploits0References7
Positive Technologies
Positive Technologies
•added 2026/05/28 12:0 a.m.•44 views

PT-2026-44331

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description In the batman-adv module, TP meter sessions remain linked on bat priv-tp list after a netlink request finishes. When the mesh interface is removed, the batadv mesh free function tears do...

7.8CVSS6AI score0.00139EPSS
SaveExploits0
Positive Technologies
Positive Technologies
•added 2026/05/27 12:0 a.m.•44 views

PT-2026-43573

The WPCode - Insert Headers and Footers + Custom Code Snippets - WordPress Code Manager plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 2.3.5 This is due to the 'wpcode' custom post type being registered without a custom capability type or capability...

8.8CVSS5.8AI score0.01862EPSS
SaveExploits2References9
Positive Technologies
Positive Technologies
•added 2026/05/27 12:0 a.m.•44 views

PT-2026-43904

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified openSUSE Tumbleweed versions prior to kernel-devel-7.0.11-1.1 Description A flaw exists in the IPv4 ICMP implementation where the system fails to validate the reply type before accessing the icmp...

8.2CVSS6AI score0.00433EPSS
SaveExploits0
Positive Technologies
Positive Technologies
•added 2026/05/23 12:0 a.m.•44 views

PT-2026-42877

Name of the Vulnerable Software and Affected Versions omec-project amf versions prior to 2.1.2 Description A flaw in the PDUSessionResourceModifyIndication function within the /go/src/amf/ngap/handler.go file can lead to memory corruption. This issue allows for remote exploitation. Recommendation...

6.5CVSS6.6AI score0.00229EPSS
SaveExploits0
Positive Technologies
Positive Technologies
•added 2026/05/21 12:0 a.m.•44 views

PT-2026-42476

Name of the Vulnerable Software and Affected Versions Uncrustify version Uncrustify d-0.82.0-132-bcc41cbdc Description A buffer overflow allows a local attacker to cause a denial of service. This issue occurs within the uncrustify executable components, specifically involving the check template...

6.2CVSS6.1AI score0.00134EPSS
SaveExploits0References11
Positive Technologies
Positive Technologies
•added 2026/05/14 12:0 a.m.•44 views

PT-2026-41157

Name of the Vulnerable Software and Affected Versions electerm versions prior to 3.8.9 Description Persistent local-pty code execution is possible through the import of bookmark JSON files or compromised synchronization targets such as gist or WebDAV. An attacker can inject exec fields or global...

9.4CVSS6.4AI score0.00234EPSS
SaveExploits0References7
Positive Technologies
Positive Technologies
•added 2026/05/13 12:0 a.m.•44 views

PT-2026-40839

Name of the Vulnerable Software and Affected Versions Date iCal versions 0.0.0 through 4.0.14 Description A missing authorization issue in the Date iCal module, which exports entity date fields as iCal feeds, allows forceful browsing. The module fails to sufficiently check entity or field access...

9.8CVSS5.8AI score0.00369EPSS
SaveExploits0References11
Positive Technologies
Positive Technologies
•added 2026/05/12 12:0 a.m.•44 views

PT-2026-40265

Name of the Vulnerable Software and Affected Versions FortiAuthenticator versions 8.0.0 through 8.0.2 FortiAuthenticator versions 6.6.0 through 6.6.8 FortiAuthenticator versions 6.5.0 through 6.5.6 Description An improper access control issue in API endpoints allows an unauthenticated remote...

9.8CVSS6.2AI score0.00551EPSS
SaveExploits0References27
Positive Technologies
Positive Technologies
•added 2026/05/12 12:0 a.m.•44 views

PT-2026-39992

Name of the Vulnerable Software and Affected Versions Solid Edge SE2026 versions prior to V226.0 Update 5 Description An issue exists where the application is susceptible to uninitialized pointer access during the parsing of specially crafted PAR files. This could allow an attacker to execute...

