Lucene search
+L
PtsecurityMost viewed

200565 matches found

Positive Technologies
Positive Technologies
added 2026/07/03 12:00 a.m.33 views

PT-2026-55583

Name of the Vulnerable Software and Affected Versions IBM i versions 7.3 through 7.6 Description A remote attacker can send a specifically crafted message to downgrade the Transport Layer Security TLS protocol to a version that has been disabled in the server configuration. This issue involves th...

5.9CVSS5.4AI score0.00247EPSS
SaveExploits0References3
Positive Technologies
Positive Technologies
added 2026/07/03 12:00 a.m.33 views

PT-2026-55589

Name of the Vulnerable Software and Affected Versions Gitea versions prior to 1.25.5 Description The software lacks validation constraints for fields used during repository creation. This includes a lack of length limits for template fields and missing validation for trust model or object format...

9.1CVSS6.1AI score0.00373EPSS
SaveExploits0References7
Positive Technologies
Positive Technologies
added 2026/07/03 12:00 a.m.33 views

PT-2026-55534

Name of the Vulnerable Software and Affected Versions Dell PowerProtect Data Domain versions 7.7.1.0 through 8.6 Dell PowerProtect Data Domain LTS2026 release versions 8.6.1.0 through 8.6.1.10 Dell PowerProtect Data Domain LTS2025 release versions 8.3.1.0 through 8.3.1.30 Dell PowerProtect Data...

6.7CVSS6AI score0.00451EPSS
SaveExploits0References8
Positive Technologies
Positive Technologies
added 2026/07/02 12:00 a.m.33 views

PT-2026-55353

We have identified an authorization issue in Craft CMS where a forced folder move can delete a conflicting destination folder without destination delete permission. Description Craft CMS’s craftcontrollersAssetsController::actionMoveFolder supports moving an asset folder into a destination parent...

7.1CVSS5.9AI score0.00207EPSS
SaveExploits0References5
Positive Technologies
Positive Technologies
added 2026/07/02 12:00 a.m.33 views

PT-2026-55203

Missing authentication for critical function vulnerability in TR7 Cyber ​​Defense Inc. WAF-ASP allows Authentication Abuse. This issue affects WAF-ASP: from v1.0.324.900 before v1.4.0.117...

9.8CVSS5.8AI score0.00333EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
added 2026/07/02 12:00 a.m.33 views

PT-2026-55338

Name of the Vulnerable Software and Affected Versions Gardyn Home Kit and Studio devices affected versions not specified Gardyn IoT Hub affected versions not specified Description Gardyn devices and the associated IoT Hub cloud service expose a hardcoded privileged iothubowner key. An...

10CVSS6.3AI score0.00582EPSS
SaveExploits2References18
Positive Technologies
Positive Technologies
added 2026/07/02 12:00 a.m.33 views

PT-2026-55295

Pathway through 0.31.1, fixed in commit d09722e, document store applies a caller-supplied glob pattern to indexed document paths using a hand-written recursive matcher that branches two ways on each token without memoization, giving exponential worst-case complexity. The filepath globpattern valu...

8.7CVSS5.9AI score0.0047EPSS
SaveExploits0References5
Positive Technologies
Positive Technologies
added 2026/07/02 12:00 a.m.33 views

PT-2026-55269

Name of the Vulnerable Software and Affected Versions Erlang/OTP versions 20.0 through 29.0.2 Erlang/OTP versions 28.0 through 28.5.0.2 Erlang/OTP versions 27.0 through 27.3.4.13 ssl versions 8.2 through 11.7.2 ssl versions 11.6.0 through 11.6.0.2 ssl versions 11.2.0 through 11.2.12.9 Description...

7.5CVSS5.2AI score0.00277EPSS
SaveExploits0References82
Positive Technologies
Positive Technologies
added 2026/07/02 12:00 a.m.33 views

PT-2026-54869

GeoWebPlayer also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud is an addon that can be installed with various GeoVision software GV-VMS, GV-Cloud, .... It creates a websocket server that expands the capabilities of the various web-interfaces provided by the...

8.3CVSS5.8AI score0.00221EPSS
SaveExploits0References3
Positive Technologies
Positive Technologies
added 2026/07/02 12:00 a.m.33 views

PT-2026-54935

Name of the Vulnerable Software and Affected Versions MLflow versions prior to 3.14.0 Description When authentication is enabled, the trace API endpoints lack proper authorization validators. This occurs because the before request handler fails to register authorization validators for these...

