Lucene search
+L
PtsecurityMost viewed

200219 matches found

Positive Technologies
Positive Technologies
•added 2026/06/16 12:0 a.m.•43 views

PT-2026-49881

Name of the Vulnerable Software and Affected Versions Oracle Coherence versions 12.2.1.4.0 Oracle Coherence versions 14.1.1.0.0 Oracle Coherence versions 14.1.2.0.0 Oracle Coherence versions 15.1.1.0.0 Description An issue in the Core component of Oracle Fusion Middleware allows an unauthenticate...

9.8CVSS5.8AI score0.00483EPSS
SaveExploits0References5
Positive Technologies
Positive Technologies
•added 2026/06/16 12:0 a.m.•43 views

PT-2026-49876

Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware component: Centralized Third Party Jars. The supported version that is affected is 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Coherence...

9.3CVSS5.2AI score0.00338EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
•added 2026/06/16 12:0 a.m.•43 views

PT-2026-50020

Name of the Vulnerable Software and Affected Versions JD Edwards EnterpriseOne Tools versions 9.2.0.0 through 9.2.26.2 Description An issue exists in the Installation Security component of JD Edwards EnterpriseOne Tools. An unauthenticated attacker with access to the infrastructure where the...

9.3CVSS5.9AI score0.0014EPSS
SaveExploits0References3
Positive Technologies
Positive Technologies
•added 2026/06/16 12:0 a.m.•43 views

PT-2026-49822

In ServerCo getssl version 2.49 and prior, the ACME challenge token returned to the client was not strictly validated against RFC 8555 before being used in challenge-file handling, allowing a maliciously crafted token to influence local path/filename usage during validation. An attacker who can...

7.4CVSS5.4AI score0.00757EPSS
SaveExploits0References8
Positive Technologies
Positive Technologies
•added 2026/06/16 12:0 a.m.•43 views

PT-2026-49986

Name of the Vulnerable Software and Affected Versions JD Edwards EnterpriseOne Tools versions 9.2.0.0 through 9.2.26.2 Description An issue exists in the Enterprise Infrastructure Security component of Oracle JD Edwards. An unauthenticated attacker with network access via JDENET can compromise th...

9.8CVSS5.8AI score0.00483EPSS
SaveExploits0References3
Positive Technologies
Positive Technologies
•added 2026/06/16 12:0 a.m.•43 views

PT-2026-50064

Name of the Vulnerable Software and Affected Versions Oracle Universal Work Queue versions 12.2.3 through 12.2.15 Description An issue exists in the Work Provider Site Level Administration component of the Oracle Universal Work Queue product within Oracle E-Business Suite. A low privileged attack...

8.8CVSS5.8AI score0.00411EPSS
SaveExploits0References3
Positive Technologies
Positive Technologies
•added 2026/06/16 12:0 a.m.•43 views

PT-2026-49981

Name of the Vulnerable Software and Affected Versions Oracle VM VirtualBox version 7.2.8 Description An issue exists in the VMSVGA device component of Oracle VM VirtualBox. A high-privileged attacker with logon access to the infrastructure where the software executes can compromise the system,...

7.5CVSS5.8AI score0.00114EPSS
SaveExploits0References7
Positive Technologies
Positive Technologies
•added 2026/06/15 12:0 a.m.•43 views

PT-2026-49228

Authentication Bypass Using an Alternate Path or Channel vulnerability in WP Engine Faust.Js allows Password Recovery Exploitation. This issue affects Faust.Js: from n/a through 1.8.7...

8.8CVSS5.2AI score0.0029EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
•added 2026/06/13 12:0 a.m.•43 views

PT-2026-49097

SQL Injection in reports/catalogue out.pl in Koha Community Koha through 22.11.37, 23.x, 24.x before 24.11.16, 25.05.x before 25.05.11, 25.11.x before 25.11.05, 26.05.x before 26.05.01, and 26.11.x before 26.11.00 allows an authenticated staff user with the Reports module flag to read arbitrary...

7.6CVSS9AI score0.00244EPSS
SaveExploits0References6
Positive Technologies
Positive Technologies
•added 2026/06/12 12:0 a.m.•43 views

PT-2026-48938

Name of the Vulnerable Software and Affected Versions Mattermost versions prior to 11.6.2 Mattermost versions prior to 11.5.5 Mattermost versions prior to 10.11.17 Description Authenticated users with delegated user-management permissions can escalate privileges by altering built-in role...

