Lucene search
+L
PtsecurityMost viewed

200488 matches found

Positive Technologies
Positive Technologies
added 2026/06/16 12:0 a.m.39 views

PT-2026-49993

Name of the Vulnerable Software and Affected Versions Oracle Siebel CRM Siebel Apps - Marketing versions 17.0 through 26.5 Description An issue in the Marketing component of the Siebel Apps - Marketing product allows a low privileged attacker with network access via HTTP to compromise the system...

8.8CVSS5.8AI score0.00411EPSS
SaveExploits0References3
Positive Technologies
Positive Technologies
added 2026/06/16 12:0 a.m.39 views

PT-2026-49880

Name of the Vulnerable Software and Affected Versions Oracle Coherence versions 12.2.1.4.0 Oracle Coherence versions 14.1.1.0.0 Oracle Coherence versions 14.1.2.0.0 Oracle Coherence versions 15.1.1.0.0 Description An issue exists in the Centralized Third Party Jars component of Oracle Coherence...

9.8CVSS5.9AI score0.00473EPSS
SaveExploits0References5
Positive Technologies
Positive Technologies
added 2026/06/15 12:0 a.m.39 views

PT-2026-49604

Name of the Vulnerable Software and Affected Versions Buildah versions prior to 1.43.2 Buildah versions prior to 1.44 Podman versions prior to 5.8.3 Description When processing build contexts or add/copy instructions, a malicious server serving a Git repository or a tar archive file can cause fil...

6.3CVSS5.8AI score
SaveExploits0References13
Positive Technologies
Positive Technologies
added 2026/06/15 12:0 a.m.39 views

PT-2026-49261

Name of the Vulnerable Software and Affected Versions Valhalla versions prior to 3.6.4 Description Reflected cross-site scripting XSS occurs due to improper neutralization of input in the JSONP callback parameter. When a request specifies a JSONP callback, the value is reflected directly into the...

6.1CVSS5.9AI score0.00149EPSS
SaveExploits0References3
Positive Technologies
Positive Technologies
added 2026/06/15 12:0 a.m.39 views

PT-2026-49597

Name of the Vulnerable Software and Affected Versions Starlette affected versions not specified FastAPI affected versions not specified Description A Denial of Service DoS issue exists in the request.form function when processing application/x-www-form-urlencoded requests. While limits for max...

7.5CVSS5.8AI score0.00397EPSS
SaveExploits0References7
Positive Technologies
Positive Technologies
added 2026/06/14 12:0 a.m.39 views

PT-2026-49104

Name of the Vulnerable Software and Affected Versions LiteSpeed cPanel plugin versions prior to 2.4.8 LiteSpeed WHM PlugIn versions prior to 5.3.2.0 Description A privilege escalation issue exists where the software mishandles symbolic links symlinks provided by a user with FTP or web shell acces...

8.5CVSS6.1AI score0.01439EPSS
SaveExploits3References51
Positive Technologies
Positive Technologies
added 2026/06/14 12:0 a.m.39 views

PT-2026-49133

Name of the Vulnerable Software and Affected Versions nanoMODBUS versions prior to 1.23.1 Description The Modbus/TCP server contains an off-by-one buffer overflow in the recv msg header function. Remote unauthenticated attackers can exploit this by sending a crafted MBAP frame with the Length fie...

9CVSS6.1AI score0.00541EPSS
SaveExploits0References13
Positive Technologies
Positive Technologies
added 2026/06/13 12:0 a.m.39 views

PT-2026-49082

Name of the Vulnerable Software and Affected Versions FooGallery versions prior to 3.1.32 Description The FooGallery plugin for WordPress contains a Stored Cross-Site Scripting issue. This occurs because the foogallery sanitize javascript function uses an incomplete blacklist for JavaScript event...

6.4CVSS5.5AI score0.00301EPSS
SaveExploits0References11
Positive Technologies
Positive Technologies
added 2026/06/13 12:0 a.m.39 views

PT-2026-49168

Name of the Vulnerable Software and Affected Versions runc versions prior to 1.3.6 runc versions prior to 1.4.3 runc versions prior to 1.5.0-rc.3 Description A flaw involving a /dev symlink allows a malicious container image to obtain limited write access to the host filesystem. This issue occurs...

3.3CVSS5.2AI score0.00186EPSS
SaveExploits0References88
Positive Technologies
Positive Technologies
added 2026/06/12 12:0 a.m.39 views

PT-2026-48949

Name of the Vulnerable Software and Affected Versions aws-c-http versions prior to 0.11.0 Description Improper handling of HPACK dynamic table size updates in the AWS Common Runtime aws-c-http library allows a remote threat actor operating a server to cause memory corruption on a connecting clien...

