Lucene search
+L
PtsecurityMost viewed

200488 matches found

Positive Technologies
Positive Technologies
added 2026/07/15 12:0 a.m.39 views

PT-2026-60206

Name of the Vulnerable Software and Affected Versions NGINX Plus affected versions not specified NGINX Open Source affected versions not specified Description A flaw exists in the ngx http slice module module. When the slice directive is used with unnamed regex captures or during a background cac...

8.8CVSS7.7AI score0.0071EPSS
SaveExploits0References38
Positive Technologies
Positive Technologies
added 2026/07/15 12:0 a.m.39 views

PT-2026-60183

Name of the Vulnerable Software and Affected Versions NGINX Ingress Controller affected versions not specified Description An injection flaw exists in the configuration generator when the software is configured with Custom Resource Definitions CRDs or Ingress annotations. Multiple user-controllab...

8.7CVSS6.2AI score0.00293EPSS
SaveExploits0References4
Positive Technologies
Positive Technologies
added 2026/07/15 12:0 a.m.39 views

PT-2026-60529

Name of the Vulnerable Software and Affected Versions NTFS-3G versions prior to 2026.2.25 Description A heap buffer overflow occurs in the ntfs index walk down function within libntfs-3g/index.c. An attacker can corrupt heap memory in the SUID-root ntfs-3g binary by providing a specially crafted...

5.6AI score
SaveExploits0References39
Positive Technologies
Positive Technologies
added 2026/07/14 12:0 a.m.39 views

PT-2026-58630

Name of the Vulnerable Software and Affected Versions Microsoft Windows affected versions not specified Description A heap-based buffer overflow in Microsoft Windows Media Foundation allows an unauthorized attacker to execute code over a network. A heap-based buffer overflow occurs when a program...

8.8CVSS6.4AI score0.00829EPSS
SaveExploits0References3
Positive Technologies
Positive Technologies
added 2026/07/13 12:0 a.m.39 views

PT-2026-59612

Impact A raw string path concatenation vulnerability in pygeoapi's STAC FileSystemProvider plugin can allow for requests to STAC collection based collections to expose directories without authentication. The issue manifests when pygeoapi is deployed without a proxy or web front end that would...

7.5CVSS6AI score0.0051EPSS
SaveExploits0References8
Positive Technologies
Positive Technologies
added 2026/07/13 12:0 a.m.39 views

PT-2026-59515

Development Runner Telephony WebSocket /ws Unauthenticated Call-Control Abuse via Attacker-Supplied Call SID Summary The pipecat development runner registers a /ws WebSocket endpoint for telephony testing that accepts connections without any authentication. An unauthenticated remote attacker who...

7.5CVSS6.1AI score0.00369EPSS
SaveExploits1References7
Positive Technologies
Positive Technologies
added 2026/07/10 12:0 a.m.39 views

PT-2026-57119

The BetterDocs – AI Documentation, Knowledge Base, Docs, Wikis, FAQ with Chatbot plugin for WordPress is vulnerable to generic SQL Injection via the 'lang' parameter in all versions up to, and including, 4.6.0 due to insufficient escaping on the user supplied parameter and lack of sufficient...

6.5CVSS6.1AI score0.00242EPSS
SaveExploits0References6
Positive Technologies
Positive Technologies
added 2026/07/09 12:0 a.m.39 views

PT-2026-57030

Summary YesWiki’s public Bazar entry-listing APIs are vulnerable to unauthenticated SQL injection in numeric query / queries filters. For Bazar fields whose value structure is numeric, YesWiki escapes the attacker-controlled filter value but inserts it into SQL without quotes or numeric validatio...

7.5CVSS6.1AI score0.00047EPSS
SaveExploits0References4
Positive Technologies
Positive Technologies
added 2026/07/06 12:0 a.m.39 views

PT-2026-55985

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description Memory corruption occurs when invoking device input/output control operations for mapping and unmapping persistent memory buffers. This issue is caused by improp...

7.8CVSS6AI score0.00064EPSS
SaveExploits0References3
Positive Technologies
Positive Technologies
added 2026/07/06 12:0 a.m.39 views

PT-2026-55968

Name of the Vulnerable Software and Affected Versions ArcGIS Server versions prior to 12.0 Description An unrestricted file upload issue exists where an unauthenticated attacker can upload a crafted file to the affected endpoint. This could allow for arbitrary file upload, potentially enabling...

