Lucene search
+L
PtsecurityMost viewed

212496 matches found

Positive Technologies
Positive Technologies
•added 2026/06/01 12:00 a.m.•44 views

PT-2026-45663

Name of the Vulnerable Software and Affected Versions SGLang version 0.5.10.post1 Description A flaw exists in the Inference HTTP Endpoint component within the file python/sglang/srt/lora/lora manager.py. Remote manipulation of the lora path argument can trigger a reachable assertion, potentially...

6.3CVSS6AI score0.00368EPSS
SaveExploits0References16
Positive Technologies
Positive Technologies
•added 2026/05/31 12:00 a.m.•44 views

PT-2026-45174

A vulnerability has been found in code-projects Online Music Site 1.0. This affects an unknown part of the file /Administrator/PHP/AdminUpdateAlbum.php. Such manipulation of the argument ID leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public a...

5.8CVSS5.7AI score0.00206EPSS
SaveExploits0References6
Positive Technologies
Positive Technologies
•added 2026/05/31 12:00 a.m.•44 views

PT-2026-45167

A vulnerability was found in Edimax BR-6478AC 1.23. Impacted is the function formUSBFolder of the file /goform/formUSBFolder of the component POST Request Handler. The manipulation of the argument ShareName/SelectName results in buffer overflow. The attack can be executed remotely. The exploit ha...

9CVSS7.7AI score0.00463EPSS
SaveExploits0References5
Positive Technologies
Positive Technologies
•added 2026/05/31 12:00 a.m.•44 views

PT-2026-45212

Name of the Vulnerable Software and Affected Versions Sereal::Decoder versions prior to 5.005 Description An issue exists where crafted input can lead to a heap out-of-bounds read. In the file Perl/Decoder/srl decoder.c, the functions srl read object and srl read hash process a COPY tag, which is...

8.1CVSS5.7AI score0.00485EPSS
SaveExploits0References9
Positive Technologies
Positive Technologies
•added 2026/05/29 12:00 a.m.•44 views

PT-2026-44998

Name of the Vulnerable Software and Affected Versions ExtremeCloud IQ affected versions not specified Description A race condition in the shared Extreme Platform ONE IAM Gateway API-key authentication path can intermittently allow requests authenticated with an Extreme Platform ONE /IAM-issued AP...

6.3CVSS5.8AI score0.00257EPSS
SaveExploits0References6
Positive Technologies
Positive Technologies
•added 2026/05/29 12:00 a.m.•44 views

PT-2026-44926

Name of the Vulnerable Software and Affected Versions Danelec MacGregor Voyage Data Recorder affected versions not specified Description The software includes default accounts with hard-coded credentials, which can allow unauthorized access to the system. Recommendations At the moment, there is n...

8.7CVSS5.5AI score0.00343EPSS
SaveExploits0References6
Positive Technologies
Positive Technologies
•added 2026/05/29 12:00 a.m.•44 views

PT-2026-44859

Name of the Vulnerable Software and Affected Versions WP Travel Pro versions prior to 10.6.1 Description The plugin allows unauthenticated attackers to delete arbitrary user accounts, including administrators. This occurs via the '/wp-json/wp-travel/v1/travel-guide/user id' REST API endpoint...

9.1CVSS5.9AI score0.00464EPSS
SaveExploits0References5
Positive Technologies
Positive Technologies
•added 2026/05/29 12:00 a.m.•44 views

PT-2026-44979

Name of the Vulnerable Software and Affected Versions FastGPT versions prior to 4.15.0-beta1 Description An authenticated attacker can bypass the global isInternalAddress network protection to make arbitrary HTTP GET requests to internal network services. This occurs due to an incomplete fix in t...

7.7CVSS5.9AI score0.00361EPSS
SaveExploits0References6
Positive Technologies
Positive Technologies
•added 2026/05/29 12:00 a.m.•44 views

PT-2026-44759

The Plus Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'carousel direction' parameter of the Carousel Anything widget in versions up to, and including, 6.4.15 This is due to insufficient output escaping in the render function, where the carousel...

6.4CVSS6AI score0.00331EPSS
SaveExploits0References5
Positive Technologies
Positive Technologies
•added 2026/05/28 12:00 a.m.•44 views

PT-2026-44203

The SlimStat Analytics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'User-Agent' header in all versions up to, and including, 5.4.11 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary we...