7.2CVSS5.9AI score0.00257EPSS
SaveExploits0References4
Positive Technologies
Positive Technologies
•added 2026/06/12 12:0 a.m.•43 views

PT-2026-48977

Name of the Vulnerable Software and Affected Versions Discourse versions 2026.1.0-latest through 2026.1.3 Discourse versions 2026.3.0-latest through 2026.3.0 Discourse versions 2026.4.0-latest through 2026.4.0 Description Bot debug endpoints disclose whisper translation audit logs. Recommendation...

4.3CVSS5.2AI score0.00235EPSS
SaveExploits0References5
Positive Technologies
Positive Technologies
•added 2026/06/12 12:0 a.m.•43 views

PT-2026-50785

Name of the Vulnerable Software and Affected Versions OpenBSD versions prior to commit 6a23123 Description An out-of-bounds read exists in the mpls do error function within sys/netmpls/mpls input.c. Remote attackers can disclose kernel stack memory by sending crafted MPLS frames containing 16...

6.9CVSS5.8AI score0.00423EPSS
SaveExploits2References23
Positive Technologies
Positive Technologies
•added 2026/06/11 12:0 a.m.•43 views

PT-2026-48791

ClipBucket v5 is an open source video sharing platform. Prior to version 5.5.3 - 129, the actions/progress video.php endpoint is vulnerable to blind SQL injection. Any unauthenticated user can exploit the ids parameter to execute SQL queries and exfiltrate sensitive data. This issue has been...

9.8CVSS5.7AI score0.00364EPSS
SaveExploits0References3
Positive Technologies
Positive Technologies
•added 2026/06/11 12:0 a.m.•43 views

PT-2026-48624

Spring Boot's ArtemisEmbeddedConfigurationFactory uses a fixed, static path for the embedded Artemis message broker's data directory when no explicit path is configured. A local attacker on the same host can pre-create this predictable directory or place a symlink before the application starts...

5.3CVSS5.5AI score0.00094EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
•added 2026/06/10 12:0 a.m.•43 views

PT-2026-48353

ESF-IDF is the Espressif Internet of Things IOT Development Framework. In versions 5.2.6, 5.3.5, 5.4.4, 5.5.4, and 6.0, a heap buffer overflow exists in the Security Scheme 2 SRP6a session-setup path of the protocomm component. The first-phase handler handle session command0 in...

7.1CVSS5.7AI score0.00325EPSS
SaveExploits0References8
Positive Technologies
Positive Technologies
•added 2026/06/10 12:0 a.m.•43 views

PT-2026-50814

Name of the Vulnerable Software and Affected Versions pgAdmin 4 versions 6.0 through 9.15 Description Stored cross-site scripting exists in the error-rendering and plan-node-rendering paths. Text returned by a PostgreSQL server, such as ErrorResponse messages, object names in...

9.3CVSS5.9AI score0.0021EPSS
SaveExploits0References40
Positive Technologies
Positive Technologies
•added 2026/06/09 12:0 a.m.•43 views

PT-2026-48272

Name of the Vulnerable Software and Affected Versions ColdFusion versions prior to 2023.20 ColdFusion versions prior to 2025.9 Description An improper limitation of a pathname to a restricted directory, known as Path Traversal, allows an attacker to bypass security features and access unauthorize...

9.6CVSS5.2AI score0.02547EPSS
SaveExploits0References3
Positive Technologies
Positive Technologies
•added 2026/06/09 12:0 a.m.•43 views

PT-2026-48082

Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a DOM-based Cross-Site Scripting XSS vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser...

5.4CVSS5.5AI score0.00189EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
•added 2026/06/09 12:0 a.m.•43 views

PT-2026-48327

Name of the Vulnerable Software and Affected Versions Spring for Apache Kafka versions 4.0.0 through 4.0.5 Spring for Apache Kafka versions 3.3.0 through 3.3.15 Spring for Apache Kafka versions 3.2.0 through 3.2.13 Spring for Apache Kafka versions 2.9.0 through 2.9.13 Spring for Apache Kafka...

8.1CVSS6AI score0.0051EPSS
SaveExploits0References10
Positive Technologies
Positive Technologies
•added 2026/06/09 12:0 a.m.•43 views

PT-2026-48275

Name of the Vulnerable Software and Affected Versions ColdFusion versions 2023.19 and earlier ColdFusion versions 2025.8 and earlier Description An Improper Restriction of XML External Entity Reference XXE allows arbitrary file system read. This issue enables an attacker to access sensitive files...