9.8CVSS6.2AI score0.00352EPSS
SaveExploits0References4
Positive Technologies
Positive Technologies
added 2026/07/06 12:0 a.m.39 views

PT-2026-56009

FOSSBilling is a free, open-source billing and client management system. Prior to version 0.8.0, the Guest API invoice/update endpoint is missing an authorization check present in other invoice-related endpoints, allowing an unauthenticated user with knowledge of an invoice hash to modify the...

7.7CVSS6.1AI score0.00247EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
added 2026/07/02 12:0 a.m.39 views

PT-2026-55334

Name of the Vulnerable Software and Affected Versions Fireware OS versions 12.1 through 12.12 Fireware OS versions 2025.1 through 2026.2 Description An Out-of-bounds Write occurs in the ikestubd process, which may allow an authenticated privileged user to execute arbitrary code by sending special...

8.6CVSS6.3AI score0.00597EPSS
SaveExploits0References7
Positive Technologies
Positive Technologies
added 2026/07/02 12:0 a.m.39 views

PT-2026-55261

Name of the Vulnerable Software and Affected Versions Dockwatch versions prior to 0.6.568 Description An unauthenticated OS command injection exists that allows remote attackers to execute arbitrary shell commands. The issue arises from a chain of two bugs: a missing exit function after an...

9.8CVSS6.3AI score0.04856EPSS
SaveExploits0References12
Positive Technologies
Positive Technologies
added 2026/07/02 12:0 a.m.39 views

PT-2026-55455

Name of the Vulnerable Software and Affected Versions Kiwi TCMS affected versions not specified Description The /init-db/ endpoint, used for initial database setup via a browser, remains accessible and responds to requests even after the initial setup is complete. This endpoint does not require...

6.9CVSS6.1AI score0.00048EPSS
SaveExploits0References7
Positive Technologies
Positive Technologies
added 2026/07/01 12:0 a.m.39 views

PT-2026-54885

Name of the Vulnerable Software and Affected Versions Control Web Panel versions prior to 0.9.8.1225 Description An unauthenticated remote attacker can execute arbitrary SQL queries due to improper input validation and unsafe SQL query construction. This issue occurs at the 'user' endpoint throug...

9.8CVSS6.8AI score0.01151EPSS
SaveExploits2References13
Positive Technologies
Positive Technologies
added 2026/07/01 12:0 a.m.39 views

PT-2026-54930

Name of the Vulnerable Software and Affected Versions FatFs versions R0.16 and earlier Description An issue exists in the handling of long filenames when LFN Long File Name is enabled. The fno.fname variable can contain up to 255 characters, which may lead to a buffer overflow if callers copy thi...

7.6CVSS6.3AI score0.00428EPSS
SaveExploits2References10
Positive Technologies
Positive Technologies
added 2026/06/30 12:0 a.m.39 views

PT-2026-54336

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 150.0.7871.47 Description An inappropriate implementation in Dawn allows a remote attacker to obtain potentially sensitive information from process memory by using a crafted HTML page. Recommendations Update...

9.8CVSS6AI score0.0051EPSS
SaveExploits0References448
Positive Technologies
Positive Technologies
added 2026/06/26 12:0 a.m.39 views

PT-2026-52885

Name of the Vulnerable Software and Affected Versions Envoy versions 1.34.0 through 1.35.12 Envoy versions 1.36.0 through 1.36.8 Envoy versions 1.37.0 through 1.37.4 Envoy versions 1.38.0 through 1.38.2 Description The PROXY Protocol v2 header generator emits Type-Length-Values TLVs that exceed t...

4.8CVSS5.8AI score0.00138EPSS
SaveExploits0References3
Positive Technologies
Positive Technologies
added 2026/06/25 12:0 a.m.39 views

PT-2026-52623

Name of the Vulnerable Software and Affected Versions wolfSSL affected versions not specified Description A configuration issue occurs when WOLFSSL IP ALT NAME is not defined, leading to a bypass of iPAddress name constraints. In this state, the software fails to enforce IP address constraints se...

