Lucene search
+L
PtsecurityMost viewed

200595 matches found

Positive Technologies
Positive Technologies
added 2026/05/13 12:00 a.m.40 views

PT-2026-40751

Name of the Vulnerable Software and Affected Versions Palo Alto Networks GlobalProtect app affected versions not specified Description A buffer overflow occurs during the processing of requests and responses exchanged between the Portal and Gateway. This allows a man-in-the-middle attacker to...

7.7CVSS6.3AI score0.00392EPSS
SaveExploits0References7
Positive Technologies
Positive Technologies
added 2026/05/13 12:00 a.m.40 views

PT-2026-40708

Buffer Overflow vulnerability in Ardupilot rover commit v.c56439b045162058df0ff136afea3081fcd06d38 allows a local attacker to cause a denial of service via the AP InertialSensor ADIS1647x.cpp, ArduRover, ADIS1647x Sensor component...

5.8AI score0.00106EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
added 2026/05/12 12:00 a.m.40 views

PT-2026-39952

The Eight Day Week Print Workflow plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'title' parameter in the pp-get-articles AJAX action in all versions up to, and including, 1.2.6. This is due to insufficient escaping on the user supplied parameter and lack of sufficie...

6.5CVSS5.9AI score0.00241EPSS
SaveExploits0References4
Positive Technologies
Positive Technologies
added 2026/05/11 12:00 a.m.40 views

PT-2026-39670

Name of the Vulnerable Software and Affected Versions Open WebUI versions prior to 0.6.10 Description An issue exists where the application does not validate or sanitize the filename of uploaded audio files, deriving it directly from the original HTTP upload request. This allows users to include...

8.1CVSS5.9AI score0.00454EPSS
SaveExploits1References11
Positive Technologies
Positive Technologies
added 2026/04/18 12:00 a.m.40 views

PT-2026-33585

Name of the Vulnerable Software and Affected Versions SAIL versions prior to commit 36aa5c7ec8a2bb35f6fb867a1177a6f141156b02 Description The XWD codec resolves pixel format based on the pixmap depth variable, but the byte-swap code independently uses bits per pixel. When pixmap depth is 8 BPP8...

9.8CVSS6AI score0.00332EPSS
SaveExploits0References7
Positive Technologies
Positive Technologies
added 2026/04/17 12:00 a.m.40 views

PT-2026-33508

Name of the Vulnerable Software and Affected Versions mcp-neo4j-cypher versions prior to 0.6.0 Description The read only mode enforcement can be bypassed using APOC CALL procedures. This may allow unauthorized write operations or server-side request forgery, which is a technique where an attacker...

2.3CVSS5.2AI score0.00264EPSS
SaveExploits0References12
Positive Technologies
Positive Technologies
added 2026/04/10 12:00 a.m.40 views

PT-2026-31869

Name of the Vulnerable Software and Affected Versions CodeAstro Online Classroom versions 1.0/2.php Description A security flaw exists in CodeAstro Online Classroom 1.0/2.php, specifically within the file /OnlineClassroom/takeassessment2.php?exid=14. Manipulation of the Q1 argument leads to a SQL...

6.5CVSS6.5AI score0.00196EPSS
SaveExploits0References10
Positive Technologies
Positive Technologies
added 2026/03/31 12:00 a.m.40 views

PT-2026-29305

Name of the Vulnerable Software and Affected Versions Discourse versions 2026.1.0 through 2026.1.2, 2026.2.0 through 2026.2.1, and 2026.3.0 through 2026.3.0. Description Discourse, an open-source discussion platform, is affected by a flaw that allows an attacker who can create shared AI...

6.1CVSS6AI score0.00169EPSS
SaveExploits0References7
Positive Technologies
Positive Technologies
added 2026/03/25 12:00 a.m.40 views

PT-2026-28169

Name of the Vulnerable Software and Affected Versions Pay versions prior to 3.7.20 Description The verify wechat sign function in src/Functions.php does not properly validate signatures when the Host header in a PSR-7 request is set to localhost. This allows an attacker to bypass the RSA signatur...

8.6CVSS5.9AI score0.00503EPSS
SaveExploits1References5
Positive Technologies
Positive Technologies
added 2026/03/05 12:00 a.m.40 views

PT-2026-23098

Name of the Vulnerable Software and Affected Versions IDC SFX2100 satellite receiver affected versions not specified Description The /sbin/ip utility is installed with the setuid bit set on the IDC SFX2100 satellite receiver. This configuration allows any local user who can execute the binary to...