8.1CVSS7.2AI score0.00376EPSS
SaveExploits1References9
Positive Technologies
Positive Technologies
added 2026/07/02 12:00 a.m.33 views

PT-2026-55231

Name of the Vulnerable Software and Affected Versions UniFi Connect Application versions prior to 3.4.17 Description An improper access control flaw exists in the UniFi Connect Application. A malicious actor with network access can exploit this issue to execute arbitrary commands on the host devi...

10CVSS6.4AI score0.02505EPSS
SaveExploits0References29
Positive Technologies
Positive Technologies
added 2026/07/02 12:00 a.m.33 views

PT-2026-55438

It was discovered that the nghttp2 nghttpx proxy incorrectly handled HTTP/1.1 Upgrade requests that included a Content-Length header and body. A remote attacker could possibly use this issue to perform HTTP request and response smuggling attacks against backend services...

6.3CVSS6.1AI score0.00263EPSS
SaveExploits0References3
Positive Technologies
Positive Technologies
added 2026/07/02 12:00 a.m.33 views

PT-2026-55339

Name of the Vulnerable Software and Affected Versions WatchGuard Fireware OS versions 11.0 through 11.12.4 Update1 WatchGuard Fireware OS versions 12.0 through 12.12 WatchGuard Fireware OS versions 2025.1 through 2026.2 Description An Out-of-bounds Write issue exists where an unauthenticated...

8.8CVSS6.2AI score0.00268EPSS
SaveExploits0References12
Positive Technologies
Positive Technologies
added 2026/07/01 12:00 a.m.34 views

PT-2026-54458

In Modem, there is a possible escalation of privilege due to a permissions bypass. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: MOLY01716533; Issue ID: MSV-6309...

5.8AI score0.0011EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
added 2026/07/01 12:00 a.m.33 views

PT-2026-54631

Name of the Vulnerable Software and Affected Versions pretix versions prior to 2026.5.3 Description A chain of weaknesses allows an attacker to impersonate any user in the backend and access any data. The issue stems from payment integration plugins Stripe, pretix-mollie, pretix-oppwa,...

9.4CVSS6.1AI score0.00271EPSS
SaveExploits0References4
Positive Technologies
Positive Technologies
added 2026/07/01 12:00 a.m.33 views

PT-2026-54931

Name of the Vulnerable Software and Affected Versions allegroai/clearml versions prior to 2.1.6 Description Relative path traversal occurs during the extraction of .zip archives via the ZipFile.extractall method within the StorageManager. extract to cache function. This is caused by a lack of pat...

2.4CVSS6.5AI score0.00357EPSS
SaveExploits0References6
Positive Technologies
Positive Technologies
added 2026/07/01 12:00 a.m.33 views

PT-2026-54783

Name of the Vulnerable Software and Affected Versions Microsoft Edge Chromium-based versions prior to 149.0.4022.98 Description A use-after-free issue exists in Microsoft Edge Chromium-based. This flaw allows an authorized attacker to execute arbitrary code over a network. Use-after-free is a...

8.3CVSS6.1AI score0.00456EPSS
SaveExploits0References8
Positive Technologies
Positive Technologies
added 2026/07/01 12:00 a.m.33 views

PT-2026-54455

Name of the Vulnerable Software and Affected Versions Modem affected versions not specified Description Improper input validation in the modem allows for remote information disclosure. This occurs when a User Equipment UE connects to a rogue base station controlled by an attacker. The exploitatio...

5.3CVSS6.2AI score0.00174EPSS
SaveExploits0References9
Positive Technologies
Positive Technologies
added 2026/07/01 12:00 a.m.33 views

PT-2026-54859

Name of the Vulnerable Software and Affected Versions Craft CMS versions 5.0.0-RC1 through 5.9.22 Craft CMS versions 4.0.0-RC1 through 4.17.15 Description An attacker with a GitHub account can inject a JavaScript payload into a craftcms/cms issue title. The payload executes within the control pan...

7.4CVSS5.8AI score0.00311EPSS
SaveExploits0References10
Positive Technologies
Positive Technologies
added 2026/07/01 12:00 a.m.33 views

PT-2026-54928

Name of the Vulnerable Software and Affected Versions FatFs versions R0.16 and earlier Description An uninitialized cluster exposure occurs when the f lseek function extends files beyond the end-of-file EOF without zero-filling newly allocated clusters. This issue is a Use of Uninitialized...

