Lucene search
+L
PtsecurityMost viewed

200724 matches found

Positive Technologies
Positive Technologies
added 2026/04/02 12:00 a.m.35 views

PT-2026-29704

SEPPmail Secure Email Gateway before version 15.0.3 allows an attacker to bypass subject sanitization and forge tags such as signed OK...

7.7CVSS5.9AI score0.00212EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
added 2026/04/01 12:00 a.m.35 views

PT-2026-29498

Name of the Vulnerable Software and Affected Versions Tina versions prior to 2.2.2 Description A path-traversal issue exists in Tina, a headless content management system, due to insufficient validation of file paths in the dev media routes. The implementation validates only the path string and...

8.3CVSS5.4AI score0.00408EPSS
SaveExploits0References7
Positive Technologies
Positive Technologies
added 2026/03/30 12:00 a.m.35 views

PT-2026-29111

A weakness has been identified in YunaiV yudao-cloud up to 2026.01. This vulnerability affects unknown code of the file /admin-api/system/mail-log/page. This manipulation of the argument toMail causes sql injection. The attack can be initiated remotely. The exploit has been made available to the...

5.8CVSS5.7AI score0.00253EPSS
SaveExploits0References7
Positive Technologies
Positive Technologies
added 2026/03/27 12:00 a.m.35 views

PT-2026-28272

Cache misconfiguration vulnerability in OpenText Identity Manager on Windows, Linux allows remote authenticated users to obtain another user's session data via insecure application cache handling. This issue affects Identity Manager: 25.2v4.10.1...

8.4CVSS6AI score0.00286EPSS
SaveExploits0References5
Positive Technologies
Positive Technologies
added 2026/03/26 12:00 a.m.35 views

PT-2026-28334

Name of the Vulnerable Software and Affected Versions Complianz – GDPR/CCPA Cookie Consent plugin for WordPress versions prior to 7.4.4.3 Description The Complianz – GDPR/CCPA Cookie Consent plugin for WordPress is susceptible to Stored Cross-Site Scripting. This occurs because the revert divs to...

4.9CVSS6AI score0.00222EPSS
SaveExploits0References7
Positive Technologies
Positive Technologies
added 2026/03/26 12:00 a.m.35 views

PT-2026-28185

A security flaw has been discovered in kalcaddle kodbox 1.64. Impacted is the function can of the file /workspace/source-code/app/controller/explorer/auth.class.php of the component Password-protected Share Handler. Performing a manipulation results in improper authentication. The attack is...

6.3CVSS4.9AI score0.0048EPSS
SaveExploits0References5
Positive Technologies
Positive Technologies
added 2026/03/25 12:00 a.m.35 views

PT-2026-28176

Name of the Vulnerable Software and Affected Versions Streamlit versions prior to 1.54.0 Description Streamlit Open Source versions running on Windows hosts are affected by an unauthenticated Server-Side Request Forgery SSRF issue. This arises from insufficient validation of filesystem paths...

4.7CVSS5.9AI score0.00282EPSS
SaveExploits0References10
Positive Technologies
Positive Technologies
added 2026/03/25 12:00 a.m.35 views

PT-2026-28097

What are the limits of AI-assisted vulnerability hunting? I obtained 23 CVEs in one month. BentoML 8.2k CVE-2026-27905 HIGH SillyTavern 24.6k CVE-2026-26286 HIGH Plane 28.2k CVE-2026-27705 MEDIUM NocoDB 46.4k CVE-2026-28399 MEDIUM Mautic 8.4k CVE-2026-3105 HIGH File Browser 27.9k CVE-2026-28492...

9.8CVSS5.8AI score0.01701EPSS
SaveExploits12References1
Positive Technologies
Positive Technologies
added 2026/03/22 12:00 a.m.35 views

PT-2026-27019

A security flaw has been discovered in Tenda F453 1.0.0.3. The affected element is the function FormWriteFacMac of the file /goform/WriteFacMac. The manipulation of the argument mac results in command injection. It is possible to launch the attack remotely. The exploit has been released to the...

