Lucene search
+L
PtsecurityMost viewed

200565 matches found

Positive Technologies
Positive Technologies
added 2026/07/11 12:00 a.m.38 views

PT-2026-57425

Name of the Vulnerable Software and Affected Versions RSFiles versions prior to 1.17.12 Description The RSFiles Joomla extension contains a flaw allowing unauthenticated arbitrary file upload. This issue occurs due to a split-controller upload bypass and a direct write task, enabling attackers to...

10CVSS6.2AI score0.01602EPSS
SaveExploits4References9
Positive Technologies
Positive Technologies
added 2026/07/11 12:00 a.m.38 views

PT-2026-57457

A heads up that there are a ton of CVEs being patched for July 2026 June was also high. So many that they released the "hot fix" patches in June and still have not updated the Android Patch notes. Could just be 4th of July holiday, but they are an international firm. No previous delays as long...

8.4CVSS7.4AI score0.00738EPSS
SaveExploits0References1
Positive Technologies
Positive Technologies
added 2026/07/10 12:00 a.m.38 views

PT-2026-57304

Name of the Vulnerable Software and Affected Versions RabbitMQ versions prior to 3.13.15 RabbitMQ versions prior to 4.0.20 RabbitMQ versions prior to 4.1.11 RabbitMQ versions prior to 4.2.6 Description An obsolete GET '/api/auth' endpoint in the management plugin can disclose the OAuth 2 client...

8.7CVSS6.1AI score0.00784EPSS
SaveExploits0References21
Positive Technologies
Positive Technologies
added 2026/07/10 12:00 a.m.38 views

PT-2026-57083

Improper access control in SamsungSEAgentService prior to SMR Jul-2026 Release 1 allows local attackers to access sensitive information...

6.9CVSS6.1AI score0.00105EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
added 2026/07/09 12:00 a.m.38 views

PT-2026-56804

A vulnerability has been identified in CPCI85 Central Processing/Communication All versions V26.20, SICORE Base system All versions V26.20.0. The affected application includes a debugging interface that is accessible through HTTP endpoints. This could allow an authenticated attacker to disrupt th...

7.1CVSS5.9AI score0.0024EPSS
SaveExploits0References1
Positive Technologies
Positive Technologies
added 2026/07/09 12:00 a.m.38 views

PT-2026-56879

Name of the Vulnerable Software and Affected Versions Open WebUI versions 0.9.6 through 0.9.9 Description An issue exists where the verify knowledge file access function only validates read access. Subsequently, file write and delete routes trust object-derived access via writable meta.knowledge...

5.4CVSS5.8AI score0.0033EPSS
SaveExploits1References11
Positive Technologies
Positive Technologies
added 2026/07/09 12:00 a.m.38 views

PT-2026-56817

Name of the Vulnerable Software and Affected Versions n8n versions prior to 2.27.4 n8n versions 2.28.0 through 2.28.0 Description Instances configured with multiple trusted token-exchange issuers resolve external identities to local accounts using only the sub claim of the JSON Web Token JWT and...

7.6CVSS6.1AI score0.00314EPSS
SaveExploits0References14
Positive Technologies
Positive Technologies
added 2026/07/08 12:00 a.m.38 views

PT-2026-56333

When the application opens a PDF file, JavaScript uses the damaged field tree to trigger field traversal, resulting in the program holding an invalid form object when accessing the field property path. Eventually, the application crashes due to reading an invalid pointer...

7.8CVSS6AI score0.00116EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
added 2026/07/06 12:00 a.m.38 views

PT-2026-55883

Name of the Vulnerable Software and Affected Versions Apache Camel versions 4.14.0 through 4.14.7 Apache Camel versions 4.15.0 through 4.18.2 Apache Camel versions 4.19.0 through 4.20.9 Description An issue exists where the default ObjectInputFilter pattern used for deserialization filtering in...

8.1CVSS6.1AI score0.00625EPSS
SaveExploits1References7
Positive Technologies
Positive Technologies
added 2026/07/06 12:00 a.m.38 views

PT-2026-55879

Name of the Vulnerable Software and Affected Versions Apache IoTDB versions 1.3.3 through 2.0.7 Description An authentication bypass issue exists due to insufficient validation of the sessionId parameter within certain Thrift RPC query handlers. An attacker can forge the sessionId to bypass the...

