Lucene search
+L
PtsecurityMost viewed

200310 matches found

Positive Technologies
Positive Technologies
added 2026/06/18 12:0 a.m.43 views

PT-2026-56002

Name of the Vulnerable Software and Affected Versions Crawl4AI versions prior to 0.9.0 Description An issue exists when the crawler saves downloaded files, as the destination filename is derived from attacker-influenced input and joined to the downloads directory without proper confinement. This...

9.6CVSS6.5AI score0.00596EPSS
SaveExploits1References9
Positive Technologies
Positive Technologies
added 2026/06/18 12:0 a.m.43 views

PT-2026-50625

The Advanced Order Export For WooCommerce plugin for WordPress is vulnerable to generic SQL Injection via the 'sort direction' parameter in all versions up to, and including, 4.0.10 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...

4.9CVSS5.8AI score0.00474EPSS
SaveExploits0References14
Positive Technologies
Positive Technologies
added 2026/06/18 12:0 a.m.43 views

PT-2026-50659

Name of the Vulnerable Software and Affected Versions googleapis/mcp-toolbox affected versions not specified Description An authentication bypass exists in the generic opaque token validation path validateOpaqueToken. When verifying an unparsed opaque token via an OAuth 2.0 introspection endpoint...

9.3CVSS5.8AI score0.00176EPSS
SaveExploits0
Positive Technologies
Positive Technologies
added 2026/06/18 12:0 a.m.43 views

PT-2026-50676

Name of the Vulnerable Software and Affected Versions Docker Sandboxes affected versions not specified Description Docker Sandboxes sbx fail to re-apply the ICMP egress authorizer to networks rebuilt from disk after a Docker daemon restart. This allows a restart-surviving sandbox to forward ICMP...

5.7CVSS6AI score0.0014EPSS
SaveExploits0References8
Positive Technologies
Positive Technologies
added 2026/06/17 12:0 a.m.43 views

PT-2026-50208

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 149.0.7827.155 Description An inappropriate implementation in the Passwords component allows a remote attacker to leak cross-origin data. This occurs when a user is convinced to perform specific UI gestures on a...

9.6CVSS5.9AI score0.00613EPSS
SaveExploits0References40
Positive Technologies
Positive Technologies
added 2026/06/16 12:0 a.m.43 views

PT-2026-50048

Vulnerability in the Oracle Advanced Outbound Telephony product of Oracle E-Business Suite component: Internal Operations. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle...

8.8CVSS5.3AI score0.00411EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
added 2026/06/16 12:0 a.m.43 views

PT-2026-49968

Name of the Vulnerable Software and Affected Versions MySQL Router versions 9.0.0 through 9.7.0 Description An issue in the General component of MySQL Router allows an unauthenticated attacker with network access via HTTP to compromise the system. Successful exploitation can lead to a complete...

9.8CVSS5.8AI score0.00473EPSS
SaveExploits0References3
Positive Technologies
Positive Technologies
added 2026/06/16 12:0 a.m.43 views

PT-2026-49902

Name of the Vulnerable Software and Affected Versions Oracle VM VirtualBox version 7.2.8 Description An issue exists in the VMSVGA device component of Oracle VM VirtualBox. A high-privileged attacker with access to the infrastructure where the software executes can compromise the system. This may...

6CVSS5.8AI score0.0015EPSS
SaveExploits0References4
Positive Technologies
Positive Technologies
added 2026/06/16 12:0 a.m.43 views

PT-2026-49892

Name of the Vulnerable Software and Affected Versions Oracle WebCenter Content version 12.2.1.4.0 Oracle WebCenter Content version 14.1.2.0.0 Description An issue exists in the Content Server component of the Oracle WebCenter Content product within Oracle Fusion Middleware. A low privileged...

9.9CVSS5.9AI score0.00411EPSS
SaveExploits0References5
Positive Technologies
Positive Technologies
added 2026/06/16 12:0 a.m.43 views

PT-2026-50141

Name of the Vulnerable Software and Affected Versions Langflow versions prior to 1.9.0 Description Langflow contains a path traversal flaw in the Knowledge Bases API endpoint 'POST /api/v1/knowledge bases'. The issue resides in the create knowledge base function, where the name variable is used t...