7.8CVSS7.5AI score0.00105EPSS
SaveExploits0References6
Positive Technologies
Positive Technologies
•added 2026/05/12 12:0 a.m.•44 views

PT-2026-40458

Name of the Vulnerable Software and Affected Versions ChurchCRM versions prior to 7.3.2 Description A pre-authentication remote code execution issue exists in the setup wizard. The flaw allows for remote code execution via the unsanitized DB PASSWORD variable. Recommendations Update to version...

10CVSS6.4AI score0.00576EPSS
SaveExploits0References4
Positive Technologies
Positive Technologies
•added 2026/05/11 12:0 a.m.•44 views

PT-2026-39880

Name of the Vulnerable Software and Affected Versions Mantis Bug Tracker MantisBT versions prior to 2.28.2 Description Flawed logic in the Update Issue page 'bug update page.php' causes improper escaping of textarea custom field contents. This allows an authenticated user with low-privilege bug...

5.4CVSS6.2AI score0.0023EPSS
SaveExploits0References6
Positive Technologies
Positive Technologies
•added 2026/05/08 12:0 a.m.•44 views

PT-2026-38912

Name of the Vulnerable Software and Affected Versions DrayTek Vigor 2960 versions prior to 1.5.1.4 Description An OS command injection issue exists in the CGI login handler. Unauthenticated remote attackers can execute arbitrary commands with web server privileges by injecting shell metacharacter...

9.2CVSS6.1AI score0.01432EPSS
SaveExploits0References5
Positive Technologies
Positive Technologies
•added 2026/05/07 12:0 a.m.•44 views

PT-2026-38610

Name of the Vulnerable Software and Affected Versions FacturaScripts affected versions not specified Description A flaw in the Plugins::add function allows for a Zip Slip attack. The system does not properly validate file paths within uploaded ZIP archives in the Plugins.php file. Although the...

7.2CVSS6.2AI score0.00522EPSS
SaveExploits0References8
Positive Technologies
Positive Technologies
•added 2026/05/01 12:0 a.m.•44 views

PT-2026-36543

Name of the Vulnerable Software and Affected Versions bandit versions 0.5.0 through 1.10.x Description An allocation of resources without limits or throttling allows unauthenticated remote denial of service via memory exhaustion. The fragment reassembly path in the handle frame/3 function within...

8.7CVSS5.8AI score0.00549EPSS
SaveExploits0References14
Positive Technologies
Positive Technologies
•added 2026/04/20 12:0 a.m.•44 views

PT-2026-33809

A vulnerability was found in ericc-ch copilot-api up to 0.7.0. The impacted element is the function cors of the file src/server.ts of the component Token Endpoint. Performing a manipulation results in permissive cross-domain policy with untrusted domains. It is possible to initiate the attack...

7.5CVSS5.4AI score0.00182EPSS
SaveExploits0References6
Positive Technologies
Positive Technologies
•added 2026/04/17 12:0 a.m.•44 views

PT-2026-33515

radare2 prior to commit bc5a890 contains a command injection vulnerability in the afsv/afsvj command path where crafted ELF binaries can embed malicious r2 command sequences as DWARF DW TAG formal parameter names. Attackers can craft a binary with shell commands in DWARF parameter names that...

8.5CVSS6.2AI score0.00915EPSS
SaveExploits1References6
Positive Technologies
Positive Technologies
•added 2026/04/13 12:0 a.m.•44 views

PT-2026-32267

Improper check for exceptional conditions in Recents prior to SMR Apr-2026 Release 1 allows physical attacker to bypass App Pinning...

4.1CVSS5.8AI score0.00227EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
•added 2026/04/06 12:0 a.m.•44 views

PT-2026-30712

Workbench is a suite of tools for administrators and developers to interact with Salesforce.com organizations via the Force.com APIs. Prior to 65.0.0, Workbench contains remote code execution vulnerability in the timezone conversion flow, which processes attacker-controlled cookie values in an...