7.2CVSS6AI score0.00527EPSS
SaveExploits0References15
Positive Technologies
Positive Technologies
•added 2026/05/28 12:00 a.m.•44 views

PT-2026-44179

Name of the Vulnerable Software and Affected Versions Frontend Admin by DynamiApps versions prior to 3.29.3 Description An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. Authenticated attackers with subscriber-level...

8.8CVSS5.9AI score0.00752EPSS
SaveExploits0References16
Positive Technologies
Positive Technologies
•added 2026/05/28 12:00 a.m.•44 views

PT-2026-44421

Casdoor versions 2.362.0 and earlier contain a vulnerability involving unverified email binding that may enable account takeover. The getExistUserByBindingRule function matches users by email without checking the email verified claim from upstream providers; the idp.UserInfo struct does not even...

5.8AI score0.00404EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
•added 2026/05/28 12:00 a.m.•44 views

PT-2026-44292

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the hfsplus module where the hfs brec read function fails to validate that the on-disk record size matches the expected size for the record type being read. When...

5.5CVSS6.6AI score0.00173EPSS
SaveExploits0
Positive Technologies
Positive Technologies
•added 2026/05/28 12:00 a.m.•44 views

PT-2026-44210

The PeachPay — Payments & Express Checkout for WooCommerce supports Stripe, PayPal, Square, Authorize.net, NMI plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.120.46. This is due to missing or incorrect nonce validation on the peachpay stri...

4.3CVSS5.7AI score0.00201EPSS
SaveExploits0References9
Positive Technologies
Positive Technologies
•added 2026/05/28 12:00 a.m.•44 views

PT-2026-44389

Name of the Vulnerable Software and Affected Versions TinyMCE versions 6.8.0 through 7.0.x Description An XSS Cross-Site Scripting issue exists due to improper SVG namespace scope handling within the sanitizer. An attacker can use a crafted payload with nested elements to bypass attribute...

8.7CVSS6AI score0.00275EPSS
SaveExploits0References5
Positive Technologies
Positive Technologies
•added 2026/05/28 12:00 a.m.•44 views

PT-2026-44215

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to unauthenticated privilege escalation in versions up to and including 3.29.2. This is due to insecure form submission handling that accepts arbitrary form definitions from user input instead of securely loading them from the...

8.8CVSS5.9AI score0.01173EPSS
SaveExploits0References11
Positive Technologies
Positive Technologies
•added 2026/05/28 12:00 a.m.•44 views

PT-2026-44707

An access bypass vulnerability in Drupal TFA Basic Plugins allows users with the administer users permission to view or generate recovery codes for other users. This issue affects TFA Basic Plugins: from 7.x-1.0 through 7.x-1.2...

5.1CVSS5.8AI score0.00387EPSS
SaveExploits1References3
Positive Technologies
Positive Technologies
•added 2026/05/28 12:00 a.m.•44 views

PT-2026-44289

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A slab-use-after-free error exists in the mac80211 wireless subsystem. The issue occurs during radar detect work when the ieee80211 dfs cac cancel function is called, which can cause the...

8.8CVSS6AI score0.00287EPSS
SaveExploits0
Positive Technologies
Positive Technologies
•added 2026/05/27 12:00 a.m.•44 views

PT-2026-43546

The LiteSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the /wp-json/litespeed/v1/notify ccss and /wp-json/litespeed/v1/notify ucss REST API endpoints in all versions up to, and including, 7.7. These endpoints accept CSS content from QUIC.cloud callback...

7.2CVSS5.8AI score0.00438EPSS
SaveExploits0References9
Positive Technologies
Positive Technologies
•added 2026/05/27 12:00 a.m.•44 views

PT-2026-44013

Name of the Vulnerable Software and Affected Versions Jenkins Email Extension Plugin versions prior to 1933.v45cec755423f Description The plugin allows inlining images as base64 in email content by setting the data-inline attribute. Because there are no restrictions on the image URLs that can be...

8.8CVSS5.9AI score0.00509EPSS
SaveExploits0References4
Positive Technologies
Positive Technologies
•added 2026/05/27 12:00 a.m.•44 views

PT-2026-47120

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=516422427 Crash type: Heap-buffer-overflow READ 1 Crash state: ihevcd sao shift ctb ihevcd process ihevcd parse slice data...