9.1CVSS6AI score0.00521EPSS
SaveExploits0References6
Positive Technologies
Positive Technologies
added 2026/07/06 12:00 a.m.38 views

PT-2026-55891

Name of the Vulnerable Software and Affected Versions Apache Camel versions 4.0.0 through 4.14.7 Apache Camel versions 4.15.0 through 4.18.2 Apache Camel versions 4.19.0 through 4.20.9 Description Improper input validation in the Apache Camel AWS2-SQS component allows an attacker to inject...

9.8CVSS6.1AI score0.00641EPSS
SaveExploits0References13
Positive Technologies
Positive Technologies
added 2026/07/05 12:00 a.m.38 views

PT-2026-55835

Name of the Vulnerable Software and Affected Versions SourceCodester Onlne Examination & Learning Management System version 1.0 Description Improper authorization occurs in the Enrollment Management component within the /ajax enroll.php endpoint. A remote attacker can manipulate the student id,...

7.5CVSS7.1AI score0.00294EPSS
SaveExploits0References9
Positive Technologies
Positive Technologies
added 2026/07/05 12:00 a.m.38 views

PT-2026-55807

Name of the Vulnerable Software and Affected Versions radareorg radare2 versions prior to 6.1.7 Description An integer overflow occurs in the hexpairs Parser component within the cmd anal opcode function located in the libr/core/cmd anal.inc.c file. This issue requires local access to be exploite...

5.5CVSS5.9AI score0.00162EPSS
SaveExploits1References12
Positive Technologies
Positive Technologies
added 2026/07/04 12:00 a.m.38 views

PT-2026-55727

A security vulnerability has been detected in code-projects Online Voting System up to 0.x/1.0. This issue affects the function test input of the file /authentication.php of the component Login. Such manipulation of the argument adminUserName/adminPassword leads to sql injection. It is possible t...

7.5CVSS6.8AI score0.00347EPSS
SaveExploits0References7
Positive Technologies
Positive Technologies
added 2026/07/03 12:00 a.m.38 views

PT-2026-55626

Name of the Vulnerable Software and Affected Versions Microsoft Edge Chromium-based affected versions not specified Description A use after free issue exists that allows an unauthorized attacker to execute arbitrary code over a network. Use after free is a memory corruption flaw that occurs when ...

7.5CVSS6.3AI score0.00429EPSS
SaveExploits0References7
Positive Technologies
Positive Technologies
added 2026/07/03 12:00 a.m.38 views

PT-2026-55500

Name of the Vulnerable Software and Affected Versions JSON API User versions prior to 4.1.1 Description The JSON API User plugin for WordPress contains a Stored Cross-Site Scripting issue. This occurs because the post comment function fails to properly sanitize input, allowing the comment content...

6.4CVSS6.1AI score0.00221EPSS
SaveExploits0References10
Positive Technologies
Positive Technologies
added 2026/07/02 12:00 a.m.39 views

PT-2026-55285

Name of the Vulnerable Software and Affected Versions Netdata versions prior to 2.3.1 Description Reflected cross-site scripting occurs when the application reflects the user-supplied love query parameter of the 'api/v2/ilove.svg' and 'api/v3/ilove.svg' endpoints verbatim into a generated SVG...

6.1CVSS6.1AI score0.00237EPSS
SaveExploits0References9
Positive Technologies
Positive Technologies
added 2026/07/02 12:00 a.m.38 views

PT-2026-55277

Name of the Vulnerable Software and Affected Versions mcp-memory-service affected versions not specified Description All HTTP routes under the /api/documents/ endpoint are served without authentication, even when the server is configured with an API key MCP API KEY or OAuth. This allows an...

9.8CVSS6.2AI score0.00503EPSS
SaveExploits0References7
Positive Technologies
Positive Technologies
added 2026/07/02 12:00 a.m.38 views

PT-2026-55234

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the Bluetooth L2CAP socket cleanup process. The problem occurs during a race condition between l2cap sock cleanup listen and l2cap conn del. Specifically...

8CVSS6AI score0.00258EPSS
SaveExploits0
Positive Technologies
Positive Technologies
added 2026/07/02 12:00 a.m.38 views

PT-2026-55464

Name of the Vulnerable Software and Affected Versions kerberos-io/agent versions prior to 3.6.26 Description An issue exists in the Kerberos Hub upload path where the agent sends credentials in the custom X-Kerberos-Hub-PrivateKey and X-Kerberos-Hub-PublicKey request headers to the...