9.3CVSS6.5AI score0.00491EPSS
SaveExploits0References3
Positive Technologies
Positive Technologies
•added 2026/03/05 12:0 a.m.•44 views

PT-2026-51776

Name of the Vulnerable Software and Affected Versions Flowise versions prior to 3.0.13 Description The software uses bcrypt with a default salt round value of 5, resulting in only 32 iterations. This is significantly lower than the OWASP-recommended minimum of 10 rounds 1024 iterations. This...

5.6CVSS5.8AI score0.00073EPSS
SaveExploits0References9
Positive Technologies
Positive Technologies
•added 2026/02/08 12:0 a.m.•44 views

PT-2026-6963

Name of the Vulnerable Software and Affected Versions Tenda TX3 versions up to 16.03.13.11 multi Description A flaw exists in Tenda TX3 that allows remote attackers to trigger a buffer overflow. The issue is located in the file /goform/SetIpMacBind and involves manipulation of the argument list t...

9CVSS8.4AI score0.00733EPSS
SaveExploits1References13
Positive Technologies
Positive Technologies
•added 2026/02/06 12:0 a.m.•44 views

PT-2026-6692

Name of the Vulnerable Software and Affected Versions Code Snippets plugin for WordPress versions up to and including 3.9.4 Description The Code Snippets plugin for WordPress is susceptible to Cross-Site Request Forgery. This is a result of a lack of nonce validation on the cloud snippet download...

4.3CVSS5.5AI score0.00191EPSS
SaveExploits0References10
Positive Technologies
Positive Technologies
•added 2026/01/20 12:0 a.m.•44 views

PT-2026-4329

Name of the Vulnerable Software and Affected Versions HPE Alletra 6000/5000 and Nimble Storage versions prior to 6.1.2.800 HPE Alletra 6000/5000 and Nimble Storage versions prior to 6.1.3.300 Description A privilege escalation flaw exists in HPE Alletra 6000/5000 and Nimble Storage arrays. An...

9CVSS5.3AI score
SaveExploits0References8
Positive Technologies
Positive Technologies
•added 2026/01/10 12:0 a.m.•44 views

PT-2026-2250

Name of the Vulnerable Software and Affected Versions RustCrypto versions 0.14.0-pre.0 through 0.14.0-rc.0 Description The RustCrypto Elliptic Curves library provides Elliptic Curve Cryptography ECC support. A denial-of-service issue exists in the SM2 public-key encryption implementation where...

7.5CVSS6.6AI score0.00284EPSS
SaveExploits1References10
Positive Technologies
Positive Technologies
•added 2026/01/09 12:0 a.m.•44 views

PT-2026-2228

Name of the Vulnerable Software and Affected Versions Fickling versions prior to 0.1.7 Description Fickling, a Python pickling decompiler and static analyzer, does not explicitly block the ctypes and pydoc modules in versions prior to 0.1.7. Combining these modules can lead to Remote Code Executi...

9.3CVSS7AI score0.00347EPSS
SaveExploits0References17
Positive Technologies
Positive Technologies
•added 2026/01/01 12:0 a.m.•44 views

PT-2026-1002

Name of the Vulnerable Software and Affected Versions feast-dev/feast version 0.53.0 Description A high-severity remote code execution issue exists in the Kubernetes materializer job located at feast/sdk/python/feast/infra/compute engines/kubernetes/main.py. The problem stems from using...

7.8CVSS8.1AI score0.00268EPSS
SaveExploits0References19
Positive Technologies
Positive Technologies
•added 2026/01/01 12:0 a.m.•44 views

PT-2026-6179

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A flaw exists in the Linux kernel’s fs/writeback functionality, specifically within the wait sb inodes function. The issue involves skipping AS NO DATA INTEGRITY mappings, which can caus...

9.8CVSS5.5AI score0.00817EPSS
SaveExploits6References294
Total number of security vulnerabilities5000