6.5CVSS6AI score0.00348EPSS
SaveExploits1References12
Positive Technologies
Positive Technologies
added 2026/06/16 12:0 a.m.43 views

PT-2026-49851

Name of the Vulnerable Software and Affected Versions PeopleSoft Enterprise PT PeopleTools versions 8.61 PeopleSoft Enterprise PT PeopleTools versions 8.62 Description An issue exists in the Application Server component of Oracle PeopleSoft. This flaw allows an unauthenticated attacker with netwo...

8.1CVSS5.8AI score0.00416EPSS
SaveExploits0References4
Positive Technologies
Positive Technologies
added 2026/06/16 12:0 a.m.43 views

PT-2026-49881

Name of the Vulnerable Software and Affected Versions Oracle Coherence versions 12.2.1.4.0 Oracle Coherence versions 14.1.1.0.0 Oracle Coherence versions 14.1.2.0.0 Oracle Coherence versions 15.1.1.0.0 Description An issue in the Core component of Oracle Fusion Middleware allows an unauthenticate...

9.8CVSS5.8AI score0.00483EPSS
SaveExploits0References5
Positive Technologies
Positive Technologies
added 2026/06/16 12:0 a.m.43 views

PT-2026-49822

In ServerCo getssl version 2.49 and prior, the ACME challenge token returned to the client was not strictly validated against RFC 8555 before being used in challenge-file handling, allowing a maliciously crafted token to influence local path/filename usage during validation. An attacker who can...

7.4CVSS5.4AI score0.00757EPSS
SaveExploits0References8
Positive Technologies
Positive Technologies
added 2026/06/16 12:0 a.m.43 views

PT-2026-49986

Name of the Vulnerable Software and Affected Versions JD Edwards EnterpriseOne Tools versions 9.2.0.0 through 9.2.26.2 Description An issue exists in the Enterprise Infrastructure Security component of Oracle JD Edwards. An unauthenticated attacker with network access via JDENET can compromise th...

9.8CVSS5.8AI score0.00483EPSS
SaveExploits0References3
Positive Technologies
Positive Technologies
added 2026/06/16 12:0 a.m.43 views

PT-2026-50020

Name of the Vulnerable Software and Affected Versions JD Edwards EnterpriseOne Tools versions 9.2.0.0 through 9.2.26.2 Description An issue exists in the Installation Security component of JD Edwards EnterpriseOne Tools. An unauthenticated attacker with access to the infrastructure where the...

9.3CVSS5.9AI score0.0014EPSS
SaveExploits0References3
Positive Technologies
Positive Technologies
added 2026/06/16 12:0 a.m.43 views

PT-2026-50064

Name of the Vulnerable Software and Affected Versions Oracle Universal Work Queue versions 12.2.3 through 12.2.15 Description An issue exists in the Work Provider Site Level Administration component of the Oracle Universal Work Queue product within Oracle E-Business Suite. A low privileged attack...

8.8CVSS5.8AI score0.00411EPSS
SaveExploits0References3
Positive Technologies
Positive Technologies
added 2026/06/16 12:0 a.m.43 views

PT-2026-49981

Name of the Vulnerable Software and Affected Versions Oracle VM VirtualBox version 7.2.8 Description An issue exists in the VMSVGA device component of Oracle VM VirtualBox. A high-privileged attacker with logon access to the infrastructure where the software executes can compromise the system,...

7.5CVSS5.8AI score0.00114EPSS
SaveExploits0References7
Positive Technologies
Positive Technologies
added 2026/06/15 12:0 a.m.43 views

PT-2026-49228

Authentication Bypass Using an Alternate Path or Channel vulnerability in WP Engine Faust.Js allows Password Recovery Exploitation. This issue affects Faust.Js: from n/a through 1.8.7...

8.8CVSS5.2AI score0.0029EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
added 2026/06/13 12:0 a.m.43 views

PT-2026-49097

SQL Injection in reports/catalogue out.pl in Koha Community Koha through 22.11.37, 23.x, 24.x before 24.11.16, 25.05.x before 25.05.11, 25.11.x before 25.11.05, 26.05.x before 26.05.01, and 26.11.x before 26.11.00 allows an authenticated staff user with the Reports module flag to read arbitrary...

7.6CVSS9AI score0.00244EPSS
SaveExploits0References6
Positive Technologies
Positive Technologies
added 2026/06/12 12:0 a.m.43 views

PT-2026-48938

Name of the Vulnerable Software and Affected Versions Mattermost versions prior to 11.6.2 Mattermost versions prior to 11.5.5 Mattermost versions prior to 10.11.17 Description Authenticated users with delegated user-management permissions can escalate privileges by altering built-in role...