6.5CVSS6.4AI score0.03749EPSS
SaveExploits1References7
Positive Technologies
Positive Technologies
added 2026/03/17 12:00 a.m.35 views

PT-2026-25918

Sipeed NanoKVM before 2.3.1 exposes a Wi-Fi configuration endpoint without proper security checks, allowing an unauthenticated attacker with network access to change the saved configured Wi-Fi network to one of the attacker's choosing, or craft a request to exhaust the system memory and terminate...

8.8CVSS5.8AI score0.00504EPSS
SaveExploits0References10
Positive Technologies
Positive Technologies
added 2026/03/16 12:00 a.m.35 views

PT-2026-25826

Name of the Vulnerable Software and Affected Versions SiYuan versions 3.6.0 and below SiYuan versions prior to 3.6.1 Description SiYuan is a personal knowledge management system. The mobile file tree component MobileFiles.ts renders notebook names using innerHTML without proper HTML escaping when...

9CVSS6AI score0.00796EPSS
SaveExploits1
Positive Technologies
Positive Technologies
added 2026/03/13 12:00 a.m.35 views

PT-2026-25267

Missing Authorization vulnerability in Agile Logix Post Timeline post-timeline allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Post Timeline: from n/a through = 2.4.1...

5.3CVSS5.8AI score0.00199EPSS
SaveExploits0References3
Positive Technologies
Positive Technologies
added 2026/03/11 12:00 a.m.35 views

PT-2026-24589

Name of the Vulnerable Software and Affected Versions Koha affected versions not specified Description An authenticated SQL Injection issue exists in the Koha staff interface. The issue is located in the /cgi-bin/koha/suggestion/suggestion.pl endpoint, specifically due to insufficient validation ...

9CVSS6AI score0.00372EPSS
SaveExploits0References12
Positive Technologies
Positive Technologies
added 2026/03/11 12:00 a.m.35 views

PT-2026-24547

The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.2.7. This is due to missing or incorrect nonce validation on the reload preview function. This makes it possible for...

6.1CVSS5.6AI score0.00095EPSS
SaveExploits0References3
Positive Technologies
Positive Technologies
added 2026/03/05 12:00 a.m.35 views

PT-2026-23404

Improper Control of Generation of Code 'Code Injection' vulnerability in Crocoblock JetEngine jet-engine allows Remote Code Inclusion.This issue affects JetEngine: from n/a through = 3.7.2...

6AI score0.00234EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
added 2026/03/03 12:00 a.m.35 views

PT-2026-22714

Name of the Vulnerable Software and Affected Versions The All-in-One Microsoft 365 & Entra ID / Azure AD SSO Login plugin for WordPress versions through 2.2.5 Description The All-in-One Microsoft 365 & Entra ID / Azure AD SSO Login plugin for WordPress is susceptible to an authentication bypass,...

9.8CVSS5.7AI score0.00856EPSS
SaveExploits0References12
Positive Technologies
Positive Technologies
added 2026/03/02 12:00 a.m.35 views

PT-2026-26419

Summary In [email protected], sandbox network hardening blocks network=host but still allows network=container:. This can let a sandbox join another container's network namespace and reach services available in that namespace. Preconditions and Trust Model Context This issue requires a...

9.8CVSS5.8AI score0.00265EPSS
SaveExploits0References11
Positive Technologies
Positive Technologies
added 2026/03/02 12:00 a.m.35 views

PT-2026-22627

Name of the Vulnerable Software and Affected Versions ZimaOS versions prior to 1.5.1 Description ZimaOS, a fork of CasaOS, is susceptible to a flaw stemming from inadequate validation or restriction of target URLs. An authenticated local user can construct requests that target internal IP...

7.1CVSS5.9AI score0.00238EPSS
SaveExploits1References9
Positive Technologies
Positive Technologies
added 2026/03/02 12:00 a.m.35 views

PT-2026-47313

Name of the Vulnerable Software and Affected Versions Apache HTTP Server versions 2.4.0 through 2.4.67 Description A Use After Free issue exists in Apache HTTP Server when using mod ldap in per-directory configuration. Use After Free occurs when an application continues to use a pointer after it...

9.8CVSS5.6AI score0.01118EPSS
SaveExploits0References147
Positive Technologies
Positive Technologies
added 2026/03/02 12:00 a.m.35 views

PT-2026-42471

Name of the Vulnerable Software and Affected Versions Trend Micro Apex One affected versions not specified Trend Micro Apex One as a Service affected versions not specified Description An origin validation issue in the Apex One/SEP agent allows a local attacker to escalate privileges. This flaw...