8.8CVSS5.7AI score0.00351EPSS
SaveExploits0References5
Positive Technologies
Positive Technologies
added 2026/06/12 12:0 a.m.39 views

PT-2026-48844

Name of the Vulnerable Software and Affected Versions Apache CXF versions prior to 4.2.2 Apache CXF versions prior to 4.1.7 Description The EndpointReferenceUtils and W3CMultiSchemaFactory classes construct a SAXParserFactory without the required JAXP hardening configurations. This allows for...

9.8CVSS5.3AI score0.00527EPSS
SaveExploits0References18
Positive Technologies
Positive Technologies
added 2026/06/12 12:0 a.m.39 views

PT-2026-48863

Name of the Vulnerable Software and Affected Versions MobaXterm Personal Edition Portable version 26.3 Build 5154 Description The application allows arbitrary code execution by loading malicious DLLs from a predictable temporary directory that can be modified by the user. During startup, the...

8.5CVSS5.9AI score0.00108EPSS
SaveExploits0References4
Positive Technologies
Positive Technologies
added 2026/06/12 12:0 a.m.39 views

PT-2026-48932

Summary A NoSQL injection vulnerability existed in MongoDBSaver where checkpoint identifier fields from config.configurable were used in MongoDB queries without strict type enforcement. In vulnerable versions, attacker-controlled object payloads for example MongoDB operators like $gt and $ne coul...

6.7CVSS5.4AI score0.00229EPSS
SaveExploits0References6
Positive Technologies
Positive Technologies
added 2026/06/12 12:0 a.m.39 views

PT-2026-49048

Name of the Vulnerable Software and Affected Versions Avira Antivirus versions prior to 8.3.70.76 Description A heap buffer out-of-bounds read occurs in the antivirus engine when scanning a malformed PDF file. This issue may lead to local execution of code or a denial-of-service of the engine...

7.8CVSS5.7AI score0.00122EPSS
SaveExploits0References3
Positive Technologies
Positive Technologies
added 2026/06/12 12:0 a.m.39 views

PT-2026-48885

Name of the Vulnerable Software and Affected Versions Pause+ Mobile App versions 1.0.6 through 1.4.x Description Improper restriction of excessive authentication attempts allows for authentication bypass. Recommendations Update to version 1.5...

9.8CVSS5.2AI score0.00346EPSS
SaveExploits0References5
Positive Technologies
Positive Technologies
added 2026/06/12 12:0 a.m.39 views

PT-2026-49036

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.5.18 Description An identity header validation issue allows local same-host callers to forge trusted-proxy identity headers. Attackers with access to the proxy-facing Gateway port can supply these forged headers...

7.7CVSS5.2AI score0.00102EPSS
SaveExploits0References8
Positive Technologies
Positive Technologies
added 2026/06/11 12:0 a.m.39 views

PT-2026-48647

A Missing Authorization vulnerability in the playbook import functionality in Dialogflow CX on Google Cloud Platform allows an authenticated user with specific roles to escalate privileges and potentially take over a GCP project using a maliciously crafted playbook import. This vulnerability was...

9.4CVSS5.5AI score0.00207EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
added 2026/06/11 12:0 a.m.39 views

PT-2026-48617

Name of the Vulnerable Software and Affected Versions Spring Web Services versions 5.0.0 through 5.0.1 Spring Web Services versions 4.1.0 through 4.1.3 Spring Web Services versions 4.0.0 through 4.0.18 Spring Web Services versions 3.1.0 through 3.1.8 Description The Wss4jSecurityInterceptor...

8.2CVSS5.8AI score0.00229EPSS
SaveExploits0References7
Positive Technologies
Positive Technologies
added 2026/06/11 12:0 a.m.39 views

PT-2026-48643

Name of the Vulnerable Software and Affected Versions GitLab EE versions 17.1 through 18.10.7 GitLab EE versions 18.11 through 18.11.4 GitLab EE versions 19.0 through 19.0.1 Description Improper input sanitization in the Analytics Dashboard allows an authenticated user with developer-role...

8.7CVSS5.6AI score0.00249EPSS
SaveExploits0References11
Positive Technologies
Positive Technologies
added 2026/06/10 12:0 a.m.39 views

PT-2026-48428

Improper comparison with the certificates trusted list in S2OPC allows an attacker well-formed untrusted certificate to be considered trusted...