7.2CVSS5.9AI score0.00257EPSS
SaveExploits0References4
Positive Technologies
Positive Technologies
added 2026/06/12 12:0 a.m.43 views

PT-2026-48977

Name of the Vulnerable Software and Affected Versions Discourse versions 2026.1.0-latest through 2026.1.3 Discourse versions 2026.3.0-latest through 2026.3.0 Discourse versions 2026.4.0-latest through 2026.4.0 Description Bot debug endpoints disclose whisper translation audit logs. Recommendation...

4.3CVSS5.2AI score0.00235EPSS
SaveExploits0References5
Positive Technologies
Positive Technologies
added 2026/06/11 12:0 a.m.43 views

PT-2026-48624

Spring Boot's ArtemisEmbeddedConfigurationFactory uses a fixed, static path for the embedded Artemis message broker's data directory when no explicit path is configured. A local attacker on the same host can pre-create this predictable directory or place a symlink before the application starts...

5.3CVSS5.5AI score0.00094EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
added 2026/06/10 12:0 a.m.43 views

PT-2026-48353

ESF-IDF is the Espressif Internet of Things IOT Development Framework. In versions 5.2.6, 5.3.5, 5.4.4, 5.5.4, and 6.0, a heap buffer overflow exists in the Security Scheme 2 SRP6a session-setup path of the protocomm component. The first-phase handler handle session command0 in...

7.1CVSS5.7AI score0.00325EPSS
SaveExploits0References8
Positive Technologies
Positive Technologies
added 2026/06/10 12:0 a.m.43 views

PT-2026-50814

Name of the Vulnerable Software and Affected Versions pgAdmin 4 versions 6.0 through 9.15 Description Stored cross-site scripting exists in the error-rendering and plan-node-rendering paths. Text returned by a PostgreSQL server, such as ErrorResponse messages, object names in...

9.3CVSS5.9AI score0.0021EPSS
SaveExploits0References40
Positive Technologies
Positive Technologies
added 2026/06/09 12:0 a.m.43 views

PT-2026-48272

Name of the Vulnerable Software and Affected Versions ColdFusion versions prior to 2023.20 ColdFusion versions prior to 2025.9 Description An improper limitation of a pathname to a restricted directory, known as Path Traversal, allows an attacker to bypass security features and access unauthorize...

9.6CVSS5.2AI score0.02547EPSS
SaveExploits0References3
Positive Technologies
Positive Technologies
added 2026/06/09 12:0 a.m.43 views

PT-2026-48082

Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a DOM-based Cross-Site Scripting XSS vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser...

5.4CVSS5.5AI score0.00189EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
added 2026/06/09 12:0 a.m.43 views

PT-2026-48327

Name of the Vulnerable Software and Affected Versions Spring for Apache Kafka versions 4.0.0 through 4.0.5 Spring for Apache Kafka versions 3.3.0 through 3.3.15 Spring for Apache Kafka versions 3.2.0 through 3.2.13 Spring for Apache Kafka versions 2.9.0 through 2.9.13 Spring for Apache Kafka...

8.1CVSS6AI score0.0051EPSS
SaveExploits0References10
Positive Technologies
Positive Technologies
added 2026/06/09 12:0 a.m.43 views

PT-2026-48275

Name of the Vulnerable Software and Affected Versions ColdFusion versions 2023.19 and earlier ColdFusion versions 2025.8 and earlier Description An Improper Restriction of XML External Entity Reference XXE allows arbitrary file system read. This issue enables an attacker to access sensitive files...

7.4CVSS5.3AI score0.00457EPSS
SaveExploits0References3
Positive Technologies
Positive Technologies
added 2026/06/06 12:0 a.m.43 views

PT-2026-47148

Name of the Vulnerable Software and Affected Versions Protocol::HTTP2 versions prior to 1.13 Description The software is susceptible to an HTTP/2 Bomb, where a small request can expand into large server memory consumption. This occurs because the inbound HPACK path lacks a header-list size limit...

7.5CVSS5.7AI score0.00414EPSS
SaveExploits0References26
Positive Technologies
Positive Technologies
added 2026/06/05 12:0 a.m.43 views

PT-2026-47073

Name of the Vulnerable Software and Affected Versions RSS Aggregator by Feedzy versions prior to 5.1.8 Description An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. Authenticated attackers with contributor-level access ...