9.2CVSS5.8AI score0.00148EPSS
SaveExploits1References10
Positive Technologies
Positive Technologies
added 2026/03/04 12:00 a.m.40 views

PT-2026-22876

Name of the Vulnerable Software and Affected Versions International Datacasting Corporation IDC SFX Series SuperFlex SatelliteReceiver Web Management Interface version 101 Description An OS Command Injection vulnerability exists in the web-based Traceroute diagnostic utility. An authenticated...

9.3CVSS6.2AI score0.02432EPSS
SaveExploits1References7
Positive Technologies
Positive Technologies
added 2026/02/17 12:00 a.m.40 views

PT-2026-20245

Name of the Vulnerable Software and Affected Versions IBM Concert versions 1.0.0 through 2.1.0 Description The IBM Concert Z hub framework is susceptible to cross-site scripting. An unauthenticated attacker can inject arbitrary JavaScript code into the Web UI, potentially modifying the intended...

6.1CVSS5AI score0.00162EPSS
SaveExploits0References3
Positive Technologies
Positive Technologies
added 2026/02/12 12:00 a.m.40 views

PT-2026-8170

CVE-2026-26088 - Apache HTTP Server Cross-Site Request Forgery CVE ID : CVE-2026-26088 Published : Feb. 12, 2026, 5:17 a.m. | 2 hours, 9 minutes ago Description : Rejected reason: Not used Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and...

5.5AI score
SaveExploits0References1
Positive Technologies
Positive Technologies
added 2026/02/06 12:00 a.m.40 views

PT-2026-6767

Name of the Vulnerable Software and Affected Versions OpenSTAManager versions 2.9.8 and earlier Description OpenSTAManager is susceptible to a critical OS Command Injection issue in the P7M signed XML file decoding functionality. An authenticated attacker can upload a ZIP file containing a...

9.4CVSS6.7AI score0.01755EPSS
SaveExploits14References9
Positive Technologies
Positive Technologies
added 2025/12/10 12:00 a.m.40 views

PT-2026-36801

Name of the Vulnerable Software and Affected Versions Apache HTTP Server versions prior to 2.4.67 Description An out-of-bounds read issue exists in the mod proxy ajp module of Apache HTTP Server, specifically within AJP getter functions. This flaw allows a remote attacker to read memory outside t...

7.5CVSS5.8AI score0.00713EPSS
SaveExploits0References201
Positive Technologies
Positive Technologies
added 2025/03/28 12:00 a.m.40 views

PT-2025-13560 · Futurenet · Futurenet Nxr Series

Name of the Vulnerable Software and Affected Versions: FutureNet NXR series, VXR series and WXR series routers affected versions not specified Description: The issue exists due to improper handling of symbolic link files. An attacker can exploit this by attaching an external storage containing...

6.2CVSS6.3AI score0.00305EPSS
SaveExploits0References6
Positive Technologies
Positive Technologies
added 2023/09/07 12:00 a.m.40 views

PT-2023-9638 · Totolink · Totolink Lr350

Name of the Vulnerable Software and Affected Versions: TOTOLINK LR350 versions up to 9.3.5u.6369 Description: A critical issue is related to the authorization procedure, specifically with the handling of the authCode parameter. This can allow a remote attacker to bypass security restrictions. The...

9.1CVSS7.4AI score0.01554EPSS
SaveExploits1References13
Positive Technologies
Positive Technologies
added 2023/07/26 12:00 a.m.40 views

PT-2023-4318 · Linux +6 · Linux Kernel +6

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: A use-after-free vulnerability in the Linux kernel's netfilter: nf tables component can be exploited to achieve local privilege escalation. On an error when building a nftables rule,...

10CVSS6.8AI score0.71737EPSS
SaveExploits67References489
Positive Technologies
Positive Technologies
added 2026/08/03 12:00 a.m.39 views

PT-2026-67016

In Bouncy Castle for Java before 1.85, KCCMBlockCipher MAC does not bind nonce when AAD is absent cross-nonce AEAD forgery. This issue also affects Bouncy Castle for Java LTS before 2.73.12...

8.7CVSS5.4AI score0.00174EPSS
SaveExploits0References4
Positive Technologies
Positive Technologies
added 2026/08/01 12:00 a.m.39 views

PT-2026-67271

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 3.29.0 Description A heap out-of-bounds read exists in the update process glyph fragments and glyph cache fragment put functions within libfreerdp/cache/glyph.c. The issue occurs during the handling of a GLYPH FRAGMEN...