6.9CVSS6AI score
SaveExploits0
Positive Technologies
Positive Technologies
added 2026/06/30 12:00 a.m.38 views

PT-2026-54434

Buffer Overflow vulnerability in UTT nv518G nv518GV3v3.2.7-210919-161313 allows a remote attacker to cause a denial of service via the gohead/sub 425994 component...

5.8AI score0.00423EPSS
SaveExploits0References3
Positive Technologies
Positive Technologies
added 2026/06/30 12:00 a.m.38 views

PT-2026-54180

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 150.0.7871.47 Description Insufficient policy enforcement in the Bluetooth component allows a remote attacker to perform privilege escalation by inducing a user to visit a crafted HTML page. Recommendations Upda...

9.8CVSS6AI score0.0051EPSS
SaveExploits0References448
Positive Technologies
Positive Technologies
added 2026/06/30 12:00 a.m.38 views

PT-2026-53819

Name of the Vulnerable Software and Affected Versions libarchive affected versions not specified Description A double free issue exists in the RAR5 reader of libarchive. When parsing a specially crafted RAR5 archive, the filtered buf pointer may remain stale after being freed during the...

7.5CVSS5.1AI score0.0047EPSS
SaveExploits0References44
Positive Technologies
Positive Technologies
added 2026/06/29 12:00 a.m.38 views

PT-2026-53579

Summary python-statemachine 3.1.2 evaluates attributes in SCXML documents using Python's eval. Any application that passes attacker-controlled SCXML content to SCXMLProcessor is vulnerable to arbitrary code execution in the context of the hosting process. Details SCXMLProcessor.parse scxml file...

9.8CVSS6.5AI score0.01173EPSS
SaveExploits2References8
Positive Technologies
Positive Technologies
added 2026/06/29 12:00 a.m.38 views

PT-2026-53541

Summary The AgentService.loadAgentFromFile method uses the js-yaml library to parse YAML files without disabling dangerous tags such as !!js/function and !!js/undefined. This allows an attacker to craft a malicious YAML file that, when parsed, executes arbitrary JavaScript code. An attacker can...

9.8CVSS6.8AI score0.0058EPSS
SaveExploits0References7
Positive Technologies
Positive Technologies
added 2026/06/29 12:00 a.m.38 views

PT-2026-53251

Name of the Vulnerable Software and Affected Versions Edimax EW-7478APC version 1.04 Description An OS command injection flaw exists in the POST Request Handler component. A remote attacker can exploit this by manipulating the submit-url argument within the formAccept function of the...

6.5CVSS7AI score0.01158EPSS
SaveExploits0References9
Positive Technologies
Positive Technologies
added 2026/06/29 12:00 a.m.38 views

PT-2026-53446

In invoke-ai/invokeai version v5.0.2, the web API POST /api/v1/images/delete is vulnerable to Arbitrary File Deletion. This vulnerability allows unauthorized attackers to delete arbitrary files on the server, potentially including critical or sensitive system files such as SSH keys, SQLite...

9.1CVSS6AI score0.01495EPSS
SaveExploits0References7
Positive Technologies
Positive Technologies
added 2026/06/27 12:00 a.m.38 views

PT-2026-53221

Name of the Vulnerable Software and Affected Versions Delta Electronics DTM Soft affected versions not specified Description The software is susceptible to the deserialization of untrusted data, which can allow an attacker to execute arbitrary code. Real-world exploitation has been observed where...

8.4CVSS6AI score0.00146EPSS
SaveExploits0References8
Positive Technologies
Positive Technologies
added 2026/06/26 12:00 a.m.38 views

PT-2026-52683

The User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder plugin for WordPress is vulnerable to unauthorized modification of data due to missing validation checks in the confirm payment function in all...

6.5CVSS5.8AI score0.00251EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
added 2026/06/25 12:00 a.m.38 views

PT-2026-52559

Name of the Vulnerable Software and Affected Versions GPAC Project/MP4Box versions prior to 26.02.0 Description A use-after-free issue exists in the gf filter pid inst swap function located in /filter core/filter pid.c. A use-after-free occurs when a program continues to use a pointer after it ha...