5.4AI score
SaveExploits0References2
Positive Technologies
Positive Technologies
•added 2026/05/27 12:00 a.m.•44 views

PT-2026-43621

Name of the Vulnerable Software and Affected Versions python-engineio versions prior to 4.13.2 Description An attacker can trigger the creation of unnecessary background threads in the server by exploiting the heartbeat mechanism. This occurs when a new connection is received or when a client sen...

7.5CVSS6.1AI score0.00575EPSS
SaveExploits0References18
Positive Technologies
Positive Technologies
•added 2026/05/27 12:00 a.m.•44 views

PT-2026-43518

The Team Master – A Modern WordPress Team Showcase plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes in all versions up to, and including, 1.1.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,...

6.4CVSS6AI score0.00261EPSS
SaveExploits0References4
Positive Technologies
Positive Technologies
•added 2026/05/27 12:00 a.m.•44 views

PT-2026-43787

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the ext4 file system where a double decrement of the dirty clusters counter occurs during file system shutdown. This happens in the error path between the ext4 mb mark...

7.8CVSS5.4AI score0.00199EPSS
SaveExploits0
Positive Technologies
Positive Technologies
•added 2026/05/27 12:00 a.m.•44 views

PT-2026-43785

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A race condition exists in the OpenVPN implementation within the Linux kernel. When a peer is deleted due to keepalive expiration, it is moved to a release list for processing via the ov...

5.5CVSS5.8AI score0.0017EPSS
SaveExploits0References12
Positive Technologies
Positive Technologies
•added 2026/05/26 12:00 a.m.•44 views

PT-2026-43307

Name of the Vulnerable Software and Affected Versions Bugsink versions prior to 2.2.0 Description Bugsink is a self-hosted error tracking tool that resolved sourcemaps and debug files by debug ID without scoping the lookup to the project that owned the uploaded metadata. An authenticated user wit...

4.3CVSS5.4AI score0.00281EPSS
SaveExploits0References12
Positive Technologies
Positive Technologies
•added 2026/05/26 12:00 a.m.•44 views

PT-2026-47116

Use after free in garbage collector and finalizer of lgc.c in Lua interpreter 5.4.05.4.3 allows attackers to perform Sandbox Escape via a crafted script file...

5.5AI score
SaveExploits0References6
Positive Technologies
Positive Technologies
•added 2026/05/26 12:00 a.m.•44 views

PT-2026-43425

Name of the Vulnerable Software and Affected Versions Vanetza versions 26.02 and earlier Description A denial-of-service issue exists in the cryptographic verification pipeline. When processing incoming V2X messages, the ASN.1 decoder accepts structures as syntactically valid even if semantic...

7.5CVSS5.8AI score0.00333EPSS
SaveExploits0References7
Positive Technologies
Positive Technologies
•added 2026/05/26 12:00 a.m.•44 views

PT-2026-43163

Name of the Vulnerable Software and Affected Versions Archive::Tar versions prior to 3.08 Description Archive::Tar for Perl allows the extraction of hardlinks to attacker-controlled paths outside the intended extraction directory. The function make special file passes the tar header's linkname to...

7.5CVSS5.4AI score0.00471EPSS
SaveExploits0References18
Positive Technologies
Positive Technologies
•added 2026/05/26 12:00 a.m.•44 views

PT-2026-43281

IBM Financial Transaction Manager for SWIFT Services for Multiplatforms 3.2.4.0 through 3.2.4.15 IBM Financial Transaction Manager SWIFT is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the...

5.4CVSS5.6AI score0.00193EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
•added 2026/05/26 12:00 a.m.•44 views

PT-2026-43336

Name of the Vulnerable Software and Affected Versions NVIDIA Display Driver for Windows and Linux affected versions not specified Description An out-of-bounds write issue exists, which occurs when a program writes data past the end of the intended buffer. A successful exploit could result in deni...