8.7CVSS5.6AI score0.00339EPSS
SaveExploits0References6
Positive Technologies
Positive Technologies
added 2026/07/30 12:00 a.m.39 views

PT-2026-66606

Name of the Vulnerable Software and Affected Versions Sylius Mollie Plugin versions prior to 2.2.8 Sylius Mollie Plugin versions prior to 3.2.4 Sylius Mollie Plugin versions prior to 3.3.1 Description The payment webhook at the POST / locale/update-payment endpoint accepts the id and orderId...

7.5CVSS5.5AI score0.00382EPSS
SaveExploits0References15
Positive Technologies
Positive Technologies
added 2026/07/27 12:00 a.m.39 views

PT-2026-65095

Name of the Vulnerable Software and Affected Versions Ekushey Project Manager CRM versions prior to 5.1 Description A stored cross-site scripting issue exists where authenticated client users can inject arbitrary HTML and JavaScript. This occurs when malicious payloads are entered into the Reply...

5.4CVSS5.4AI score0.00165EPSS
SaveExploits0References5
Positive Technologies
Positive Technologies
added 2026/07/24 12:00 a.m.39 views

PT-2026-64285

Name of the Vulnerable Software and Affected Versions Parse Server versions 9.0.0 through 9.10.0-alpha.5 Parse Server versions 8.2.2 through 8.6.86 Description An issue exists where Pointer and Relation target class names are disclosed through GraphQL validation and input-coercion error messages...

6.3CVSS5.8AI score0.0032EPSS
SaveExploits0References7
Positive Technologies
Positive Technologies
added 2026/07/24 12:00 a.m.39 views

PT-2026-64374

Name of the Vulnerable Software and Affected Versions Likeshop versions prior to 3.0.6 Description Authenticated users with admin-level privileges can extract arbitrary database contents, including credentials, personally identifiable information PII, and session tokens. This occurs because the...

8.5CVSS5.8AI score0.00266EPSS
SaveExploits0References4
Positive Technologies
Positive Technologies
added 2026/07/23 12:00 a.m.39 views

PT-2026-63974

Grav versions = 1.7.0 and before 2.0.9 contain a remote code execution vulnerability. FlexDirectory::dynamicDataField resolves blueprint data-@: directives by calling call user func array on attacker-influenced input, validating only that the target is callable is callable without restricting...

8.8CVSS6.8AI score0.00849EPSS
SaveExploits0References4
Positive Technologies
Positive Technologies
added 2026/07/22 12:00 a.m.39 views

PT-2026-63374

A flaw was found in the Visual Studio Code Ansible Lightspeed extension. This command injection vulnerability CWE-78 arises from improper handling of the ansible.executionEnvironment.containerOptions and ansible.executionEnvironment.volumeMounts settings, allowing an attacker to inject shell...

7.8CVSS6.4AI score0.00473EPSS
SaveExploits0References3
Positive Technologies
Positive Technologies
added 2026/07/15 12:00 a.m.39 views

PT-2026-60254

Name of the Vulnerable Software and Affected Versions OpenWrt versions prior to 25.12.5 Description The odhcpd component writes a DHCPv6 client FQDN option 39 hostname into the /tmp/odhcpd.leases file via the statefiles write state6 and statefiles write state4 functions without proper escaping...

9.6CVSS5.3AI score0.00358EPSS
SaveExploits1References11
Positive Technologies
Positive Technologies
added 2026/07/15 12:00 a.m.39 views

PT-2026-60206

Name of the Vulnerable Software and Affected Versions NGINX Plus affected versions not specified NGINX Open Source affected versions not specified Description A flaw exists in the ngx http slice module module. When the slice directive is used with unnamed regex captures or during a background cac...

8.8CVSS7.7AI score0.0071EPSS
SaveExploits0References38
Positive Technologies
Positive Technologies
added 2026/07/15 12:00 a.m.39 views

PT-2026-60183

Name of the Vulnerable Software and Affected Versions NGINX Ingress Controller affected versions not specified Description An injection flaw exists in the configuration generator when the software is configured with Custom Resource Definitions CRDs or Ingress annotations. Multiple user-controllab...

8.7CVSS6.2AI score0.00293EPSS
SaveExploits0References4
Positive Technologies
Positive Technologies
added 2026/07/15 12:00 a.m.39 views

PT-2026-60529

Name of the Vulnerable Software and Affected Versions NTFS-3G versions prior to 2026.2.25 Description A heap buffer overflow occurs in the ntfs index walk down function within libntfs-3g/index.c. An attacker can corrupt heap memory in the SUID-root ntfs-3g binary by providing a specially crafted...