6.1CVSS5.8AI score0.00171EPSS
SaveExploits1References11
Positive Technologies
Positive Technologies
added 2026/06/25 12:00 a.m.38 views

PT-2026-52261

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A race condition exists in the iomap subsystem during buffered read failures. The function iomap finish folio read reports errors using fserror report iofolio-mapping-host, ... after...

7.5CVSS6AI score0.00344EPSS
SaveExploits0References14
Positive Technologies
Positive Technologies
added 2026/06/24 12:00 a.m.38 views

PT-2026-51790

Name of the Vulnerable Software and Affected Versions Jenkins Script Security Plugin versions prior to 1402.v94c9ce464861 Description Sandboxed Groovy scripts fail to intercept implicit type casts applied to elements of typed for-each loops. This allows attackers who can provide such scripts to...

8.8CVSS5.9AI score0.0038EPSS
SaveExploits0References4
Positive Technologies
Positive Technologies
added 2026/06/24 12:00 a.m.38 views

PT-2026-51649

Name of the Vulnerable Software and Affected Versions Xpro Addons — 140+ Widgets for Elementor versions prior to 1.7.3 Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Authenticated attackers with author-level access and above can inject...

6.4CVSS6AI score0.00248EPSS
SaveExploits0References23
Positive Technologies
Positive Technologies
added 2026/06/24 12:00 a.m.38 views

PT-2026-51981

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the bcmgenet network driver where free bds buffer descriptors are leaked. During the reclamation of the tx queue, the write pointer is fast-forwarded to drop data in...

7.5CVSS5.9AI score0.00371EPSS
SaveExploits0
Positive Technologies
Positive Technologies
added 2026/06/23 12:00 a.m.38 views

PT-2026-51536

Name of the Vulnerable Software and Affected Versions Control Builder A versions prior to 1.4/4 800xA for Advant Master versions prior to 6.0.3-1 800xA for Advant Master versions prior to 6.1.1-1 800xA for Advant Master version 6.1.1-3 800xA for Advant Master version 6.2.0-1 Description An...

4.4CVSS5.8AI score0.00083EPSS
SaveExploits0References4
Positive Technologies
Positive Technologies
added 2026/06/23 12:00 a.m.38 views

PT-2026-51641

Name of the Vulnerable Software and Affected Versions mise versions 2026.3.15 through 2026.6.3 Description mise loads the github.credential command setting from local project configuration files before any trust decision is made. When resolving a GitHub token, the software executes the value of...

6.3CVSS6.2AI score0.00115EPSS
SaveExploits0References6
Positive Technologies
Positive Technologies
added 2026/06/22 12:00 a.m.38 views

PT-2026-51300

Name of the Vulnerable Software and Affected Versions ArubaSign versions prior to 4.6.6 Description Incorrect default permissions are assigned during the installation of the software. The main executable and other program files located in "C:Program Files" have excessive permissions for the...

8.8CVSS6.2AI score0.00175EPSS
SaveExploits0References6
Positive Technologies
Positive Technologies
added 2026/06/21 12:00 a.m.38 views

PT-2026-51229

Name of the Vulnerable Software and Affected Versions Craft CMS versions 5.0.0-RC1 and later Description A stored cross-site scripting issue exists in the User Permissions page. The software fails to properly perform HTML escaping when rendering user group names. This allows attackers with...

4.8CVSS5.8AI score0.00251EPSS
SaveExploits0References6
Positive Technologies
Positive Technologies
added 2026/06/20 12:00 a.m.38 views

PT-2026-51172

Name of the Vulnerable Software and Affected Versions vLLM versions 0.10.2 through 0.12.x Description Multimodal embeddings processing lacks sparse tensor validation. Since PyTorch disables sparse tensor invariant checks by default, an attacker can submit crafted embedding requests containing...

8.8CVSS5.9AI score0.00352EPSS
SaveExploits0References6
Positive Technologies
Positive Technologies
added 2026/06/20 12:00 a.m.38 views

PT-2026-51145

Name of the Vulnerable Software and Affected Versions Flowise versions prior to 3.0.8 Description Insufficient input filtering in chat messages and custom agent functions allows for cross-site scripting XSS, a flaw where malicious scripts are injected into trusted websites. An attacker can execut...

6.1CVSS5.8AI score0.00222EPSS
SaveExploits1References9
Positive Technologies
Positive Technologies
added 2026/06/20 12:00 a.m.38 views

PT-2026-51132

Name of the Vulnerable Software and Affected Versions Simple File List versions prior to 6.3.8 Description The Simple File List plugin for WordPress contains insufficient authorization checks that allow unauthenticated attackers to delete and modify files on the server. This issue occurs within t...