7.3CVSS5.4AI score0.00119EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
added 2026/06/10 12:0 a.m.39 views

PT-2026-48394

The Easy Image Collage plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'gridpropertiesborderColor' and 'gridimagesNattachment url' Parameters in all versions up to, and including, 1.13.6 due to insufficient input sanitization and output escaping. This makes it possible for...

6.4CVSS5.6AI score0.00195EPSS
SaveExploits0References7
Positive Technologies
Positive Technologies
added 2026/06/10 12:0 a.m.39 views

PT-2026-48403

Name of the Vulnerable Software and Affected Versions image-size versions prior to 2.0.3 Description A denial of service issue exists where remote attackers can permanently block the Node.js event loop. By supplying a specially crafted image buffer containing a box-type with a zero-valued size...

8.7CVSS5.5AI score0.0043EPSS
SaveExploits1References8
Positive Technologies
Positive Technologies
added 2026/06/10 12:0 a.m.39 views

PT-2026-48391

Name of the Vulnerable Software and Affected Versions Warp versions 0.2025.08.06.08.12.stable 00 through 0.2026.05.06.15.41.stable 01 Description A command injection exists in the prompt branch selector. An attacker who publishes a crafted branch name to a Git repository can execute arbitrary...

8CVSS6.2AI score0.00948EPSS
SaveExploits0References4
Positive Technologies
Positive Technologies
added 2026/06/10 12:0 a.m.39 views

PT-2026-48481

Name of the Vulnerable Software and Affected Versions Nezha Monitoring versions 1.0.0 through 2.0.13 Description A cross-site request forgery CSRF issue exists where a cross-site GET request can trigger stored cron commands on a victim's agents. The dashboard exposes a manual-trigger action via t...

7.1CVSS5.2AI score0.00123EPSS
SaveExploits0
Positive Technologies
Positive Technologies
added 2026/06/10 12:0 a.m.39 views

PT-2026-48374

The Animation Addons for Elementor – GSAP Powered Elementor Addons & Website Templates plugin for WordPress is vulnerable to DOM-Based Stored Cross-Site Scripting via the multiple parameters in all versions up to, and including, 2.6.7 due to insufficient input sanitization and output escaping. Th...

6.4CVSS5.7AI score0.00155EPSS
SaveExploits0References3
Positive Technologies
Positive Technologies
added 2026/06/10 12:0 a.m.39 views

PT-2026-48499

🚨 CVE-2026-20259 In Splunk Enterprise versions below 10.2.4 and 10.0.7, and Splunk Cloud Platform versions below 10.4.2604.0, 10.3.2512.12, 10.2.2510.15, 10.1.2507.23, 10.0.2503.14, and 9.3.2411.131, a user who holds a Splunk role that contains the high-privilege capability edit saved search owne...

5.5CVSS5.2AI score0.00189EPSS
SaveExploits0References3
Positive Technologies
Positive Technologies
added 2026/06/10 12:0 a.m.39 views

PT-2026-48561

Name of the Vulnerable Software and Affected Versions Pi-hole FTL versions prior to 6.6.1 Description A race condition exists in the HTTP session management subsystem of the embedded CivetWeb-based web server. This issue was introduced during the v6.0 rewrite of the server engine. Recommendations...

8.8CVSS5.2AI score0.00293EPSS
SaveExploits0References5
Positive Technologies
Positive Technologies
added 2026/06/09 12:0 a.m.39 views

PT-2026-48325

Name of the Vulnerable Software and Affected Versions Spring Data REST versions 3.7.0 through 3.7.19 Spring Data REST versions 4.3.0 through 4.3.16 Spring Data REST versions 4.4.0 through 4.4.14 Spring Data REST versions 4.5.0 through 4.5.11 Spring Data REST versions 5.0.0 through 5.0.5 Descripti...

8.1CVSS5.9AI score0.00393EPSS
SaveExploits0References4
Positive Technologies
Positive Technologies
added 2026/06/09 12:0 a.m.39 views

PT-2026-47855

Name of the Vulnerable Software and Affected Versions OpenSSL affected versions not specified Description A signed integer overflow occurs when sizing the destination buffer for Unicode output in the ASN1 mbstring ncopy function, which can lead to a heap buffer overflow. This happens in ASN1...

8.1CVSS6.1AI score0.01025EPSS
SaveExploits0References139
Positive Technologies
Positive Technologies
added 2026/06/09 12:0 a.m.39 views

PT-2026-47530

Name of the Vulnerable Software and Affected Versions SAP NetWeaver Application Server Java Web Container affected versions not specified Description An unauthenticated attacker can craft a malicious HTTP logon request that manipulates file inclusion parameters. This enables path traversal, which...

