Lucene search
+L
PtsecurityMost viewed

212496 matches found

Positive Technologies
Positive Technologies
•added 2026/01/28 12:00 a.m.•54 views

PT-2026-5120

The Passster – Password Protect Pages and Content plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'content protector' shortcode in all versions up to, and including, 4.2.24. This makes it possible for authenticated attackers, with Contributor-level access and...

6.4CVSS6AI score0.0028EPSS
SaveExploits0References5
Positive Technologies
Positive Technologies
•added 2026/01/25 12:00 a.m.•54 views

PT-2026-4679

A security vulnerability has been detected in Beetel 777VR1 up to 01.00.09/01.00.09 55. This issue affects some unknown processing of the component UART Interface. The manipulation leads to improper restriction of excessive authentication attempts. It is possible to launch the attack on the...

2CVSS4.4AI score0.00384EPSS
SaveExploits1References5
Positive Technologies
Positive Technologies
•added 2026/01/22 12:00 a.m.•54 views

PT-2026-3906

Name of the Vulnerable Software and Affected Versions Grist versions prior to 1.7.9 Description Grist is spreadsheet software that utilizes Python as its formula language. When configured to run formulas in the Pyodide sandbox GRIST SANDBOX FLAVOR set to pyodide, a crafted spreadsheet formula can...

9CVSS6AI score0.00523EPSS
SaveExploits0References29
Positive Technologies
Positive Technologies
•added 2026/01/20 12:00 a.m.•54 views

PT-2026-4329

Name of the Vulnerable Software and Affected Versions HPE Alletra 6000/5000 and Nimble Storage versions prior to 6.1.2.800 HPE Alletra 6000/5000 and Nimble Storage versions prior to 6.1.3.300 Description A privilege escalation flaw exists in HPE Alletra 6000/5000 and Nimble Storage arrays. An...

9CVSS5.3AI score
SaveExploits0References8
Positive Technologies
Positive Technologies
•added 2026/01/08 12:00 a.m.•54 views

PT-2026-2178

Name of the Vulnerable Software and Affected Versions Open eClass versions prior to 4.2 Description The Open eClass platform, previously known as GUnet eClass, is a course management system. Prior to version 4.2, a flaw exists in the theme import functionality that allows an attacker with...

8.6CVSS8AI score0.03311EPSS
SaveExploits3References12
Positive Technologies
Positive Technologies
•added 2026/01/01 12:00 a.m.•54 views

PT-2026-1007

Name of the Vulnerable Software and Affected Versions PHPEMS versions up to 11.0 Description A cross-site request forgery condition exists in PHPEMS. The issue is triggered by manipulation of an unknown function and can be exploited remotely. Recommendations Versions prior to 11.0 should be updat...

5.3CVSS6.2AI score0.00252EPSS
SaveExploits1References9
Positive Technologies
Positive Technologies
•added 2025/12/18 12:00 a.m.•54 views

PT-2025-52212

Name of the Vulnerable Software and Affected Versions Bitrix24 versions prior to 25.100.301 Description Remote Code Execution is possible because an actor with SOURCE/WRITE permissions for the Translate Module can upload and execute code by sending a PHP file and a .htaccess file. The supplier...

6.3CVSS6.3AI score0.01028EPSS
SaveExploits3References12
Positive Technologies
Positive Technologies
•added 2025/12/15 12:00 a.m.•54 views

PT-2025-51217

Name of the Vulnerable Software and Affected Versions Wekan versions prior to 18.16 Description An issue exists in Wekan, an open-source kanban board system, where uploaded attachments can be served with a Content-Type controlled by an attacker specifically, text/html. This allows for the executi...

8.1CVSS6.6AI score0.00379EPSS
SaveExploits0References8
Positive Technologies
Positive Technologies
•added 2025/10/29 12:00 a.m.•54 views

PT-2026-42467

Name of the Vulnerable Software and Affected Versions Trend Micro Apex One/SEP agent affected versions not specified Description An origin validation error in the agent's named pipe communication mechanism allows a local attacker to escalate privileges. To exploit this issue, the attacker must...