5.6AI score
SaveExploits0References39
Positive Technologies
Positive Technologies
added 2026/07/14 12:00 a.m.39 views

PT-2026-58630

Name of the Vulnerable Software and Affected Versions Microsoft Windows affected versions not specified Description A heap-based buffer overflow in Microsoft Windows Media Foundation allows an unauthorized attacker to execute code over a network. A heap-based buffer overflow occurs when a program...

8.8CVSS6.4AI score0.00829EPSS
SaveExploits0References3
Positive Technologies
Positive Technologies
added 2026/07/13 12:00 a.m.39 views

PT-2026-59612

Impact A raw string path concatenation vulnerability in pygeoapi's STAC FileSystemProvider plugin can allow for requests to STAC collection based collections to expose directories without authentication. The issue manifests when pygeoapi is deployed without a proxy or web front end that would...

7.5CVSS6AI score0.0051EPSS
SaveExploits0References8
Positive Technologies
Positive Technologies
added 2026/07/13 12:00 a.m.39 views

PT-2026-59515

Development Runner Telephony WebSocket /ws Unauthenticated Call-Control Abuse via Attacker-Supplied Call SID Summary The pipecat development runner registers a /ws WebSocket endpoint for telephony testing that accepts connections without any authentication. An unauthenticated remote attacker who...

7.5CVSS6.1AI score0.00369EPSS
SaveExploits1References7
Positive Technologies
Positive Technologies
added 2026/07/13 12:00 a.m.39 views

PT-2026-59095

Relevant Products/Components: trestle/core/commands/author/jinja.py trestle author jinja --- Detailed Description: The -o/--output argument in trestle author jinja allows writing files outside the intended workspace. The application does not properly validate: ../ .. absolute paths This allows...

8.4CVSS6.4AI score0.00158EPSS
SaveExploits0References8
Positive Technologies
Positive Technologies
added 2026/07/11 12:00 a.m.39 views

PT-2026-57425

Name of the Vulnerable Software and Affected Versions RSFiles versions prior to 1.17.12 Description The RSFiles Joomla extension contains a flaw allowing unauthenticated arbitrary file upload. This issue occurs due to a split-controller upload bypass and a direct write task, enabling attackers to...

10CVSS6.2AI score0.01602EPSS
SaveExploits4References9
Positive Technologies
Positive Technologies
added 2026/07/10 12:00 a.m.39 views

PT-2026-57119

The BetterDocs – AI Documentation, Knowledge Base, Docs, Wikis, FAQ with Chatbot plugin for WordPress is vulnerable to generic SQL Injection via the 'lang' parameter in all versions up to, and including, 4.6.0 due to insufficient escaping on the user supplied parameter and lack of sufficient...

6.5CVSS6.1AI score0.00242EPSS
SaveExploits0References6
Positive Technologies
Positive Technologies
added 2026/07/09 12:00 a.m.39 views

PT-2026-57030

Summary YesWiki’s public Bazar entry-listing APIs are vulnerable to unauthenticated SQL injection in numeric query / queries filters. For Bazar fields whose value structure is numeric, YesWiki escapes the attacker-controlled filter value but inserts it into SQL without quotes or numeric validatio...

7.5CVSS6.1AI score0.00047EPSS
SaveExploits0References4
Positive Technologies
Positive Technologies
added 2026/07/09 12:00 a.m.39 views

PT-2026-57034

Name of the Vulnerable Software and Affected Versions YesWiki version 4.6.5 Description An issue exists in the Bazar widget handler where the id GET parameter is reflected into HTML attributes using only the strip tags function. Since strip tags does not escape double quotes, an unauthenticated...

6.1CVSS6.3AI score0.00039EPSS
SaveExploits0References5
Positive Technologies
Positive Technologies
added 2026/07/06 12:00 a.m.39 views

PT-2026-55985

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description Memory corruption occurs when invoking device input/output control operations for mapping and unmapping persistent memory buffers. This issue is caused by improp...

7.8CVSS6AI score0.00064EPSS
SaveExploits0References3
Positive Technologies
Positive Technologies
added 2026/07/06 12:00 a.m.39 views

PT-2026-56009

FOSSBilling is a free, open-source billing and client management system. Prior to version 0.8.0, the Guest API invoice/update endpoint is missing an authorization check present in other invoice-related endpoints, allowing an unauthenticated user with knowledge of an invoice hash to modify the...