7.5CVSS5.9AI score0.00516EPSS
SaveExploits0References11
Positive Technologies
Positive Technologies
added 2026/06/19 12:00 a.m.38 views

PT-2026-50836

Name of the Vulnerable Software and Affected Versions Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation versions prior to 2.8.8 Description An issue exists where unauthenticated attackers can perform Server-Side Request Forgery SSRF, a flaw that allows a serv...

6.5CVSS5.8AI score0.00496EPSS
SaveExploits0References18
Positive Technologies
Positive Technologies
added 2026/06/19 12:00 a.m.38 views

PT-2026-50849

Name of the Vulnerable Software and Affected Versions STRABL – A checkout solution plugin for WordPress versions prior to 4.6 Description The plugin contains a missing authentication flaw in the REST API webhook endpoint "/wp-json/strabl/webhook/order". The endpoint uses a permission callback set...

5.3CVSS5.9AI score0.00644EPSS
SaveExploits0References20
Positive Technologies
Positive Technologies
added 2026/06/19 12:00 a.m.38 views

PT-2026-50912

Name of the Vulnerable Software and Affected Versions AnyDesk version 2.5.0 Description An unquoted service path issue exists in the service installation, allowing local users to execute arbitrary code with SYSTEM privileges. This occurs when a service path contains spaces and is not enclosed in...

8.5CVSS6.2AI score0.00181EPSS
SaveExploits1References7
Positive Technologies
Positive Technologies
added 2026/06/19 12:00 a.m.38 views

PT-2026-50851

Name of the Vulnerable Software and Affected Versions 2Download Connector for 2DL Hosted Checkout versions prior to 0.1.6 Description The plugin fails to properly verify user authorization before performing specific actions. This allows unauthenticated attackers to access arbitrary customer...

5.3CVSS6AI score0.00455EPSS
SaveExploits0References14
Positive Technologies
Positive Technologies
added 2026/06/19 12:00 a.m.38 views

PT-2026-50930

Name of the Vulnerable Software and Affected Versions Joomla! Component My Projects version 2.0 Description An SQL injection allows unauthenticated attackers to execute arbitrary SQL queries. This is achieved by injecting malicious code through the VerAyari parameter at the component endpoint,...

8.8CVSS6.1AI score0.00413EPSS
SaveExploits1References7
Positive Technologies
Positive Technologies
added 2026/06/19 12:00 a.m.38 views

PT-2026-51099

Name of the Vulnerable Software and Affected Versions Langflow versions prior to 1.9.1 Description An Insecure Direct Object Reference IDOR issue exists in the /api/v1/responses endpoint. This occurs because the get flow by id or endpoint name function queries the database using a flow ID without...

8.4CVSS6.3AI score0.29052EPSS
SaveExploits2References66
Positive Technologies
Positive Technologies
added 2026/06/19 12:00 a.m.38 views

PT-2026-50839

Name of the Vulnerable Software and Affected Versions ts-deepmerge versions prior to 8.0.0 Description An uncaught exception occurs due to improper handling of built-in Object.prototype methods, such as toString and valueOf. When user-controlled input contains these keys with non-function values,...

6.9CVSS5.8AI score0.00507EPSS
SaveExploits0References12
Positive Technologies
Positive Technologies
added 2026/06/19 12:00 a.m.38 views

PT-2026-50963

Name of the Vulnerable Software and Affected Versions Joomla! Component jCart for OpenCart version 2.0 Description An SQL injection allows unauthenticated attackers to manipulate database queries by injecting SQL code. This is achieved by sending GET requests to the 'index.php' endpoint using the...

8.8CVSS5.9AI score0.00327EPSS
SaveExploits1References7
Positive Technologies
Positive Technologies
added 2026/06/19 12:00 a.m.38 views

PT-2026-50899

Name of the Vulnerable Software and Affected Versions Apache APISIX versions 3.0.0 through 3.16.0 Description Improper Authentication occurs when the cas-auth plugin is used in a route, potentially allowing an attacker to authenticate using credentials from a different source. Recommendations...

8.1CVSS5.9AI score0.0032EPSS
SaveExploits0References6
Total number of security vulnerabilities5000