7.8CVSS5.3AI score0.00197EPSS
SaveExploits0References7
Positive Technologies
Positive Technologies
•added 2026/05/26 12:00 a.m.•44 views

PT-2026-43326

A vulnerability has been found in sambitraj STUDENT-MANAGEMENT-SYSTEM up to 56ba287f2e9031523ccb4244cb6e3fe530e4e5d5. The affected element is an unknown function of the component Dashboard. Such manipulation leads to improper access controls. The attack may be launched remotely. The exploit has...

7.5CVSS6.6AI score0.00495EPSS
SaveExploits0References7
Positive Technologies
Positive Technologies
•added 2026/05/26 12:00 a.m.•44 views

PT-2026-43302

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified openSUSE Tumbleweed versions prior to kernel-devel-7.0.11-1.1 Description A null pointer dereference exists in the Bluetooth L2CAP component. This occurs within the l2cap sock state change cb...

5.7CVSS5.2AI score0.00162EPSS
SaveExploits0
Positive Technologies
Positive Technologies
•added 2026/05/25 12:00 a.m.•44 views

PT-2026-42989

A security flaw has been discovered in SourceCodester Indian Invoicing System up to 0.x/1.0. The impacted element is an unknown function of the file /Invoicing/add order.php of the component Invoice Template Render Database-Backed. The manipulation of the argument customer name results in cross...

5.1CVSS4.2AI score0.00331EPSS
SaveExploits0References5
Positive Technologies
Positive Technologies
•added 2026/05/25 12:00 a.m.•44 views

PT-2026-43138

Name of the Vulnerable Software and Affected Versions WPSubscription versions prior to 1.9.2 Description A Cross-Site Request Forgery CSRF flaw exists in the Convers Lab WPSubscription plugin. This issue allows an attacker to induce a victim to perform unintended actions on the web application by...

4.3CVSS5.8AI score0.00122EPSS
SaveExploits0References4
Positive Technologies
Positive Technologies
•added 2026/05/25 12:00 a.m.•44 views

PT-2026-43068

Name of the Vulnerable Software and Affected Versions hackney versions 0.10.0 through 4.0.0 Description Uncontrolled Resource Consumption in the SOCKS5 transport within src/hackney socks5.erl allows flooding. While the caller-supplied timeout is applied during the SOCKS5 negotiation phase, the...

8.2CVSS5.8AI score0.007EPSS
SaveExploits1References14
Positive Technologies
Positive Technologies
•added 2026/05/25 12:00 a.m.•44 views

PT-2026-43020

A severe vulnerability was disclosed for Edimax EW-7438RPn CVE-2026-9482 https://t.co/41d9U3ZOrq...

5.8AI score0.00805EPSS
SaveExploits0References1
Positive Technologies
Positive Technologies
•added 2026/05/22 12:00 a.m.•44 views

PT-2026-42810

Name of the Vulnerable Software and Affected Versions YesWiki versions prior to 4.6.4 Description An unauthenticated SQL injection exists in the Bazar form-import path within the FormManager::create function. This flaw allows an unauthenticated visitor of a default installation to inject arbitrar...

9.8CVSS5.6AI score0.01992EPSS
SaveExploits0References8
Positive Technologies
Positive Technologies
•added 2026/05/21 12:00 a.m.•44 views

PT-2026-42851

Name of the Vulnerable Software and Affected Versions Azure Resource Manager affected versions not specified Description Improper authentication in Azure Resource Manager ARM allows an unauthorized attacker to elevate privileges over a network. Recommendations At the moment, there is no informati...

10CVSS5.8AI score0.00901EPSS
SaveExploits0References10
Positive Technologies
Positive Technologies
•added 2026/05/21 12:00 a.m.•44 views

PT-2026-42494

Name of the Vulnerable Software and Affected Versions Open ISES Tickets versions prior to 3.44.2 Description A reflected cross-site scripting issue exists in the 'db loader.php' endpoint. Authenticated attackers can inject arbitrary JavaScript by providing unsanitized values through the POST...

5.4CVSS6AI score0.00295EPSS
SaveExploits0References7
Positive Technologies
Positive Technologies
•added 2026/05/21 12:00 a.m.•44 views

PT-2026-42480

Name of the Vulnerable Software and Affected Versions Open ISES Tickets versions prior to 3.44.2 Description A reflected cross-site scripting issue exists in the 'add.php' endpoint. Authenticated attackers can inject arbitrary JavaScript by providing an unsanitized value through the ticket id POS...