7.5CVSS5.7AI score0.00155EPSS
SaveExploits0References7
Positive Technologies
Positive Technologies
added 2026/06/25 12:0 a.m.39 views

PT-2026-52653

Name of the Vulnerable Software and Affected Versions Lemur affected versions not specified Description An authenticated user with the operator role can induce the server to make unauthorized outbound requests to internal network resources. This occurs because the software extracts CRL Distributi...

6.3CVSS6.1AI score0.00165EPSS
SaveExploits0References9
Positive Technologies
Positive Technologies
added 2026/06/24 12:0 a.m.39 views

PT-2026-51799

Name of the Vulnerable Software and Affected Versions Jenkins Bitbucket Push and Pull Request Plugin versions prior to 3.3.9 Description The plugin unconditionally disables SSL/TLS certificate and hostname validation when sending Bearer token authenticated requests to the configured Bitbucket...

4.8CVSS5.8AI score0.00108EPSS
SaveExploits0References4
Positive Technologies
Positive Technologies
added 2026/06/23 12:0 a.m.39 views

PT-2026-51651

Name of the Vulnerable Software and Affected Versions Hubbell Aclara Metrum affected versions not specified Description The Cellular Web Interface contains a flaw where missing authentication allows unauthenticated attackers to manipulate critical device settings and disrupt operations. This issu...

8.7CVSS5.8AI score0.00511EPSS
SaveExploits0References12
Positive Technologies
Positive Technologies
added 2026/06/22 12:0 a.m.39 views

PT-2026-51292

Name of the Vulnerable Software and Affected Versions Net::Statsite::Client versions prior to 1.1.1 Description Net::Statsite::Client, a client for the statsite protocol a variant of statsd, allows metric injections. This occurs because newlines are not removed from metric names, and values are n...

9.1CVSS5.9AI score0.00569EPSS
SaveExploits0References12
Positive Technologies
Positive Technologies
added 2026/06/22 12:0 a.m.39 views

PT-2026-51290

Untrusted user data was passed verbatim to Excel exports for administrators. This allowed formula injection which can be used to compromise the environment of the user loading the file or other data in the file...

5.1CVSS5.8AI score0.00382EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
added 2026/06/19 12:0 a.m.39 views

PT-2026-50898

Name of the Vulnerable Software and Affected Versions Apache APISIX versions 3.0.0 through 3.16.0 Description A Cross-Site Request Forgery CSRF issue exists in the cas-auth plugin under default configurations. This allows a remote attacker to trick a victim into visiting a malicious webpage,...

9.3CVSS5.9AI score0.00261EPSS
SaveExploits0References7
Positive Technologies
Positive Technologies
added 2026/06/19 12:0 a.m.39 views

PT-2026-51032

Name of the Vulnerable Software and Affected Versions Microsoft 365 Copilot's Business Chat affected versions not specified Description An open redirect issue exists, which is a flaw that allows a user to be redirected to an untrusted external website. This can enable an unauthorized attacker to...

8.8CVSS5.8AI score0.00758EPSS
SaveExploits0References7
Positive Technologies
Positive Technologies
added 2026/06/19 12:0 a.m.39 views

PT-2026-51100

Name of the Vulnerable Software and Affected Versions Langflow versions prior to 1.7.0 Description The logout button fails to clear the user session, allowing a previous user to remain logged in unless another user explicitly authenticates. This occurs because the '/logout' endpoint deletes...

6.1CVSS5.9AI score0.00189EPSS
SaveExploits1References10
Positive Technologies
Positive Technologies
added 2026/06/19 12:0 a.m.39 views

PT-2026-50917

Name of the Vulnerable Software and Affected Versions Realtek Audio Service version 1.0.0.55 Description An unquoted service path issue exists in RtkAudioService64.exe. This allows local attackers to escalate privileges by placing malicious executable files in the unquoted service path directory,...

8.5CVSS5.9AI score0.00173EPSS
SaveExploits0References5
Positive Technologies
Positive Technologies
added 2026/06/19 12:0 a.m.39 views

PT-2026-50884

Name of the Vulnerable Software and Affected Versions Apache APISIX versions 2.3 through 3.16.0 Description The openid-connect plugin under default configuration contains an issue where insufficient verification of data authenticity allows an attacker to spoof identity headers. This can lead to...