7.8CVSS6AI score0.00213EPSS
SaveExploits0References13
Positive Technologies
Positive Technologies
added 2026/02/25 12:00 a.m.35 views

PT-2026-21986

Name of the Vulnerable Software and Affected Versions Windows versions prior to September 2025 cumulative update for Windows 11 2024 LTSC and Windows Server 2025 Windows 11 23H2 and earlier Description The issue is caused by improper handling of invalid use of special elements within the CLFS.sys...

5.5CVSS5.8AI score0.0041EPSS
SaveExploits2References13
Positive Technologies
Positive Technologies
added 2026/02/25 12:00 a.m.35 views

PT-2026-21829

Name of the Vulnerable Software and Affected Versions CyberArk Endpoint Privilege Manager Agent versions 25.10.0 and lower Description The CyberArk Endpoint Privilege Manager Agent versions 25.10.0 and lower have a condition that may allow unauthorized privilege elevation through CyberArk elevati...

8.5CVSS6AI score0.00146EPSS
SaveExploits0References6
Positive Technologies
Positive Technologies
added 2026/02/24 12:00 a.m.35 views

PT-2026-21786

Name of the Vulnerable Software and Affected Versions Devolutions Server versions prior to 2025.3.15 Description An authenticated user can bypass permissions and access entries due to a permission cache poisoning issue in Devolutions Server. Recommendations Update Devolutions Server to version...

5.2AI score0.00224EPSS
SaveExploits0References3
Positive Technologies
Positive Technologies
added 2026/02/23 12:00 a.m.35 views

PT-2026-21546

Name of the Vulnerable Software and Affected Versions Astro versions prior to 9.5.4 Description Astro, a web framework, is affected by a Server-Side Request Forgery SSRF issue in versions prior to 9.5.4. Server-Side Rendered pages returning an error with a prerendered custom error page such as...

8.6CVSS5.3AI score0.01769EPSS
SaveExploits1References17
Positive Technologies
Positive Technologies
added 2026/02/19 12:00 a.m.35 views

PT-2026-23488

Name of the Vulnerable Software and Affected Versions Gogs versions prior to 0.14.2 Description Gogs, a self-hosted Git service, is affected by a DOM-Based Cross-Site Scripting XSS issue. An attacker can inject an HTML/JavaScript payload into a repository’s Milestone name. When another user selec...

8.5CVSS5.8AI score0.00184EPSS
SaveExploits0
Positive Technologies
Positive Technologies
added 2026/02/19 12:00 a.m.35 views

PT-2026-20776

The MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions 4.0 to 5.10 via the 'load track note ajax' due to missing validation on a user controlled key. This makes it possible for unauthenticated...

5.3CVSS5.6AI score0.00245EPSS
SaveExploits0References4
Positive Technologies
Positive Technologies
added 2026/02/18 12:00 a.m.35 views

PT-2026-20375

The Complianz – GDPR/CCPA Cookie Consent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's cmplz-accept-link shortcode in all versions up to, and including, 7.4.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it...

6.4CVSS5.7AI score0.00245EPSS
SaveExploits0References4
Positive Technologies
Positive Technologies
added 2026/02/11 12:00 a.m.35 views

PT-2026-7581

CWE‑94: Improper Control of Generation of Code vulnerability exists that could cause execution of untrusted or unintended code within the application when maliciously crafted design content is processed through a TGML graphics file...

7CVSS5.9AI score0.0013EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
added 2026/02/09 12:00 a.m.35 views

PT-2026-7121

A vulnerability was found in janet-lang janet up to 1.40.1. This affects the function os strftime of the file src/core/os.c. Performing a manipulation results in out-of-bounds read. The attack must be initiated from a local position. The exploit has been made public and could be used. The patch i...

4.8CVSS5.1AI score0.00169EPSS
SaveExploits1References8
Positive Technologies
Positive Technologies
added 2026/02/08 12:00 a.m.35 views

PT-2026-7025

Name of the Vulnerable Software and Affected Versions Tenda AC9 version 15.03.06.42 multi Description A security issue exists in the function formGetRebootTimer of Tenda AC9 routers. Manipulation of the arguments sys.schedulereboot.start time/sys.schedulereboot.end time can lead to a stack-based...