7.8CVSS7.1AI score0.00104EPSS
SaveExploits0References8
Positive Technologies
Positive Technologies
•added 2025/10/22 12:00 a.m.•54 views

PT-2025-43375

Name of the Vulnerable Software and Affected Versions TOTOLINK N600R version 4.3.0cu.7866 B20220506 Description The TOTOLINK N600R device contains a stack overflow in the ssid parameter within the setWiFiBasicConfig function. This issue allows attackers to cause a Denial of Service DoS by providi...

7.8CVSS6.8AI score0.00589EPSS
SaveExploits1References6
Positive Technologies
Positive Technologies
•added 2024/12/02 12:00 a.m.•54 views

PT-2024-35863 · Unknown · Cultbooking Hotel Booking Engine

Name of the Vulnerable Software and Affected Versions: CultBooking Hotel Booking Engine versions n/a through 2.1 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS in the CultBooking Hotel Booking Engine. This means an attacker can perform unauthorize...

7.1CVSS6AI score0.00149EPSS
SaveExploits0References4
Positive Technologies
Positive Technologies
•added 2024/05/23 12:00 a.m.•54 views

PT-2024-40380 · Softwarex · Softwarex

Name of the Vulnerable Software and Affected Versions: SoftwareX versions prior to 3.1.14 Description: The issue arises during installation, where certain parameters admin username and admin password are not properly escaped in the setup form. Recommendations: For versions prior to 3.1.14, update...

6.1CVSS7.2AI score
SaveExploits0References5
Positive Technologies
Positive Technologies
•added 2024/04/26 12:00 a.m.•54 views

PT-2024-6814 · Google +4 · Google Chrome +4

Name of the Vulnerable Software and Affected Versions: Google Chrome versions prior to 129.0.6668.58 Microsoft Edge affected versions not specified Description: The issue is related to an inappropriate implementation in the Autofill feature, allowing a remote attacker to perform UI spoofing via a...

8.8CVSS5.1AI score0.00508EPSS
SaveExploits2References60
Positive Technologies
Positive Technologies
•added 2024/03/15 12:00 a.m.•54 views

PT-2024-21732 · WordPress · Postmash

Name of the Vulnerable Software and Affected Versions: postMash – custom post order versions 1.2.0 and earlier Description: The issue is a Cross Site Scripting XSS vulnerability, specifically a Reflected XSS, in the postMash – custom post order plugin. This type of vulnerability allows an attacke...

7.1CVSS8.6AI score0.00351EPSS
SaveExploits0References7
Positive Technologies
Positive Technologies
•added 2023/08/13 12:00 a.m.•54 views

PT-2023-23939 · Cyberpower · Cyberpower Powerpanel Enterprise

Name of the Vulnerable Software and Affected Versions: CyberPower PowerPanel Enterprise affected versions not specified Description: A non-feature complete authentication mechanism exists in the production application, allowing an attacker to bypass all authentication checks if LDAP authenticatio...

9.8CVSS9.6AI score0.00882EPSS
SaveExploits0References6
Positive Technologies
Positive Technologies
•added 2022/12/30 12:00 a.m.•54 views

PT-2022-28146 · Unknown · Kbase Metrics

Name of the Vulnerable Software and Affected Versions: KBase Metrics affected versions not specified Description: A critical issue was found in KBase Metrics, affecting the upload user data function of the file source/daily cron jobs/methods upload user stats.py. This issue leads to sql injection...

9.8CVSS6.2AI score0.00604EPSS
SaveExploits0References9
Positive Technologies
Positive Technologies
•added 2022/12/27 12:00 a.m.•54 views

PT-2022-11698 · Freepbx · Freepbx

Name of the Vulnerable Software and Affected Versions: FreePBX versions prior to 14.0.6.25 Description: A vulnerability was found in FreePBX voicemail, affecting an unknown functionality of the file page.voicemail.php. The manipulation leads to cross site scripting. The attack can be launched...

6.1CVSS6.5AI score0.00516EPSS
SaveExploits0References8
Positive Technologies
Positive Technologies
•added 2022/09/13 12:00 a.m.•54 views

PT-2022-24428 · Lief · Lief

Name of the Vulnerable Software and Affected Versions: LIEF version 365a16a Description: A reachable assertion abort was discovered in the BinaryStream.hpp component. Recommendations: For LIEF version 365a16a, consider disabling the use of the BinaryStream.hpp component until a patch is available...

5.5CVSS5.4AI score0.003EPSS
SaveExploits1References8
Positive Technologies
Positive Technologies
•added 2026/09/09 12:00 a.m.•53 views

PT-2026-88771

Tanium addressed a path traversal vulnerability in Comply...