7.4CVSS5.3AI score0.00457EPSS
SaveExploits0References3
Positive Technologies
Positive Technologies
•added 2026/06/06 12:0 a.m.•43 views

PT-2026-47148

Name of the Vulnerable Software and Affected Versions Protocol::HTTP2 versions prior to 1.13 Description The software is susceptible to an HTTP/2 Bomb, where a small request can expand into large server memory consumption. This occurs because the inbound HPACK path lacks a header-list size limit...

7.5CVSS5.7AI score0.00414EPSS
SaveExploits0References26
Positive Technologies
Positive Technologies
•added 2026/06/05 12:0 a.m.•43 views

PT-2026-47073

Name of the Vulnerable Software and Affected Versions RSS Aggregator by Feedzy versions prior to 5.1.8 Description An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. Authenticated attackers with contributor-level access ...

4.3CVSS5.5AI score0.0029EPSS
SaveExploits0References27
Positive Technologies
Positive Technologies
•added 2026/06/05 12:0 a.m.•43 views

PT-2026-46910

Name of the Vulnerable Software and Affected Versions ansible-core affected versions not specified Red Hat Ansible Automation Platform affected versions not specified Description An argument injection flaw exists in the ansible-galaxy role install command. The issue occurs because dependency...

7.8CVSS6.1AI score0.00214EPSS
SaveExploits0References58
Positive Technologies
Positive Technologies
•added 2026/06/04 12:0 a.m.•43 views

PT-2026-46253

A vulnerability was found in LakshayD02 Hostel-Management-System-PHP up to f87e67c283bab6f718faf2fec6ae39a13bd7036b. This issue affects some unknown processing of the file hostel/index.php of the component Admin Dashboard Page. The manipulation of the argument ID results in missing authorization...

6.5CVSS6.2AI score0.00209EPSS
SaveExploits0References7
Positive Technologies
Positive Technologies
•added 2026/06/04 12:0 a.m.•43 views

PT-2026-46363

Unauthenticated Local File Inclusion in Printo = 1.11 versions...

8.1CVSS5.2AI score0.00435EPSS
SaveExploits0References3
Positive Technologies
Positive Technologies
•added 2026/06/04 12:0 a.m.•43 views

PT-2026-46155

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description Leftover debug modules contain fixed credentials for internal AWS Cognito test sandboxes, which may lead to asset exploitation. Recommendations At the moment,...

6.9CVSS5.8AI score0.00159EPSS
SaveExploits0References4
Positive Technologies
Positive Technologies
•added 2026/06/04 12:0 a.m.•43 views

PT-2026-46301

Name of the Vulnerable Software and Affected Versions Axios versions prior to 0.32.0 Axios versions prior to 1.16.0 Description The Node.js HTTP adapter in Axios may forward a Proxy-Authorization header to a redirected origin during specific proxy-to-direct redirect flows. This occurs when an...

8.2CVSS5.5AI score0.00664EPSS
SaveExploits1References75
Positive Technologies
Positive Technologies
•added 2026/06/01 12:0 a.m.•43 views

PT-2026-45501

Name of the Vulnerable Software and Affected Versions horizon921 mcpilot version 0.1.0 Description A server-side request forgery SSRF exists in the MCP API Call Endpoint within the file client/src/app/api/mcp/call/route.ts. This issue allows a remote attacker to manipulate the serverBaseUrl...

7.5CVSS7.2AI score0.00305EPSS
SaveExploits0References8
Positive Technologies
Positive Technologies
•added 2026/06/01 12:0 a.m.•43 views

PT-2026-45518

F5-TTS through version 1.1.20 contains a path traversal vulnerability in the finetune Gradio handlers that allows unauthenticated attackers to write arbitrary files by passing unsanitized user-supplied project names directly to os.path.join without validating the resulting path stays within the...

8.8CVSS5.9AI score0.00393EPSS
SaveExploits0References5
Positive Technologies
Positive Technologies
•added 2026/06/01 12:0 a.m.•43 views

PT-2026-45553

Name of the Vulnerable Software and Affected Versions code-projects Hotel and Tourism Reservation System version 1.0 Description An issue in the Admin Login component allows remote attackers to achieve improper authentication. This occurs through the manipulation of the Password argument within t...