9CVSS5.5AI score0.00454EPSS
SaveExploits0References14
Positive Technologies
Positive Technologies
added 2026/06/09 12:0 a.m.39 views

PT-2026-48306

Name of the Vulnerable Software and Affected Versions Spring REST Docs version 4.0.0 Spring REST Docs versions 3.0.0 through 3.0.5 Spring REST Docs versions 2.0.0.RELEASE through 2.0.8.RELEASE Description An XXE XML External Entity injection attack can occur when using spring-restdocs-webtestclie...

5.9CVSS6AI score0.00223EPSS
SaveExploits0References4
Positive Technologies
Positive Technologies
added 2026/06/09 12:0 a.m.39 views

PT-2026-47754

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the KVM arm64 component where the kvm-arch.nested mmus array is accessed under the kvm-mmu lock, including within the MMU notifier path via the functions kvm unmap gfn...

8.8CVSS5.5AI score0.0013EPSS
SaveExploits0
Positive Technologies
Positive Technologies
added 2026/06/09 12:0 a.m.39 views

PT-2026-47862

Name of the Vulnerable Software and Affected Versions Nuance PowerScribe affected versions not specified Description Deserialization of untrusted data allows an unauthorized attacker to execute code over a network. Deserialization is the process of converting a data stream back into an object,...

9.8CVSS5.7AI score0.01914EPSS
SaveExploits0References7
Positive Technologies
Positive Technologies
added 2026/06/09 12:0 a.m.39 views

PT-2026-48273

Name of the Vulnerable Software and Affected Versions ColdFusion versions 2023.19 and earlier ColdFusion versions 2025.8 and earlier Description A stored Cross-Site Scripting XSS issue allows a low-privileged attacker to inject malicious scripts into vulnerable form fields. This can result in the...

5.4CVSS5.3AI score0.00205EPSS
SaveExploits0References3
Positive Technologies
Positive Technologies
added 2026/06/09 12:0 a.m.39 views

PT-2026-47805

Name of the Vulnerable Software and Affected Versions FortiOS versions 7.6.0 through 7.6.2 FortiOS versions 7.4.0 through 7.4.7 FortiOS versions 7.2.0 through 7.2.10 FortiOS versions 7.0.0 through 7.0.16 FortiOS versions 6.4 all versions FortiProxy versions 7.6.0 through 7.6.3 FortiProxy versions...

6.7CVSS5.4AI score0.00149EPSS
SaveExploits0References5
Positive Technologies
Positive Technologies
added 2026/06/08 12:0 a.m.39 views

PT-2026-47285

Incorrect authorization in the User Messages dashboard widget in Checkmk 2.5.0p5 causes the message-fetching endpoints to return the dashboard creator's messages rather than the viewer's, allowing an attacker who knows a valid public dashboard share token to read the issuer's personal messages by...

6.3CVSS5.4AI score0.00187EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
added 2026/06/08 12:0 a.m.39 views

PT-2026-47330

Name of the Vulnerable Software and Affected Versions phpMyFAQ versions prior to 4.1.4 Description Attachment passwords are hashed using SHA-1, which is a cryptographically broken algorithm susceptible to collision attacks. A collision attack occurs when two different inputs produce the same hash...

6.9CVSS5.8AI score0.00182EPSS
SaveExploits0References7
Positive Technologies
Positive Technologies
added 2026/06/08 12:0 a.m.39 views

PT-2026-47295

A security vulnerability has been detected in Mohammed-eid35 bank-management-system-springboot up to 7b9bcc65ad7df3db29af71aed9bb500e5f24d948. This affects an unknown part of the file src/main/java/com/alien/bank/management/system/controller/TransactionController.java of the component Transaction...

6.5CVSS6.1AI score0.00272EPSS
SaveExploits0References7
Positive Technologies
Positive Technologies
added 2026/06/08 12:0 a.m.39 views

PT-2026-47292

Name of the Vulnerable Software and Affected Versions SourceCodester Inventory System version 1.0 Description Cross site scripting can be triggered remotely via the User Management Page component in the file '/users.php'. The issue occurs through the manipulation of the fullname or username...

5.3CVSS5.2AI score0.00388EPSS
SaveExploits0References8
Positive Technologies
Positive Technologies
added 2026/06/08 12:0 a.m.39 views

PT-2026-47430

Name of the Vulnerable Software and Affected Versions Devolutions Server version 2026.2.4.0 Devolutions Server versions prior to 2026.1.20.0 Description Improper access control in the ticketing integration settings allows an authenticated low-privileged user to obtain cleartext credentials for...