8.5CVSS5.7AI score0.00463EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
•added 2026/09/05 12:00 a.m.•53 views

PT-2026-86393

Name of the Vulnerable Software and Affected Versions Rowboat versions prior to 0.9.2 Description Authenticated users can configure arbitrary destinations because the software fails to validate custom MCP server and webhook URLs. This allows attackers to point these URLs at internal services and...

5.3CVSS5.8AI score0.00372EPSS
SaveExploits0References8
Positive Technologies
Positive Technologies
•added 2026/09/03 12:00 a.m.•53 views

PT-2026-85102

A critical security vulnerability was found in the LiteSpeed Cache plugin for WordPress, and you really need to patch it right now. This flaw, tracked as CVE-2026-84761 with a high severity rating of 7.2, lets unauthenticated hackers pull off Server-Side Request Forgery attacks. Basically, anyone...

7.2CVSS5.6AI score0.00266EPSS
SaveExploits0References3
Positive Technologies
Positive Technologies
•added 2026/09/01 12:00 a.m.•53 views

PT-2026-84295

Use of Hard-coded Credentials vulnerability in TMT Machine Industry and Trade Ltd. Co. Talassoft Industrial Management Software allows Retrieve Embedded Sensitive Data. This issue affects Talassoft Industrial Management Software: from V.4 before V.16...

9.1CVSS5.9AI score0.00232EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
•added 2026/08/25 12:00 a.m.•53 views

PT-2026-81578

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 152.0.7977.65 Description Missing authorization in the BFCache Back-Forward Cache, a browser feature that stores a complete page in memory to allow instant loading when navigating back or forward allows a remote...

9.6CVSS6.4AI score0.0056EPSS
SaveExploits1References334
Positive Technologies
Positive Technologies
•added 2026/08/18 12:00 a.m.•53 views

PT-2026-77895

Name of the Vulnerable Software and Affected Versions Oracle Hyperion Data Relationship Management version 11.2.25.0.000 Description An issue exists in the Access and security component that allows a low privileged attacker with access to the infrastructure where the software executes to compromi...

7.1CVSS5.1AI score0.00159EPSS
SaveExploits0References3
Positive Technologies
Positive Technologies
•added 2026/08/15 12:00 a.m.•53 views

PT-2026-73006

In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix out-of-bounds clear bit in ath12k mac dp peer cleanup ath12k mac dp peer cleanup clears the ML peer ID slot on the free ml peer id map bitmap by indexing it with dp peer-peer id. That is wrong: dp peer-peer id f...

5.4AI score0.0034EPSS
SaveExploits0References3
Positive Technologies
Positive Technologies
•added 2026/08/15 12:00 a.m.•53 views

PT-2026-72713

In the Linux kernel, the following vulnerability has been resolved: iommu/dma-iommu: Fix wrong scatterlist length assignment in P2PDMA path In iommu dma map sg, when handling PCI P2PDMA cases, the DMA length of the current scatterlist segment s is incorrectly assigned from the head entry sg-lengt...

5.4AI score0.00165EPSS
SaveExploits0References3
Positive Technologies
Positive Technologies
•added 2026/08/15 12:00 a.m.•53 views

PT-2026-72718

In the Linux kernel, the following vulnerability has been resolved: tipc: prevent snt unacked underflow on CONN ACK tipc sk conn proto rcv subtracts the peer-supplied connection ack count from the unsigned 16-bit send counter snt unacked without checking that it does not exceed the number of...

5.4AI score0.00716EPSS
SaveExploits0References9
Positive Technologies
Positive Technologies
•added 2026/08/15 12:00 a.m.•53 views

PT-2026-72796

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject exclusive maps for bpf map elem iterators Exclusive maps aka excl prog hash are meant to be reachable only from the single program whose hash matches. This is enforced by check map prog compatibility when the map is...

5.3AI score0.00206EPSS
SaveExploits0References4
Positive Technologies
Positive Technologies
•added 2026/08/15 12:00 a.m.•53 views

PT-2026-72683

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the RDMA/bnxt re component where applications can request multiple Work Completion WC pages for the same ucontext, although only one WC page per ucontext is supported...