8.6CVSS6AI score0.00662EPSS
SaveExploits1References8
Positive Technologies
Positive Technologies
added 2026/02/05 12:00 a.m.35 views

PT-2026-6581

Name of the Vulnerable Software and Affected Versions 10-Strike Network Inventory Explorer version 9.03 Description The software contains a buffer overflow issue in the file import functionality that enables remote attackers to run code without authorization. An attacker can create a specially...

9.8CVSS6.5AI score0.0063EPSS
SaveExploits0References6
Positive Technologies
Positive Technologies
added 2026/02/04 12:00 a.m.35 views

PT-2026-6097

Name of the Vulnerable Software and Affected Versions GalaxyDiagnostics versions prior to 3.5.050 Description Improper input validation in GalaxyDiagnostics prior to version 3.5.050 allows local privileged attackers to execute privileged commands. Recommendations Update GalaxyDiagnostics to versi...

8.7CVSS5.5AI score0.00136EPSS
SaveExploits0References3
Positive Technologies
Positive Technologies
added 2026/02/02 12:00 a.m.35 views

PT-2026-5624

Name of the Vulnerable Software and Affected Versions Modem affected versions not specified Description A system crash due to an uncaught exception may lead to remote denial of service. This can occur if a User Equipment UE connects to a rogue base station controlled by an attacker, requiring no...

7.5CVSS5.7AI score0.00676EPSS
SaveExploits0References7
Positive Technologies
Positive Technologies
added 2026/02/02 12:00 a.m.35 views

PT-2026-5667

A unauthenticated adjacent attacker could potentially disrupt operations by switching between multiple configuration presets via CAN...

6.5CVSS5.3AI score0.00208EPSS
SaveExploits0References3
Positive Technologies
Positive Technologies
added 2026/01/26 12:00 a.m.35 views

PT-2026-4790

Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.195037 disclose sensitive account credentials in cleartext within HTTP responses generated by the maintenance interface. Because the management interface is accessible over unencrypted HTTP by default, credentials may be expose...

8.2CVSS5.9AI score0.00235EPSS
SaveExploits0References3
Positive Technologies
Positive Technologies
added 2026/01/22 12:00 a.m.35 views

PT-2026-4277

Edge Crisis: CISA added two critical vulnerabilities to the Known Exploited Vulnerabilities catalog yesterday. CVE-2026-21809 and CVE-2026-21810 target Citrix Workspace and Ivanti Connect Secure. Federal agencies have until February 11 to remediate...

5.5AI score
SaveExploits0References2
Positive Technologies
Positive Technologies
added 2026/01/22 12:00 a.m.35 views

PT-2026-4181

Missing Authorization vulnerability in e-plugins fitness-trainer fitness-trainer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects fitness-trainer: from n/a through = 1.7.1...

5.4AI score0.00228EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
added 2026/01/21 12:00 a.m.35 views

PT-2026-3874

Name of the Vulnerable Software and Affected Versions FastAPI Api Key versions prior to 1.1.0 Description The verify key function in FastAPI Api Key contains a timing side-channel that allows an attacker to differentiate between valid and invalid API keys by measuring response latencies. The meth...

3.7CVSS5.3AI score0.00264EPSS
SaveExploits0References16
Positive Technologies
Positive Technologies
added 2026/01/20 12:00 a.m.35 views

PT-2026-3674

Name of the Vulnerable Software and Affected Versions Oracle Utilities Application Framework versions 4.4.0.3.0 through 4.5.0.2.0 Oracle Utilities Application Framework versions 25.4 and 25.10 Description A flaw exists within the Oracle Utilities Application Framework component of Oracle Utilitie...

5.4CVSS7.3AI score0.00187EPSS
SaveExploits0References3
Positive Technologies
Positive Technologies
added 2026/01/13 12:00 a.m.35 views

PT-2026-2388

Name of the Vulnerable Software and Affected Versions ImpressCMS version 1.4.4 Description The software contains a file upload issue due to insufficient extension validation. This allows attackers to upload potentially malicious files by bypassing file upload restrictions using alternative file...

