Lucene search
+L
PtsecurityMost viewed

200552 matches found

Positive Technologies
Positive Technologies
added 2026/06/28 12:00 a.m.33 views

PT-2026-53091

Name of the Vulnerable Software and Affected Versions Zephyr versions prior to 4.3.0 Zephyr version 4.3.0 Zephyr version 4.4.0 Description The Bluetooth LE Audio Basic Audio Profile BAP unicast client mishandles state notifications supplied by a peer. In the unicast client ep qos state function...

6.5CVSS6.1AI score0.00282EPSS
SaveExploits1References8
Positive Technologies
Positive Technologies
added 2026/06/26 12:00 a.m.33 views

PT-2026-52767

Unauthenticated Sensitive Data Exposure in Print Invoice & Delivery Notes for WooCommerce = 7.1.1 versions...

7.5CVSS5.8AI score0.00294EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
added 2026/06/26 12:00 a.m.33 views

PT-2026-52794

Zed Attack Proxy ZAP ViewState add-on before version 4 contains an insecure deserialization vulnerability that allows attackers who control a proxied web server to achieve arbitrary code execution by embedding a malicious serialized Java object in the javax.faces.ViewState HTTP response parameter...

8.8CVSS6.4AI score0.00463EPSS
SaveExploits0References6
Positive Technologies
Positive Technologies
added 2026/06/26 12:00 a.m.33 views

PT-2026-52678

An unauthenticated stack-based buffer overflow vulnerability exists in vlsvr in GeoVision GV-LPC2011 and GV-LPC2211 V1.12 and earlier. The vulnerability is caused by insufficient length validation when processing remote login data. A remote attacker may exploit this vulnerability by sending craft...

9.8CVSS6.2AI score0.00376EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
added 2026/06/26 12:00 a.m.33 views

PT-2026-52964

Name of the Vulnerable Software and Affected Versions RustFS versions 1.0.0-alpha.1 through 1.0.0-beta.8 Description An authorization bypass exists in the bucket replication admin API. The ListRemoteTargetHandler handler for listing remote replication targets verifies the existence of request...

8.2CVSS5.8AI score0.00181EPSS
SaveExploits0References4
Positive Technologies
Positive Technologies
added 2026/06/26 12:00 a.m.33 views

PT-2026-52674

An unauthenticated format string vulnerability exists in vlsvr in GeoVision GV-LPC2011 and GV-LPC2211 V1.12 and earlier. The vulnerability is caused by improper handling of externally controlled input during log message formatting in the login processing path. A remote attacker may exploit this...

8.6CVSS5.8AI score0.00281EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
added 2026/06/26 12:00 a.m.33 views

PT-2026-52744

Name of the Vulnerable Software and Affected Versions Easy Elements for Elementor – Addons & Website Templates versions prior to 1.5.0 Description An unauthenticated privilege escalation issue exists, allowing an attacker to gain higher-level permissions without providing valid credentials...

9.8CVSS5.8AI score0.0036EPSS
SaveExploits1References3
Positive Technologies
Positive Technologies
added 2026/06/26 12:00 a.m.33 views

PT-2026-52713

Name of the Vulnerable Software and Affected Versions Auros Core versions prior to 5.3.2 Description An unauthenticated content injection flaw allows an attacker to inject arbitrary content into the system without requiring valid credentials. Recommendations Update Auros Core to version 5.3.2 or...

5.3CVSS5.9AI score0.00233EPSS
SaveExploits0References5
Positive Technologies
Positive Technologies
added 2026/06/26 12:00 a.m.33 views

PT-2026-52649

Bypass to the fix for CVE-2026-34916. Variants of such vectors have been also reported by phucrio and offsetmd. The fix can be bypassed either by sending a disallowed but otherwise valid plugin identifier as type, or using the ox.setChannelTargeting XML-RPC API method...

8.8CVSS7.2AI score0.04456EPSS
SaveExploits1References9
Positive Technologies
Positive Technologies
added 2026/06/26 12:00 a.m.33 views

PT-2026-52832

Name of the Vulnerable Software and Affected Versions Contest Gallery versions prior to 30.0.1 Description A SQL Injection issue exists that allows attackers with contributor-level permissions to execute unauthorized database queries remotely. Recommendations Update to a version newer than 30.0.0...