9.3CVSS8AI score0.00194EPSS
SaveExploits0
Positive Technologies
Positive Technologies
•added 2026/08/01 12:00 a.m.•53 views

PT-2026-67003

Name of the Vulnerable Software and Affected Versions affected versions not specified Description The DHCPv4 client helper function net dhcpv4 msg type name in subsys/net/lib/dhcpv4/dhcpv4.c contains a faulty bounds check when indexing a static 8-element name table. The check incorrectly uses...

5.4CVSS5.4AI score0.00266EPSS
SaveExploits1References6
Positive Technologies
Positive Technologies
•added 2026/07/27 12:00 a.m.•53 views

PT-2026-64872

Name of the Vulnerable Software and Affected Versions containerized-data-importer affected versions not specified Description The aggregated cdi.kubevirt.io:view ClusterRole, designed for read-only access to resources, incorrectly grants create permissions on the datavolumes/source subresource. T...

7.7CVSS5.7AI score0.00567EPSS
SaveExploits0References15
Positive Technologies
Positive Technologies
•added 2026/07/27 12:00 a.m.•53 views

PT-2026-65095

Name of the Vulnerable Software and Affected Versions Ekushey Project Manager CRM versions prior to 5.1 Description A stored cross-site scripting issue exists where authenticated client users can inject arbitrary HTML and JavaScript. This occurs when malicious payloads are entered into the Reply...

5.4CVSS5.4AI score0.00289EPSS
SaveExploits0References5
Positive Technologies
Positive Technologies
•added 2026/07/25 12:00 a.m.•53 views

PT-2026-64637

Name of the Vulnerable Software and Affected Versions Linux kernel version 6.12.58 Description A NULL pointer dereference occurs in the lookup swap cgroup id function on hosts without swap enabled. The function passes swap cgroup ctrltype.map to swap cgroup id lookup without verifying if the type...

5.5CVSS5.6AI score0.00122EPSS
SaveExploits0
Positive Technologies
Positive Technologies
•added 2026/07/23 12:00 a.m.•53 views

PT-2026-63838

Unauthenticated Cross Site Scripting XSS in Grand Photography = 5.7.8 versions...

7.1CVSS5.1AI score0.00251EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
•added 2026/07/17 12:00 a.m.•53 views

PT-2026-60627

OpenClaw 2026.5.14-beta.1 before 2026.5.27 contain an authorization flaw in the QQBot exec approvals feature. When the feature is enabled and reachable, a lower-trust caller or configured input path could execute or persist actions beyond the caller's intended authorization, allowing...

8.8CVSS6.2AI score0.00447EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
•added 2026/07/17 12:00 a.m.•53 views

PT-2026-60720

The NEX-Forms WordPress plugin before 9.2.3 does not sanitise and escape some submitted form data before storing it and outputting it back in the admin dashboard, leading to a Stored Cross-Site Scripting vulnerability which could allow unauthenticated users to perform Stored Cross-Site Scripting...

6.1AI score0.00275EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
•added 2026/07/15 12:00 a.m.•53 views

PT-2026-58873

Name of the Vulnerable Software and Affected Versions ASUS System Control Interface driver versions 3.0.x ASUS Business Manager affected versions not specified Description The ASUS System Control Interface driver and ASUS Business Manager contain issues related to the allocation of resources...

8.2CVSS5AI score0.00163EPSS
SaveExploits0References12
Positive Technologies
Positive Technologies
•added 2026/07/15 12:00 a.m.•53 views

PT-2026-60205

Metabase is an open-source business intelligence and embedded analytics tool. From 1.54.0 until 1.54.24, 1.55.24, 1.56.25, 1.57.19, 1.58.14, 1.59.10, and 1.60.4, a Metabase user with permission to add or edit a database connection can achieve remote code execution on the Metabase server by...

10CVSS6.6AI score0.00768EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
•added 2026/07/15 12:00 a.m.•53 views

PT-2026-60361

Name of the Vulnerable Software and Affected Versions dd-trace versions prior to 5.100.0 Description An issue exists in the W3C baggage propagation within packages/dd-trace/src/baggage.js and packages/dd-trace/src/opentracing/propagation/text map.js where incoming baggage HTTP headers are parsed...