5.4CVSS6AI score0.00295EPSS
SaveExploits0References8
Positive Technologies
Positive Technologies
•added 2026/05/21 12:00 a.m.•44 views

PT-2026-42532

IINA before 1.4.3 contains a user-assisted command execution vulnerability that allows remote attackers to execute arbitrary commands by supplying malicious mpv -prefixed query parameters through the iina://open custom URL scheme handler. Attackers can deliver a crafted URL via a browser that...

8.8CVSS6.2AI score0.01052EPSS
SaveExploits0References5
Positive Technologies
Positive Technologies
•added 2026/05/21 12:00 a.m.•44 views

PT-2026-42441

Name of the Vulnerable Software and Affected Versions Honeywell Control Network Module CNM affected versions not specified Description The software allows the insertion of sensitive information into an unintended directory. An attacker could exploit this issue by probing system files, which may...

5.9CVSS5.4AI score0.00332EPSS
SaveExploits0References6
Positive Technologies
Positive Technologies
•added 2026/05/21 12:00 a.m.•44 views

PT-2026-42464

Name of the Vulnerable Software and Affected Versions ADSelfService Plus versions prior to 6525 DataSecurity Plus versions prior to 6264 RecoveryManager Plus versions prior to 6313 Description Authenticated remote code execution can occur in agent machines due to a bug in a third-party dependency...

8.4CVSS6.5AI score0.04011EPSS
SaveExploits0References4
Positive Technologies
Positive Technologies
•added 2026/05/19 12:00 a.m.•44 views

PT-2026-41989

Name of the Vulnerable Software and Affected Versions ScadaBR version 1.2.0 Description An OS Command Injection allows an attacker to execute commands with root privileges on the SCADA system. Recommendations At the moment, there is no information about a newer version that contains a fix for thi...

9.8CVSS6AI score0.02055EPSS
SaveExploits0References7
Positive Technologies
Positive Technologies
•added 2026/05/19 12:00 a.m.•44 views

PT-2026-41898

Name of the Vulnerable Software and Affected Versions Apache Camel affected versions not specified Description An unauthenticated attacker can perform message header injection due to missing inbound filtering in the CxfRsHeaderFilterStrategy and Knative HeaderFilterStrategy implementations. This...

9.8CVSS6.4AI score0.01605EPSS
SaveExploits1References15
Positive Technologies
Positive Technologies
•added 2026/05/19 12:00 a.m.•44 views

PT-2026-41988

Name of the Vulnerable Software and Affected Versions ScadaBR version 1.2.0 Description Missing authentication for a critical function allows an unauthenticated attacker to send HTTP GET requests to the SCADA system to inject arbitrary sensor readings. Recommendations At the moment, there is no...

9.1CVSS5.9AI score0.00581EPSS
SaveExploits0References8
Positive Technologies
Positive Technologies
•added 2026/05/19 12:00 a.m.•44 views

PT-2026-41839

Name of the Vulnerable Software and Affected Versions Samsung Open Source Escargot version 590345cc6258317c5da850d846ce6baaf2afc2d3 Description Uncontrolled recursion in the software allows for excessive allocation of resources. Recommendations At the moment, there is no information about a newer...

7.5CVSS5.9AI score0.00273EPSS
SaveExploits0References6
Positive Technologies
Positive Technologies
•added 2026/05/19 12:00 a.m.•44 views

PT-2026-41831

Name of the Vulnerable Software and Affected Versions exifreader versions prior to 4.39.0 Description A crafted image containing an ICC mluc tag can specify an attacker-controlled record count combined with a zero record size. During the parsing process, the software repeatedly processes the same...

8.7CVSS5.8AI score0.00609EPSS
SaveExploits0References14
Positive Technologies
Positive Technologies
•added 2026/05/19 12:00 a.m.•44 views

PT-2026-45478

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.0.11 Linux kernel versions prior to 6.18.34 Linux kernel versions prior to 6.12.92 Linux kernel versions prior to 6.6.142 Linux kernel versions prior to 6.1.175 Linux kernel versions prior to 5.15.209 Linux...

7.8CVSS6.3AI score0.00202EPSS
SaveExploits4
Total number of security vulnerabilities5000