7.5CVSS7.1AI score0.00496EPSS
SaveExploits0References7
Positive Technologies
Positive Technologies
•added 2026/06/01 12:0 a.m.•43 views

PT-2026-45498

A vulnerability was found in j3k0 mcp-google-workspace up to 831790e7d5c2663325733d9f5579cc339a267c4c. This issue affects the function saveToDisk of the file src/tools/gmail.ts of the component MCP Gmail Tool. Performing a manipulation results in improper access controls. It is possible to initia...

6.5CVSS5.4AI score0.00276EPSS
SaveExploits0References9
Positive Technologies
Positive Technologies
•added 2026/06/01 12:0 a.m.•43 views

PT-2026-45422

A vulnerability was detected in CodeAstro Online Job Portal 1.0. The impacted element is an unknown function of the file /admin/jobs-admins/delete-jobs.php. Performing a manipulation of the argument ID results in sql injection. It is possible to initiate the attack remotely. The exploit is now...

7.5CVSS5.7AI score0.00263EPSS
SaveExploits0References7
Positive Technologies
Positive Technologies
•added 2026/05/30 12:0 a.m.•43 views

PT-2026-45089

Name of the Vulnerable Software and Affected Versions Spectra Gutenberg Blocks – Website Builder for the Block Editor versions prior to 2.19.26 Description The plugin is susceptible to Remote Code Execution, allowing authenticated attackers with Contributor-level access or higher to execute code ...

8.8CVSS6.2AI score0.01174EPSS
SaveExploits3References12
Positive Technologies
Positive Technologies
•added 2026/05/27 12:0 a.m.•43 views

PT-2026-44007

Name of the Vulnerable Software and Affected Versions Taipy version 4.1.1 Description An issue exists in the ElementLibrary.get resource function within taipy/gui/extension/library.py that allows unauthenticated attackers to access files outside the intended library directory. This occurs due to ...

8.7CVSS6.1AI score0.00409EPSS
SaveExploits0References12
Positive Technologies
Positive Technologies
•added 2026/05/26 12:0 a.m.•44 views

PT-2026-43411

Name of the Vulnerable Software and Affected Versions JeecgBoot versions prior to 3.9.2 Description Improper access controls exist in the LoginController.selectDepart function within the /sys/selectDepart file. This flaw allows for remote exploitation. Recommendations Upgrade to version 3.9.2. As...

7.5CVSS7.1AI score0.00291EPSS
SaveExploits0References11
Positive Technologies
Positive Technologies
•added 2026/05/24 12:0 a.m.•43 views

PT-2026-42923

Name of the Vulnerable Software and Affected Versions Slim versions 4.4.0 through 4.15 Description Reflected Cross-Site Scripting XSS occurs in the HtmlErrorRenderer when an application uses the setTitle and/or setDescription functions of HttpException to include untrusted or request-derived data...

6.1CVSS5.4AI score0.00167EPSS
SaveExploits0References8
Positive Technologies
Positive Technologies
•added 2026/05/22 12:0 a.m.•43 views

PT-2026-42823

Name of the Vulnerable Software and Affected Versions Amazon Braket SDK versions prior to 1.117.0 Description Insecure deserialization in the job results processing component may allow a remote authenticated user with S3 write access to the job output bucket to achieve arbitrary code execution on...

7.5CVSS6.5AI score0.0038EPSS
SaveExploits0References16
Positive Technologies
Positive Technologies
•added 2026/05/21 12:0 a.m.•43 views

PT-2026-42608

Summary The upload-by-URL path did not enforce NC ATTACHMENT FIELD SIZE against either the remote file's advertised Content-Length or the decoded length of a data: URI, allowing an authenticated user to bypass the configured per-file size limit. Details The attachments service now checks NC...

5.3CVSS5.8AI score
SaveExploits0References3
Positive Technologies
Positive Technologies
•added 2026/05/20 12:0 a.m.•43 views

PT-2026-42101

Name of the Vulnerable Software and Affected Versions E-LAN Hybrid Recording System affected versions not specified Description The E-LAN Hybrid Recording System developed by TONNET contains a SQL Injection flaw. This allows unauthenticated remote attackers to inject arbitrary SQL commands to rea...

8.7CVSS6.1AI score0.00539EPSS
SaveExploits0References6
Positive Technologies
Positive Technologies
•added 2026/05/20 12:0 a.m.•43 views

PT-2026-42166

Name of the Vulnerable Software and Affected Versions HCL DominoIQ affected versions not specified Description The RAG feature is affected by broken access control. Under certain circumstances, document level access restrictions are ignored when determining the data returned from an AI query, whi...