7.7CVSS6.1AI score0.00247EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
added 2026/07/05 12:00 a.m.39 views

PT-2026-55807

Name of the Vulnerable Software and Affected Versions radareorg radare2 versions prior to 6.1.7 Description An integer overflow occurs in the hexpairs Parser component within the cmd anal opcode function located in the libr/core/cmd anal.inc.c file. This issue requires local access to be exploite...

5.5CVSS5.9AI score0.00162EPSS
SaveExploits1References12
Positive Technologies
Positive Technologies
added 2026/07/03 12:00 a.m.39 views

PT-2026-55541

Name of the Vulnerable Software and Affected Versions Dell PowerProtect Data Domain versions 7.7.1.0 through 8.7 Dell PowerProtect Data Domain versions 8.6.1.0 through 8.6.1.10 Dell PowerProtect Data Domain versions 8.3.1.0 through 8.3.1.30 Dell PowerProtect Data Domain versions 7.13.1.0 through...

2.7CVSS6AI score0.00109EPSS
SaveExploits0References9
Positive Technologies
Positive Technologies
added 2026/07/02 12:00 a.m.39 views

PT-2026-55261

Name of the Vulnerable Software and Affected Versions Dockwatch versions prior to 0.6.568 Description An unauthenticated OS command injection exists that allows remote attackers to execute arbitrary shell commands. The issue arises from a chain of two bugs: a missing exit function after an...

9.8CVSS6.3AI score0.04856EPSS
SaveExploits0References12
Positive Technologies
Positive Technologies
added 2026/07/02 12:00 a.m.39 views

PT-2026-55455

Name of the Vulnerable Software and Affected Versions Kiwi TCMS affected versions not specified Description The /init-db/ endpoint, used for initial database setup via a browser, remains accessible and responds to requests even after the initial setup is complete. This endpoint does not require...

6.9CVSS6.1AI score0.00048EPSS
SaveExploits0References7
Positive Technologies
Positive Technologies
added 2026/07/02 12:00 a.m.39 views

PT-2026-55040

Name of the Vulnerable Software and Affected Versions iNET Webkit version 1.2.4 Description A SQL Injection issue exists that allows users with Contributor privileges to execute arbitrary SQL commands on the database. Recommendations At the moment, there is no information about a newer version th...

8.5CVSS6.3AI score0.00281EPSS
SaveExploits0References5
Positive Technologies
Positive Technologies
added 2026/07/01 12:00 a.m.39 views

PT-2026-54885

Name of the Vulnerable Software and Affected Versions Control Web Panel versions prior to 0.9.8.1225 Description An unauthenticated remote attacker can execute arbitrary SQL queries due to improper input validation and unsafe SQL query construction. This issue occurs at the 'user' endpoint throug...

9.8CVSS6.8AI score0.01151EPSS
SaveExploits2References13
Positive Technologies
Positive Technologies
added 2026/07/01 12:00 a.m.39 views

PT-2026-54930

Name of the Vulnerable Software and Affected Versions FatFs versions R0.16 and earlier Description An issue exists in the handling of long filenames when LFN Long File Name is enabled. The fno.fname variable can contain up to 255 characters, which may lead to a buffer overflow if callers copy thi...

7.6CVSS6.3AI score0.00428EPSS
SaveExploits2References10
Positive Technologies
Positive Technologies
added 2026/07/01 12:00 a.m.39 views

PT-2026-54454

Name of the Vulnerable Software and Affected Versions Modem affected versions not specified Description Improper input validation in the Modem can cause a system crash. This allows a remote denial of service if a User Equipment UE connects to a rogue base station controlled by an attacker. The...

5.3CVSS6.2AI score0.00169EPSS
SaveExploits0References8
Positive Technologies
Positive Technologies
added 2026/06/30 12:00 a.m.39 views

PT-2026-53819

Name of the Vulnerable Software and Affected Versions libarchive affected versions not specified Description A double free issue exists in the RAR5 reader of libarchive. When parsing a specially crafted RAR5 archive, the filtered buf pointer may remain stale after being freed during the...

7.5CVSS5.1AI score0.0047EPSS
SaveExploits0References44
Positive Technologies
Positive Technologies
added 2026/06/26 12:00 a.m.39 views

PT-2026-52885

Name of the Vulnerable Software and Affected Versions Envoy versions 1.34.0 through 1.35.12 Envoy versions 1.36.0 through 1.36.8 Envoy versions 1.37.0 through 1.37.4 Envoy versions 1.38.0 through 1.38.2 Description The PROXY Protocol v2 header generator emits Type-Length-Values TLVs that exceed t...

4.8CVSS5.8AI score0.00138EPSS
SaveExploits0References3
Total number of security vulnerabilities5000