4.3CVSS5.5AI score0.0029EPSS
SaveExploits0References27
Positive Technologies
Positive Technologies
added 2026/06/05 12:0 a.m.43 views

PT-2026-46910

Name of the Vulnerable Software and Affected Versions ansible-core affected versions not specified Red Hat Ansible Automation Platform affected versions not specified Description An argument injection flaw exists in the ansible-galaxy role install command. The issue occurs because dependency...

7.8CVSS6.1AI score0.00214EPSS
SaveExploits0References58
Positive Technologies
Positive Technologies
added 2026/06/04 12:0 a.m.43 views

PT-2026-46253

A vulnerability was found in LakshayD02 Hostel-Management-System-PHP up to f87e67c283bab6f718faf2fec6ae39a13bd7036b. This issue affects some unknown processing of the file hostel/index.php of the component Admin Dashboard Page. The manipulation of the argument ID results in missing authorization...

6.5CVSS6.2AI score0.00209EPSS
SaveExploits0References7
Positive Technologies
Positive Technologies
added 2026/06/04 12:0 a.m.43 views

PT-2026-46363

Unauthenticated Local File Inclusion in Printo = 1.11 versions...

8.1CVSS5.2AI score0.00435EPSS
SaveExploits0References3
Positive Technologies
Positive Technologies
added 2026/06/04 12:0 a.m.43 views

PT-2026-46155

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description Leftover debug modules contain fixed credentials for internal AWS Cognito test sandboxes, which may lead to asset exploitation. Recommendations At the moment,...

6.9CVSS5.8AI score0.00159EPSS
SaveExploits0References4
Positive Technologies
Positive Technologies
added 2026/06/04 12:0 a.m.43 views

PT-2026-46301

Name of the Vulnerable Software and Affected Versions Axios versions prior to 0.32.0 Axios versions prior to 1.16.0 Description The Node.js HTTP adapter in Axios may forward a Proxy-Authorization header to a redirected origin during specific proxy-to-direct redirect flows. This occurs when an...

8.2CVSS5.5AI score0.00664EPSS
SaveExploits1References75
Positive Technologies
Positive Technologies
added 2026/06/01 12:0 a.m.43 views

PT-2026-45501

Name of the Vulnerable Software and Affected Versions horizon921 mcpilot version 0.1.0 Description A server-side request forgery SSRF exists in the MCP API Call Endpoint within the file client/src/app/api/mcp/call/route.ts. This issue allows a remote attacker to manipulate the serverBaseUrl...

7.5CVSS7.2AI score0.00305EPSS
SaveExploits0References8
Positive Technologies
Positive Technologies
added 2026/06/01 12:0 a.m.43 views

PT-2026-45518

F5-TTS through version 1.1.20 contains a path traversal vulnerability in the finetune Gradio handlers that allows unauthenticated attackers to write arbitrary files by passing unsanitized user-supplied project names directly to os.path.join without validating the resulting path stays within the...

8.8CVSS5.9AI score0.00393EPSS
SaveExploits0References5
Positive Technologies
Positive Technologies
added 2026/06/01 12:0 a.m.43 views

PT-2026-45553

Name of the Vulnerable Software and Affected Versions code-projects Hotel and Tourism Reservation System version 1.0 Description An issue in the Admin Login component allows remote attackers to achieve improper authentication. This occurs through the manipulation of the Password argument within t...

7.5CVSS7.1AI score0.00496EPSS
SaveExploits0References7
Positive Technologies
Positive Technologies
added 2026/06/01 12:0 a.m.43 views

PT-2026-45498

A vulnerability was found in j3k0 mcp-google-workspace up to 831790e7d5c2663325733d9f5579cc339a267c4c. This issue affects the function saveToDisk of the file src/tools/gmail.ts of the component MCP Gmail Tool. Performing a manipulation results in improper access controls. It is possible to initia...

6.5CVSS5.4AI score0.00276EPSS
SaveExploits0References9
Positive Technologies
Positive Technologies
added 2026/06/01 12:0 a.m.43 views

PT-2026-45422

A vulnerability was detected in CodeAstro Online Job Portal 1.0. The impacted element is an unknown function of the file /admin/jobs-admins/delete-jobs.php. Performing a manipulation of the argument ID results in sql injection. It is possible to initiate the attack remotely. The exploit is now...