8.5CVSS5.9AI score0.00205EPSS
SaveExploits0References3
Positive Technologies
Positive Technologies
added 2026/06/26 12:00 a.m.33 views

PT-2026-52853

Name of the Vulnerable Software and Affected Versions Dokku versions prior to 0.38.2 Description An issue exists where the app name validation regex permits shell metacharacters. An authenticated user can exploit this by pushing to a git remote using a crafted app name. This name is embedded...

9CVSS6.2AI score0.00234EPSS
SaveExploits0References5
Positive Technologies
Positive Technologies
added 2026/06/25 12:00 a.m.33 views

PT-2026-52555

Name of the Vulnerable Software and Affected Versions OMGF Pro versions prior to 5.2.7 Description An unrestricted file upload flaw allows unauthenticated users to upload malicious files of dangerous types. This issue can lead to remote code execution RCE, which is the ability of an attacker to...

10CVSS6.6AI score0.00362EPSS
SaveExploits0References7
Positive Technologies
Positive Technologies
added 2026/06/25 12:00 a.m.33 views

PT-2026-52222

CVE-2026-56091: Apache Shiro: Authentication bypass in Guice-Web integration https://t.co/tNgFNw4p66 CVE-2026-56130: Apache Shiro: Remember-me cookie isn't checked for expiry on the server https://t.co/wMSxMMxBZs...

8.2CVSS5.8AI score0.00423EPSS
SaveExploits1References1
Positive Technologies
Positive Technologies
added 2026/06/25 12:00 a.m.33 views

PT-2026-52517

Name of the Vulnerable Software and Affected Versions pnpm versions prior to 10.34.0 pnpm versions prior to 11.4.0 Description The tarball extraction worker in the pnpm package manager fails to perform integrity verification when the integrity field is missing from the lockfile resolution. This...

6.8CVSS5.8AI score0.00174EPSS
SaveExploits1References6
Positive Technologies
Positive Technologies
added 2026/06/25 12:00 a.m.33 views

PT-2026-52618

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 149.0.7827.201 Description An integer overflow exists in Mojo, a Chromium IPC Inter-Process Communication framework. This issue allows a remote attacker who has already compromised the renderer process to...

8.3CVSS5.9AI score0.00177EPSS
SaveExploits0References12
Positive Technologies
Positive Technologies
added 2026/06/24 12:00 a.m.33 views

PT-2026-51838

Name of the Vulnerable Software and Affected Versions MailerUp versions prior to 1.0.1 Description Missing authentication for a critical function in the RegisterView apps/accounts/views.py allows a remote, unauthenticated attacker to self-register an account on instances where registration should...

8.8CVSS5.8AI score0.00406EPSS
SaveExploits0References5
Positive Technologies
Positive Technologies
added 2026/06/24 12:00 a.m.33 views

PT-2026-52038

Name of the Vulnerable Software and Affected Versions Tapo C200 v3 Description A denial-of-service DoS issue exists in the network packet handling logic due to improper processing of IPv4 fragmented packets. An unauthenticated adjacent attacker can send crafted packets to cause excessive resource...

7.1CVSS5.8AI score0.00222EPSS
SaveExploits0References7
Positive Technologies
Positive Technologies
added 2026/06/24 12:00 a.m.33 views

PT-2026-51663

Name of the Vulnerable Software and Affected Versions libslirp versions prior to v4.9.2 Description An integer underflow and out-of-bounds heap read exist in the TCP urgent data handling sosendoob within hypervisor host environments, such as QEMU. A privileged guest VM attacker with root or CAP N...

6.5CVSS5.8AI score0.00106EPSS
SaveExploits0References31
Positive Technologies
Positive Technologies
added 2026/06/24 12:00 a.m.33 views

PT-2026-51795

Name of the Vulnerable Software and Affected Versions Jenkins GitHub Branch Source Plugin versions prior to 1967.1969.v205fd594c821 Description A missing permission check allows attackers with Overall/Read permission to obtain the URLs of GitHub Enterprise servers configured in the global plugin...

4.3CVSS5.8AI score0.00216EPSS
SaveExploits0References4
Positive Technologies
Positive Technologies
added 2026/06/24 12:00 a.m.33 views

PT-2026-51970

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An out-of-bounds read occurs during the copying of elements from a BPF MAP TYPE CGROUP STORAGE map to a per-CPU pcpu map when the value size is not aligned to 8 bytes. The pcpu init valu...