4.6CVSS6.1AI score0.00378EPSS
SaveExploits2References7
Positive Technologies
Positive Technologies
added 2026/07/01 12:00 a.m.33 views

PT-2026-54730

Exploiting QNAP devices CVE-2026-34007, CVE-2026-34008 https://t.co/f7KKp9dVFI infosec https://t.co/7yc8iidvo7...

6.1AI score
SaveExploits0References3
Positive Technologies
Positive Technologies
added 2026/06/30 12:00 a.m.33 views

PT-2026-53963

Name of the Vulnerable Software and Affected Versions IBM WebSphere Application Server version 9.0 IBM WebSphere Application Server version 8.5 Description A cross-site scripting issue exists within the administrative console help system. Cross-site scripting is a flaw that allows an attacker to...

9.3CVSS5.8AI score0.00336EPSS
SaveExploits0References7
Positive Technologies
Positive Technologies
added 2026/06/30 12:00 a.m.33 views

PT-2026-54046

Name of the Vulnerable Software and Affected Versions ImageMagick versions prior to 7.1.2-24 Description An incorrect policy check allows remote attackers to bypass path policy restrictions in sandboxed conversion services. This flaw enables the creation or truncation of files that are disallowed...

9.2CVSS5.9AI score0.00884EPSS
SaveExploits1References87
Positive Technologies
Positive Technologies
added 2026/06/30 12:00 a.m.33 views

PT-2026-53984

An unauthenticated URL redirection vulnerability has been identified in Archer AX20 V2 due to improper validation of user-supplied URL input within the web interface. An unauthenticated attacker can craft URLs containing URL-encoded path traversal sequences. When processed by the embedded web...

5.9CVSS5.8AI score0.00372EPSS
SaveExploits0References3
Positive Technologies
Positive Technologies
added 2026/06/30 12:00 a.m.33 views

PT-2026-54014

Name of the Vulnerable Software and Affected Versions SolarWinds Database Performance Analyzer affected versions not specified Description A stored cross-site scripting issue exists that allows for the execution of unintended scripts. Recommendations At the moment, there is no information about a...

5.6CVSS5.9AI score0.00222EPSS
SaveExploits0References5
Positive Technologies
Positive Technologies
added 2026/06/30 12:00 a.m.33 views

PT-2026-54415

Name of the Vulnerable Software and Affected Versions Google Chrome on Android versions prior to 150.0.7871.47 Description Insufficient validation of untrusted input in the Input component allows a remote attacker to perform UI spoofing, which is the act of mimicking a legitimate user interface t...

9.8CVSS6AI score0.0051EPSS
SaveExploits0References449
Positive Technologies
Positive Technologies
added 2026/06/30 12:00 a.m.33 views

PT-2026-54059

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 150.0.7871.47 Description A use after free issue exists in the Browser component. This occurs when a program continues to use a pointer after it has been freed, which can lead to memory corruption. A remote...

10CVSS6.4AI score0.0051EPSS
SaveExploits0References451
Positive Technologies
Positive Technologies
added 2026/06/29 12:00 a.m.33 views

PT-2026-53659

Name of the Vulnerable Software and Affected Versions Gorse versions prior to 0.5.10 Description An authentication bypass exists in the HTTP API when the admin api key is left empty, which is the default configuration. This occurs because improper input validation treats an empty key as a disabli...

9.8CVSS5.8AI score0.03344EPSS
SaveExploits2References9
Positive Technologies
Positive Technologies
added 2026/06/29 12:00 a.m.33 views

PT-2026-53704

Name of the Vulnerable Software and Affected Versions Safari versions prior to 26.5.2 iOS versions prior to 26.5.2 iPadOS versions prior to 26.5.2 macOS Tahoe versions prior to 26.5.2 Description A use-after-free issue, which occurs when a program continues to use a pointer after it has been free...

5.3CVSS5.8AI score0.00382EPSS
SaveExploits0References7
Positive Technologies
Positive Technologies
added 2026/06/29 12:00 a.m.33 views

PT-2026-53582

Impact A maliciously crafted QPY file can potentially execute arbitrary-code embedded in the payload without privilege escalation when deserializing QPY formats 13. A python process calling Qiskit's qiskit.qpy.load function could potentially execute any arbitrary Python code embedded in the corre...