9.1CVSS5.9AI score0.00213EPSS
SaveExploits0References7
Positive Technologies
Positive Technologies
added 2026/06/19 12:0 a.m.39 views

PT-2026-50897

Name of the Vulnerable Software and Affected Versions Line Desktop MCP versions prior to 1.1.2 Description Line Desktop MCP allows users to operate the LINE Desktop application on Windows or Mac via Model Context Protocol MCP. When using the --http-mode Streamable HTTP transport, the server binds...

8.8CVSS5.9AI score0.00564EPSS
SaveExploits0References8
Positive Technologies
Positive Technologies
added 2026/06/18 12:0 a.m.39 views

PT-2026-50628

The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to generic SQL Injection via the 'name' parameter in all versions up to, and including, 1.15.43 due to insufficient escaping on the user supplied parameter and lack of sufficient...

4.9CVSS5.8AI score0.00345EPSS
SaveExploits0References10
Positive Technologies
Positive Technologies
added 2026/06/18 12:0 a.m.39 views

PT-2026-61798

Name of the Vulnerable Software and Affected Versions praisonai versions 4.5.110 through 4.6.58 Description SandlockSandbox is designed as a kernel-enforced sandbox for untrusted code, allowing configuration of allowed filesystem paths and network restrictions via SandboxConfig.native. However, o...

8.8CVSS5.2AI score
SaveExploits0References7
Positive Technologies
Positive Technologies
added 2026/06/18 12:0 a.m.39 views

PT-2026-56003

Name of the Vulnerable Software and Affected Versions Crawl4AI versions prior to 0.9.0 Description The Docker API server allows the browser config.extra args parameter to be passed directly into Chromium launch arguments. Because the Docker API is unauthenticated by default, an attacker can injec...

10CVSS6.1AI score0.00534EPSS
SaveExploits0References10
Positive Technologies
Positive Technologies
added 2026/06/18 12:0 a.m.39 views

PT-2026-50786

Name of the Vulnerable Software and Affected Versions libssh2 versions prior to 1.11.1 commit 2dae302 Description An out-of-bounds heap read exists in the sftp symlink function within src/sftp.c. A malicious SSH server or man-in-the-middle attacker can disclose heap memory contents or cause a cra...

8.3CVSS7.2AI score0.0103EPSS
SaveExploits0References33
Positive Technologies
Positive Technologies
added 2026/06/17 12:0 a.m.39 views

PT-2026-50558

In SignalRGB versions prior to 1.3.7.0, the .SignalIo device object is created without an explicit SDDL security descriptor and without FILE DEVICE SECURE OPEN. This results in overly permissive default access control, allowing any authenticated local user to obtain a handle to the device and iss...

5.2AI score0.00111EPSS
SaveExploits0References1
Positive Technologies
Positive Technologies
added 2026/06/17 12:0 a.m.39 views

PT-2026-50261

Missing Authorization vulnerability in Yoast BV Yoast SEO Premium allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Yoast SEO Premium: from n/a through 26.6...

5.5CVSS5.2AI score0.00188EPSS
SaveExploits0References1
Positive Technologies
Positive Technologies
added 2026/06/17 12:0 a.m.39 views

PT-2026-50212

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 149.0.7827.155 Description A use-after-free issue exists in the Media component. This occurs when a program continues to use a pointer after it has been freed, which can lead to memory corruption. A remote...

9.6CVSS6.2AI score0.00613EPSS
SaveExploits0References41
Positive Technologies
Positive Technologies
added 2026/06/17 12:0 a.m.39 views

PT-2026-50606

Name of the Vulnerable Software and Affected Versions Drupal core affected versions not specified Description An attacker with appropriate JSON:API write permissions could potentially inject a malicious payload in certain rare circumstances, leading to PHP Object Injection. PHP Object Injection...

5.9CVSS6AI score0.00215EPSS
SaveExploits0References10
Positive Technologies
Positive Technologies
added 2026/06/17 12:0 a.m.39 views

PT-2026-50185

Netskope was notified about a potential gap in its Netskope Client for Windows systems where a malicious insider with administrative privileges can potentially tamper with the customer IOCTL by sending crafted IOCTL requests to the driver. A successful exploit can result in the bypassing of all...