9.8CVSS7.2AI score0.01021EPSS
SaveExploits1References6
Positive Technologies
Positive Technologies
added 2026/01/08 12:00 a.m.35 views

PT-2026-2108

Name of the Vulnerable Software and Affected Versions Flag Forge versions 2.3.2 and below Description Flag Forge is a Capture The Flag CTF platform susceptible to a Regular Expression Denial of Service ReDoS condition. The issue resides in the user profile API endpoint, /api/user/username. The...

7.5CVSS6.5AI score0.00273EPSS
SaveExploits0References7
Positive Technologies
Positive Technologies
added 2026/01/06 12:00 a.m.35 views

PT-2026-1538

Name of the Vulnerable Software and Affected Versions versions prior to 2.3 Description A memory corruption issue exists when handling identity credential operations within the trusted application. The issue can be triggered by specific operations related to identity credentials. Recommendations ...

7.8CVSS6.5AI score0.00073EPSS
SaveExploits0References5
Positive Technologies
Positive Technologies
added 2026/01/05 12:00 a.m.35 views

PT-2026-1213

Name of the Vulnerable Software and Affected Versions UTT 进取 520W version 1.7.7-180627 Description A security issue has been identified in the software. The strcpy function within the /goform/formUser file is susceptible to a buffer overflow when handling the passwd1 argument. This manipulation c...

9CVSS6.7AI score0.00797EPSS
SaveExploits1References13
Positive Technologies
Positive Technologies
added 2026/01/05 12:00 a.m.35 views

PT-2026-1294

Name of the Vulnerable Software and Affected Versions Employee Leave Management System version 2.1 Description A Cross Site Request Forgery issue exists in Employee Leave Management System version 2.1. A remote attacker can potentially escalate privileges through the manage-employee.php component...

5.4CVSS5.9AI score0.0007EPSS
SaveExploits0References7
Positive Technologies
Positive Technologies
added 2025/12/24 12:00 a.m.35 views

PT-2025-53120

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A memory leak exists in the multi transaction new function within the AppArmor subsystem. Specifically, the variable t is not freed or passed out if copy from user fails, leading to a...

7.8CVSS6.4AI score0.0094EPSS
SaveExploits2References897
Positive Technologies
Positive Technologies
added 2025/12/09 12:00 a.m.35 views

PT-2025-49626

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A memory leak exists in the hpsa init one function within the SCSI subsystem of the Linux kernel. The hpda alloc ctlr info function allocates memory for a controller information structur...

7.8CVSS6.2AI score0.0094EPSS
SaveExploits2References899
Positive Technologies
Positive Technologies
added 2025/12/09 12:00 a.m.35 views

PT-2025-49620

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A flaw exists in the Linux kernel's mmc core component related to handling non-standard SDIO cards. Specifically, the issue arises from an incorrect reference counter management when a...

7.8CVSS6.7AI score0.0094EPSS
SaveExploits2References899
Positive Technologies
Positive Technologies
added 2025/11/06 12:00 a.m.35 views

PT-2025-45284

Incorrect Privilege Assignment vulnerability in Holest Engineering Selling Commander for WooCommerce selling-commander-connector allows Privilege Escalation.This issue affects Selling Commander for WooCommerce: from n/a through = 1.2.46...

7AI score0.00408EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
added 2025/09/22 12:00 a.m.35 views

PT-2025-38835

Name of the Vulnerable Software and Affected Versions MantraBrain Ultimate Watermark versions through 1.1 Description An authorization issue exists in MantraBrain Ultimate Watermark due to incorrectly configured access control security levels. This allows exploitation of the system. Recommendatio...

4.3CVSS6.6AI score0.0023EPSS
SaveExploits0References3
Positive Technologies
Positive Technologies
added 2025/09/18 12:00 a.m.35 views

PT-2025-38290

Name of the Vulnerable Software and Affected Versions D-Link DIR-852 version 1.00CN B09 Description A vulnerability exists in the Web Management Interface component of D-Link DIR-852 version 1.00CN B09. Manipulation of unknown code within the /htdocs/cgibin/hedwig.cgi file can lead to command...

8.8CVSS6.4AI score0.08849EPSS
SaveExploits1References9
Total number of security vulnerabilities5000