9.8CVSS6AI score0.0079EPSS
SaveExploits0References7
Positive Technologies
Positive Technologies
added 2026/06/29 12:00 a.m.33 views

PT-2026-54621

CVE ID :CVE-2026-12672 Published : June 29, 2026, 4:47 p.m. | 28 minutes ago Description :None Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...

5.8AI score
SaveExploits0References1
Positive Technologies
Positive Technologies
added 2026/06/29 12:00 a.m.33 views

PT-2026-53520

OpenViking prior to commit c7bb167 contains an authentication bypass vulnerability in the VikingBot OpenAPI HTTP route surface where the authentication check fails open when the api key configuration value is unset or empty. Remote attackers with network access to the exposed service can invoke...

9.1CVSS5.8AI score0.00571EPSS
SaveExploits1References9
Positive Technologies
Positive Technologies
added 2026/06/29 12:00 a.m.33 views

PT-2026-53695

Name of the Vulnerable Software and Affected Versions Alexantr filemanager version 1.0 Description A remote attacker can execute arbitrary code through the filemanager.php component. Recommendations At the moment, there is no information about a newer version that contains a fix for this...

9.1CVSS6.3AI score0.00471EPSS
SaveExploits1References4
Positive Technologies
Positive Technologies
added 2026/06/29 12:00 a.m.33 views

PT-2026-53720

Name of the Vulnerable Software and Affected Versions Safari versions prior to 26.5.2 iOS versions prior to 26.5.2 iPadOS versions prior to 26.5.2 macOS Tahoe versions prior to 26.5.2 Description Improved input validation was implemented to address a flaw where a malicious website could process...

8.8CVSS6.1AI score0.00891EPSS
SaveExploits0References100
Positive Technologies
Positive Technologies
added 2026/06/29 12:00 a.m.33 views

PT-2026-53421

Summary Django-Unicorn is vulnerable to python class pollution vulnerability, a new type of vulnerability categorized under CWE-915. The vulnerability arises from the core functionality set property value, which can be remotely triggered by users by crafting appropriate component requests and...

9.3CVSS6.7AI score0.00478EPSS
SaveExploits0References8
Positive Technologies
Positive Technologies
added 2026/06/28 12:00 a.m.33 views

PT-2026-53091

Name of the Vulnerable Software and Affected Versions Zephyr versions prior to 4.3.0 Zephyr version 4.3.0 Zephyr version 4.4.0 Description The Bluetooth LE Audio Basic Audio Profile BAP unicast client mishandles state notifications supplied by a peer. In the unicast client ep qos state function...

6.5CVSS6.1AI score0.00282EPSS
SaveExploits1References8
Positive Technologies
Positive Technologies
added 2026/06/26 12:00 a.m.33 views

PT-2026-52767

Unauthenticated Sensitive Data Exposure in Print Invoice & Delivery Notes for WooCommerce = 7.1.1 versions...

7.5CVSS5.8AI score0.00294EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
added 2026/06/26 12:00 a.m.33 views

PT-2026-52794

Zed Attack Proxy ZAP ViewState add-on before version 4 contains an insecure deserialization vulnerability that allows attackers who control a proxied web server to achieve arbitrary code execution by embedding a malicious serialized Java object in the javax.faces.ViewState HTTP response parameter...

8.8CVSS6.4AI score0.00463EPSS
SaveExploits0References6
Positive Technologies
Positive Technologies
added 2026/06/26 12:00 a.m.33 views

PT-2026-52678

An unauthenticated stack-based buffer overflow vulnerability exists in vlsvr in GeoVision GV-LPC2011 and GV-LPC2211 V1.12 and earlier. The vulnerability is caused by insufficient length validation when processing remote login data. A remote attacker may exploit this vulnerability by sending craft...

9.8CVSS6.2AI score0.00376EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
added 2026/06/26 12:00 a.m.33 views

PT-2026-52964

Name of the Vulnerable Software and Affected Versions RustFS versions 1.0.0-alpha.1 through 1.0.0-beta.8 Description An authorization bypass exists in the bucket replication admin API. The ListRemoteTargetHandler handler for listing remote replication targets verifies the existence of request...