6.8CVSS5.3AI score0.00163EPSS
SaveExploits0References1
Positive Technologies
Positive Technologies
added 2026/06/17 12:0 a.m.39 views

PT-2026-50260

Incorrect Authorization vulnerability of /v2 experimental interface in Apache DolphinScheduler. This issue affects Apache DolphinScheduler: before 3.4.2. Users are recommended to upgrade to version 3.4.2, which fixes the issue...

5.3AI score0.00337EPSS
SaveExploits0References1
Positive Technologies
Positive Technologies
added 2026/06/17 12:0 a.m.39 views

PT-2026-50359

Unauthenticated PHP Object Injection in WP Activity Log = 5.6.3.1 versions...

9.8CVSS5.4AI score0.00699EPSS
SaveExploits1References3
Positive Technologies
Positive Technologies
added 2026/06/17 12:0 a.m.39 views

PT-2026-50235

Name of the Vulnerable Software and Affected Versions Google Android affected versions not specified Description A race condition in the eventCallback function of Nfc.h can lead to a use-after-free scenario. This issue allows for local escalation of privilege without requiring additional executio...

10CVSS5.5AI score0.00121EPSS
SaveExploits0References4
Positive Technologies
Positive Technologies
added 2026/06/16 12:0 a.m.39 views

PT-2026-50129

Summary When an application using Pydantic AI opts a URL into force download='allow-local' which disables the default block on private/internal IPs and runs on a network that routes the affected IPv6 transition forms NAT64- or ISATAP-configured networks, the cloud-metadata blocklist could be...

6.8CVSS6.1AI score0.00322EPSS
SaveExploits0References14
Positive Technologies
Positive Technologies
added 2026/06/16 12:0 a.m.39 views

PT-2026-50058

Name of the Vulnerable Software and Affected Versions Oracle E-Business Suite Oracle Subledger Accounting versions 12.2.3 through 12.2.15 Description An issue exists in the Internal Operations component of the Oracle Subledger Accounting product. A low privileged attacker with network access via...

7.5CVSS5.9AI score0.00247EPSS
SaveExploits0References4
Positive Technologies
Positive Technologies
added 2026/06/16 12:0 a.m.39 views

PT-2026-49945

Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware component: Content Server. Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle...

9.8CVSS5.3AI score0.00473EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
added 2026/06/16 12:0 a.m.39 views

PT-2026-49869

Name of the Vulnerable Software and Affected Versions Oracle Fusion Middleware WebLogic Server versions 12.2.1.4.0 Oracle Fusion Middleware WebLogic Server versions 14.1.1.0.0 Oracle Fusion Middleware WebLogic Server versions 14.1.2.0.0 Oracle Fusion Middleware WebLogic Server versions 15.1.1.0.0...

9.1CVSS5.8AI score0.00463EPSS
SaveExploits0References3
Positive Technologies
Positive Technologies
added 2026/06/16 12:0 a.m.39 views

PT-2026-50049

Vulnerability in the Oracle Advanced Outbound Telephony product of Oracle E-Business Suite component: Internal Operations. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle...

9.1CVSS5.1AI score0.00405EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
added 2026/06/16 12:0 a.m.39 views

PT-2026-50071

Vulnerability in the Oracle Outsourced Mfg for Discrete Industries product of Oracle E-Business Suite component: Internal Operations. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise...

8.8CVSS5.3AI score0.00411EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
added 2026/06/16 12:0 a.m.39 views

PT-2026-50003

Name of the Vulnerable Software and Affected Versions Oracle Enterprise Command Center Framework versions V15 through V16 Description An issue exists in the Core component of the Oracle Enterprise Command Center Framework. A high privileged attacker with network access via HTTP can exploit this...

9.1CVSS5.9AI score0.00462EPSS
SaveExploits0References3
Positive Technologies
Positive Technologies
added 2026/06/16 12:0 a.m.39 views

PT-2026-49871

Name of the Vulnerable Software and Affected Versions Oracle Fusion Middleware WebLogic Server versions 12.2.1.4.0 Oracle Fusion Middleware WebLogic Server versions 14.1.1.0.0 Oracle Fusion Middleware WebLogic Server versions 14.1.2.0.0 Oracle Fusion Middleware WebLogic Server versions 15.1.1.0.0...

9.8CVSS5.8AI score0.00565EPSS
SaveExploits0References3
Total number of security vulnerabilities5000