6.5CVSS5.9AI score0.00264EPSS
SaveExploits0References4
Positive Technologies
Positive Technologies
•added 2026/05/19 12:0 a.m.•43 views

PT-2026-41986

Name of the Vulnerable Software and Affected Versions Windmill versions prior to 1.703.2 Description Incorrect default permissions in nsjail sandbox configuration files allow the /etc directory to be bind-mounted without read-write restrictions. This enables authenticated users to write arbitrary...

9.6CVSS5.9AI score0.0024EPSS
SaveExploits0References9
Positive Technologies
Positive Technologies
•added 2026/05/19 12:0 a.m.•43 views

PT-2026-42038

Name of the Vulnerable Software and Affected Versions Nuxt versions 3.1.0 through 3.21.5 Nuxt versions 4.0.0-alpha.1 through 4.4.5 @nuxt/nitro-server versions 3.20.0 through 3.21.5 @nuxt/nitro-server versions 4.0.0-alpha.1 through 4.4.5 Description The '/ nuxt island/' endpoint accepts...

5.4CVSS5.2AI score0.00091EPSS
SaveExploits0References8
Positive Technologies
Positive Technologies
•added 2026/05/15 12:0 a.m.•43 views

PT-2026-41267

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description In the ksmbd module, the smb inherit dacl function fails to verify that the variable-length Security Identifier SID described by sid.num subauth is fully contained within the Access...

8.8CVSS6AI score0.00408EPSS
SaveExploits0
Positive Technologies
Positive Technologies
•added 2026/05/12 12:0 a.m.•43 views

PT-2026-39945

The AI Chatbot & Workflow Automation by AIWU plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 1.4.17 due to insufficient escaping on user supplied parameters and lack of sufficient preparation on the existing SQL query in the getListForTbl function. This makes...

7.5CVSS5.9AI score0.00413EPSS
SaveExploits0References20
Positive Technologies
Positive Technologies
•added 2026/05/11 12:0 a.m.•43 views

PT-2026-39736

WeGIA is a web manager for charitable institutions. In versions prior to 3.7.0, a reflected Cross-Site Scripting XSS vulnerability exists in lista arquivos etapa.php due to improper handling of user-supplied input. The id processo parameter is directly embedded into the HTML without sanitization,...

6.1CVSS6AI score0.00178EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
•added 2026/05/11 12:0 a.m.•43 views

PT-2026-39568

A vulnerability was found in Open5GS up to 2.7.7. Impacted is the function smf nsmf handle create sm context of the component SMF. Performing a manipulation results in denial of service. Remote exploitation of the attack is possible. The exploit has been made public and could be used. The project...

5.3CVSS5.4AI score0.00471EPSS
SaveExploits1References6
Positive Technologies
Positive Technologies
•added 2026/05/09 12:0 a.m.•43 views

PT-2026-41169

Name of the Vulnerable Software and Affected Versions Open WebUI versions prior to 0.9.3 Description The "POST /api/v1/notes/id/pin" endpoint performs a write operation by toggling the is pinned field but incorrectly validates only for read permission. This allows users who have read-only access ...

4CVSS5.8AI score0.00218EPSS
SaveExploits1References14
Positive Technologies
Positive Technologies
•added 2026/05/08 12:0 a.m.•43 views

PT-2026-38916

Name of the Vulnerable Software and Affected Versions Apache CloudStack versions prior to 4.20.3.0 Apache CloudStack versions prior to 4.22.0.1 Description Missing MinIO policy cleanup during bucket deletion allows users to retain access to buckets they previously owned. If a different user creat...

8.1CVSS5.8AI score0.00373EPSS
SaveExploits0References7
Positive Technologies
Positive Technologies
•added 2026/05/07 12:0 a.m.•43 views

PT-2026-45198

Name of the Vulnerable Software and Affected Versions D-Link DI-8400 versions prior to 16.07.26A1 Description A stack-based buffer overflow occurs in an unknown function within the '/dbsrv.asp' endpoint. This issue is triggered by manipulating the str argument, allowing for remote exploitation. A...

9CVSS8.5AI score0.005EPSS
SaveExploits0References15
Positive Technologies
Positive Technologies
•added 2026/05/06 12:0 a.m.•43 views

PT-2026-37690

Vulnerability in the Java SE product of Oracle Java SE component: JSSE. Supported versions that are affected are Java SE: 11.0.5 and 13.0.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Java SE. Successful attacks of this...

5.8CVSS6.8AI score0.03613EPSS
SaveExploits0References11
Total number of security vulnerabilities5000