7.5CVSS5.5AI score0.00793EPSS
SaveExploits0References11
Positive Technologies
Positive Technologies
•added 2026/07/15 12:00 a.m.•53 views

PT-2026-60187

When NGINX Plus is configured to use the Message Queuing Telemetry Transport MQTT filter module ngx stream mqtt filter module, unauthenticated attackers can send requests with conditions beyond the attacker's control to cause a heap buffer over-read in the NGINX worker process, leading to a...

6.3CVSS6.2AI score0.00448EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
•added 2026/07/13 12:00 a.m.•53 views

PT-2026-60014

A vulnerability was identified in ByteDance verl up to 0.7.1. Affected is the function math equal of the file prime math/grader.py. The manipulation leads to a sandbox issue. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is told to ...

6.3CVSS5.5AI score0.00422EPSS
SaveExploits0References10
Positive Technologies
Positive Technologies
•added 2026/07/13 12:00 a.m.•53 views

PT-2026-60021

Summary A Server Side Request Forgery SSRF vulnerability in download bytes from url allows any actor who can control batch input JSON to make the vLLM batch runner issue arbitrary HTTP/HTTPS requests from the server, without any URL validation or domain restrictions. This can be used to target...

5.4CVSS6.1AI score0.00305EPSS
SaveExploits1References8
Positive Technologies
Positive Technologies
•added 2026/07/13 12:00 a.m.•53 views

PT-2026-60028

Applications using Werkzeug to parse multipart/form-data requests are vulnerable to resource exhaustion. A specially crafted form body can bypass the Request.max form memory size setting. The Request.max content length setting, as well as resource limits provided by deployment software and...

7.5CVSS6.7AI score0.01095EPSS
SaveExploits0References12
Positive Technologies
Positive Technologies
•added 2026/07/12 12:00 a.m.•53 views

PT-2026-57547

Capgo before 12.128.2 contains an information disclosure vulnerability in the Supabase PostgREST global stats endpoint that allows unauthenticated attackers to read sensitive financial and operational metrics using only the public apikey. Remote attackers can query the /rest/v1/global stats...

8.7CVSS6.1AI score0.00559EPSS
SaveExploits0References3
Positive Technologies
Positive Technologies
•added 2026/07/11 12:00 a.m.•53 views

PT-2026-57425

Name of the Vulnerable Software and Affected Versions RSFiles versions prior to 1.17.12 Description The RSFiles Joomla extension contains a flaw allowing unauthenticated arbitrary file upload. This issue occurs due to a split-controller upload bypass and a direct write task, enabling attackers to...

10CVSS6.2AI score0.02328EPSS
SaveExploits4References9
Positive Technologies
Positive Technologies
•added 2026/07/10 12:00 a.m.•53 views

PT-2026-57154

Dell Unisphere for PowerMax, versions 10.3.0.5 and prior, contains a path traversal vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability to read arbitrary files...

6.5CVSS6.2AI score0.00453EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
•added 2026/07/09 12:00 a.m.•53 views

PT-2026-56726

A Missing Authentication vulnerability was discovered in the SSH keys synchronization endpoint. An unauthenticated attacker can send a request to the SSH keys synchronization endpoint and obtain the list of users that have uploaded their public SSH keys, their groups, and the uploaded public SSH...

6.9CVSS6AI score0.00441EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
•added 2026/07/07 12:00 a.m.•53 views

PT-2026-56184

Improper neutralization of special elements used in an LDAP query 'LDAP injection' vulnerability in HAVELSAN Inc. Liman MYS allows LDAP Injection. This issue affects Liman MYS: before release.Master.1107...

8.8CVSS5.9AI score0.00518EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
•added 2026/07/03 12:00 a.m.•53 views

PT-2026-55626

Name of the Vulnerable Software and Affected Versions Microsoft Edge Chromium-based affected versions not specified Description A use after free issue exists that allows an unauthorized attacker to execute arbitrary code over a network. Use after free is a memory corruption flaw that occurs when ...

7.5CVSS6.3AI score0.00608EPSS
SaveExploits0References7
Positive Technologies
Positive Technologies
•added 2026/07/02 12:00 a.m.•53 views

PT-2026-54872

GeoWebPlayer also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud is an addon that can be installed with various GeoVision software GV-VMS, GV-Cloud, .... It creates a websocket server that expands the capabilities of the various web-interfaces provided by the...

8.3CVSS5.8AI score0.00371EPSS
SaveExploits0References3
Total number of security vulnerabilities5000