6.5CVSS5.2AI score0.00148EPSS
SaveExploits0References6
Positive Technologies
Positive Technologies
added 2026/06/05 12:0 a.m.39 views

PT-2026-47049

Name of the Vulnerable Software and Affected Versions Arista Edge Threat Management - Arista Next Generation Firewall NGFW affected versions not specified Description An administrative cross-site scripting XSS issue exists in the web user interface dashboard layout. Unvalidated user-supplied...

5.8CVSS5.2AI score0.00154EPSS
SaveExploits0References6
Positive Technologies
Positive Technologies
added 2026/06/04 12:0 a.m.39 views

PT-2026-46425

Name of the Vulnerable Software and Affected Versions Google Chrome on iOS versions prior to 149.0.7827.53 Description A use after free issue allows a remote attacker to execute arbitrary code through a crafted HTML page. Use after free occurs when an application continues to use a pointer after ...

9.6CVSS6.3AI score0.00985EPSS
SaveExploits5References434
Positive Technologies
Positive Technologies
added 2026/06/04 12:0 a.m.39 views

PT-2026-46888

Name of the Vulnerable Software and Affected Versions Shopware versions 6.7.3.0 through 6.7.10.0 Description An open redirect exists in the public SSO entry point at GET /api/oauth/sso/auth. When the endpoint is accessed without the expected SSO session state, the application uses the Referer...

4.3CVSS5.2AI score0.00162EPSS
SaveExploits0References9
Positive Technologies
Positive Technologies
added 2026/06/04 12:0 a.m.39 views

PT-2026-46870

Impact The limit container paths directive in singularity.conf is intended to allow a system administrator limit the paths from which containers can be run, under setuid mode. Due to incorrect matching of a path string, sibling directories with similar names may incorrectly be allowed. For exampl...

4.8CVSS5.8AI score
SaveExploits0References6
Positive Technologies
Positive Technologies
added 2026/06/04 12:0 a.m.39 views

PT-2026-46183

HCL iControl was affected by Weak Input Validation vulnerability. This weakness is caused during implementation of an architectural security tactic. Received input that is expected to be of a certain type, but it does not validate or incorrectly validates that the input is actually of the expecte...

4.3CVSS5.8AI score0.00169EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
added 2026/06/04 12:0 a.m.39 views

PT-2026-46130

Name of the Vulnerable Software and Affected Versions OMICARD EDM affected versions not specified Description An Insecure Direct Object Reference IDOR issue exists, which is a type of access control flaw that occurs when an application provides direct access to objects based on user-supplied inpu...

6.9CVSS5.9AI score0.00244EPSS
SaveExploits0References7
Positive Technologies
Positive Technologies
added 2026/06/04 12:0 a.m.39 views

PT-2026-46190

Name of the Vulnerable Software and Affected Versions Streamlit versions prior to 1.53.0 Description An issue exists in the Palette Handler component within the lib/streamlit/runtime/caching/hashing.py library. Manipulation of an unknown function in this library can lead to the use of a weak hash...

4.7CVSS4.7AI score0.00083EPSS
SaveExploits0References9
Positive Technologies
Positive Technologies
added 2026/06/04 12:0 a.m.39 views

PT-2026-46859

Summary The jwt and jwk middlewares do not verify that the Authorization header value uses theBearer scheme. Any two-part header value — regardless of the scheme name in the first position — proceeds to JWT verification. A request presenting a valid JWT under a non-Bearer scheme identifier such a...

6.5CVSS5.7AI score0.00199EPSS
SaveExploits0References6
Positive Technologies
Positive Technologies
added 2026/06/03 12:0 a.m.39 views

PT-2026-46001

Mercusys AC12G EU V1 with firmware AC12GEU V1 200909 returns 128 bytes of uninitialized internal buffer contents when receiving HTTP POST requests to undefined paths, exposing server state to unauthenticated adjacent network attackers...

4.3CVSS5.9AI score0.00159EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
added 2026/06/03 12:0 a.m.39 views

PT-2026-46004

Mercusys AC12G EU V1 with firmware AC12GEU V1 200909 responds to version.bind CHAOS TXT queries, disclosing the DNS resolver software version unbound 1.22.0, aiding targeted attacks against known vulnerabilities...

5.8AI score0.00159EPSS
SaveExploits0References2
Total number of security vulnerabilities5000