8.2CVSS5.8AI score0.00181EPSS
SaveExploits0References4
Positive Technologies
Positive Technologies
added 2026/06/26 12:00 a.m.33 views

PT-2026-52674

An unauthenticated format string vulnerability exists in vlsvr in GeoVision GV-LPC2011 and GV-LPC2211 V1.12 and earlier. The vulnerability is caused by improper handling of externally controlled input during log message formatting in the login processing path. A remote attacker may exploit this...

8.6CVSS5.8AI score0.00281EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
added 2026/06/26 12:00 a.m.33 views

PT-2026-52744

Name of the Vulnerable Software and Affected Versions Easy Elements for Elementor – Addons & Website Templates versions prior to 1.5.0 Description An unauthenticated privilege escalation issue exists, allowing an attacker to gain higher-level permissions without providing valid credentials...

9.8CVSS5.8AI score0.0036EPSS
SaveExploits1References3
Positive Technologies
Positive Technologies
added 2026/06/26 12:00 a.m.33 views

PT-2026-52713

Name of the Vulnerable Software and Affected Versions Auros Core versions prior to 5.3.2 Description An unauthenticated content injection flaw allows an attacker to inject arbitrary content into the system without requiring valid credentials. Recommendations Update Auros Core to version 5.3.2 or...

5.3CVSS5.9AI score0.00233EPSS
SaveExploits0References5
Positive Technologies
Positive Technologies
added 2026/06/26 12:00 a.m.33 views

PT-2026-52649

Bypass to the fix for CVE-2026-34916. Variants of such vectors have been also reported by phucrio and offsetmd. The fix can be bypassed either by sending a disallowed but otherwise valid plugin identifier as type, or using the ox.setChannelTargeting XML-RPC API method...

8.8CVSS7.2AI score0.04456EPSS
SaveExploits1References9
Positive Technologies
Positive Technologies
added 2026/06/26 12:00 a.m.33 views

PT-2026-52832

Name of the Vulnerable Software and Affected Versions Contest Gallery versions prior to 30.0.1 Description A SQL Injection issue exists that allows attackers with contributor-level permissions to execute unauthorized database queries remotely. Recommendations Update to a version newer than 30.0.0...

8.5CVSS5.9AI score0.00205EPSS
SaveExploits0References3
Positive Technologies
Positive Technologies
added 2026/06/26 12:00 a.m.33 views

PT-2026-52853

Name of the Vulnerable Software and Affected Versions Dokku versions prior to 0.38.2 Description An issue exists where the app name validation regex permits shell metacharacters. An authenticated user can exploit this by pushing to a git remote using a crafted app name. This name is embedded...

9CVSS6.2AI score0.00234EPSS
SaveExploits0References5
Positive Technologies
Positive Technologies
added 2026/06/25 12:00 a.m.33 views

PT-2026-52555

Name of the Vulnerable Software and Affected Versions OMGF Pro versions prior to 5.2.7 Description An unrestricted file upload flaw allows unauthenticated users to upload malicious files of dangerous types. This issue can lead to remote code execution RCE, which is the ability of an attacker to...

10CVSS6.6AI score0.00362EPSS
SaveExploits0References7
Positive Technologies
Positive Technologies
added 2026/06/25 12:00 a.m.33 views

PT-2026-52222

CVE-2026-56091: Apache Shiro: Authentication bypass in Guice-Web integration https://t.co/tNgFNw4p66 CVE-2026-56130: Apache Shiro: Remember-me cookie isn't checked for expiry on the server https://t.co/wMSxMMxBZs...

8.2CVSS5.8AI score0.00423EPSS
SaveExploits1References1
Positive Technologies
Positive Technologies
added 2026/06/25 12:00 a.m.33 views

PT-2026-52517

Name of the Vulnerable Software and Affected Versions pnpm versions prior to 10.34.0 pnpm versions prior to 11.4.0 Description The tarball extraction worker in the pnpm package manager fails to perform integrity verification when the integrity field is missing from the lockfile resolution. This...

6.8CVSS5.8AI score0.00174EPSS
SaveExploits1References6
Positive Technologies
Positive Technologies
added 2026/06/25 12:00 a.m.33 views

PT-2026-52618

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 149.0.7827.201 Description An integer overflow exists in Mojo, a Chromium IPC Inter-Process Communication framework. This issue allows a remote attacker who has already compromised the renderer process to...

8.3CVSS5.9AI score0.00177EPSS
SaveExploits0References12
Total number of security vulnerabilities5000