7.5CVSS5.7AI score0.00263EPSS
SaveExploits0References7
Positive Technologies
Positive Technologies
added 2026/05/30 12:0 a.m.43 views

PT-2026-45089

Name of the Vulnerable Software and Affected Versions Spectra Gutenberg Blocks – Website Builder for the Block Editor versions prior to 2.19.26 Description The plugin is susceptible to Remote Code Execution, allowing authenticated attackers with Contributor-level access or higher to execute code ...

8.8CVSS6.2AI score0.01174EPSS
SaveExploits3References12
Positive Technologies
Positive Technologies
added 2026/05/27 12:0 a.m.43 views

PT-2026-44007

Name of the Vulnerable Software and Affected Versions Taipy version 4.1.1 Description An issue exists in the ElementLibrary.get resource function within taipy/gui/extension/library.py that allows unauthenticated attackers to access files outside the intended library directory. This occurs due to ...

8.7CVSS6.1AI score0.00409EPSS
SaveExploits0References12
Positive Technologies
Positive Technologies
added 2026/05/26 12:0 a.m.44 views

PT-2026-43411

Name of the Vulnerable Software and Affected Versions JeecgBoot versions prior to 3.9.2 Description Improper access controls exist in the LoginController.selectDepart function within the /sys/selectDepart file. This flaw allows for remote exploitation. Recommendations Upgrade to version 3.9.2. As...

7.5CVSS7.1AI score0.00291EPSS
SaveExploits0References11
Positive Technologies
Positive Technologies
added 2026/05/24 12:0 a.m.43 views

PT-2026-42923

Name of the Vulnerable Software and Affected Versions Slim versions 4.4.0 through 4.15 Description Reflected Cross-Site Scripting XSS occurs in the HtmlErrorRenderer when an application uses the setTitle and/or setDescription functions of HttpException to include untrusted or request-derived data...

6.1CVSS5.4AI score0.00167EPSS
SaveExploits0References8
Positive Technologies
Positive Technologies
added 2026/05/22 12:0 a.m.43 views

PT-2026-42823

Name of the Vulnerable Software and Affected Versions Amazon Braket SDK versions prior to 1.117.0 Description Insecure deserialization in the job results processing component may allow a remote authenticated user with S3 write access to the job output bucket to achieve arbitrary code execution on...

7.5CVSS6.5AI score0.0038EPSS
SaveExploits0References16
Positive Technologies
Positive Technologies
added 2026/05/21 12:0 a.m.43 views

PT-2026-42608

Summary The upload-by-URL path did not enforce NC ATTACHMENT FIELD SIZE against either the remote file's advertised Content-Length or the decoded length of a data: URI, allowing an authenticated user to bypass the configured per-file size limit. Details The attachments service now checks NC...

5.3CVSS5.8AI score
SaveExploits0References3
Positive Technologies
Positive Technologies
added 2026/05/20 12:0 a.m.43 views

PT-2026-42101

Name of the Vulnerable Software and Affected Versions E-LAN Hybrid Recording System affected versions not specified Description The E-LAN Hybrid Recording System developed by TONNET contains a SQL Injection flaw. This allows unauthenticated remote attackers to inject arbitrary SQL commands to rea...

8.7CVSS6.1AI score0.00539EPSS
SaveExploits0References6
Positive Technologies
Positive Technologies
added 2026/05/20 12:0 a.m.43 views

PT-2026-42166

Name of the Vulnerable Software and Affected Versions HCL DominoIQ affected versions not specified Description The RAG feature is affected by broken access control. Under certain circumstances, document level access restrictions are ignored when determining the data returned from an AI query, whi...

6.5CVSS5.9AI score0.00264EPSS
SaveExploits0References4
Positive Technologies
Positive Technologies
added 2026/05/19 12:0 a.m.43 views

PT-2026-41986

Name of the Vulnerable Software and Affected Versions Windmill versions prior to 1.703.2 Description Incorrect default permissions in nsjail sandbox configuration files allow the /etc directory to be bind-mounted without read-write restrictions. This enables authenticated users to write arbitrary...

9.6CVSS5.9AI score0.0024EPSS
SaveExploits0References9
Positive Technologies
Positive Technologies
added 2026/05/15 12:0 a.m.43 views

PT-2026-41267

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description In the ksmbd module, the smb inherit dacl function fails to verify that the variable-length Security Identifier SID described by sid.num subauth is fully contained within the Access...

8.8CVSS6AI score0.00408EPSS
SaveExploits0
Total number of security vulnerabilities5000