7.1CVSS5.7AI score0.00117EPSS
SaveExploits0
Positive Technologies
Positive Technologies
added 2026/06/24 12:00 a.m.33 views

PT-2026-51938

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the soc/tegra: cbb component where the incorrect use of ARRAY SIZE in fabric lookup tables can lead to out-of-bounds access during target timeout lookup. Out-of-bounds...

7.1CVSS5.8AI score0.00124EPSS
SaveExploits0
Positive Technologies
Positive Technologies
added 2026/06/23 12:00 a.m.33 views

PT-2026-51594

Name of the Vulnerable Software and Affected Versions jackson-databind versions 2.13.0 through 2.13.x Description A potential Denial-of-Service exists when a service reads deeply nested JSON thousands of levels as a JsonNode using the readTree function of ObjectMapper and subsequently writes that...

7.5CVSS5.9AI score0.00459EPSS
SaveExploits1References12
Positive Technologies
Positive Technologies
added 2026/06/23 12:00 a.m.33 views

PT-2026-51595

Name of the Vulnerable Software and Affected Versions jackson-databind versions 2.10.0 through 2.18.7 jackson-databind versions 2.21.0 through 2.21.3 jackson-databind versions 3.1.0 through 3.1.3 Description An issue exists in the PolymorphicTypeValidator PTV, the primary safety mechanism for...

8.1CVSS6.5AI score0.00779EPSS
SaveExploits1References44
Positive Technologies
Positive Technologies
added 2026/06/23 12:00 a.m.33 views

PT-2026-51503

Capgo before 12.128.2 contains a security control bypass vulnerability where the PostgREST/RLS plane accepts plaintext API keys through the capgkey header despite enforce hashed api keys being enabled. Attackers can bypass org-level hashed-key enforcement by sending plaintext API keys directly to...

8.6CVSS5.9AI score0.00273EPSS
SaveExploits0References3
Positive Technologies
Positive Technologies
added 2026/06/23 12:00 a.m.33 views

PT-2026-51576

Name of the Vulnerable Software and Affected Versions immich versions 4ffa26c9 through 4eb1003 Description A reflected cross-site scripting XSS issue exists on the '/auth/login' page. The continue query parameter is processed by SvelteKit's redirect function without proper scheme or origin...

9.6CVSS6AI score0.00235EPSS
SaveExploits0References6
Positive Technologies
Positive Technologies
added 2026/06/23 12:00 a.m.33 views

PT-2026-51474

Name of the Vulnerable Software and Affected Versions expr-eval affected versions not specified Description Code Execution is possible via the 'toJSFunction' API. An attacker can execute arbitrary JavaScript by supplying crafted expressions that are compiled into native code using new Function...

9.8CVSS6.2AI score0.00496EPSS
SaveExploits0References14
Positive Technologies
Positive Technologies
added 2026/06/22 12:00 a.m.33 views

PT-2026-51333

Name of the Vulnerable Software and Affected Versions qSnapper versions prior to 1.3.3 Description A path traversal issue exists when using the configName parameter. This allows a local attacker to utilize malicious configuration files for snapper, which can lead to a denial of service or potenti...

7.3CVSS5.8AI score0.00185EPSS
SaveExploits0References5
Positive Technologies
Positive Technologies
added 2026/06/22 12:00 a.m.33 views

PT-2026-51442

Name of the Vulnerable Software and Affected Versions Inspektor Gadget versions 0.28.0 and later Description A malicious container can crash or destabilize the privileged Inspektor Gadget process when a gadget using USDT User-level Statically Defined Tracing probes is deployed. The issue exists i...

6.3CVSS5.8AI score
SaveExploits0
Positive Technologies
Positive Technologies
added 2026/06/21 12:00 a.m.33 views

PT-2026-51222

Name of the Vulnerable Software and Affected Versions Capgo versions prior to 12.128.2 Description A broken row level security RLS policy in the org users table allows authenticated users to elevate their privileges from admin to super admin. This insufficient RLS enforcement enables attackers to...

7CVSS5.9AI score0.00443EPSS
SaveExploits0References7
Positive Technologies
Positive Technologies
added 2026/06/21 12:00 a.m.33 views

PT-2026-51232

Name of the Vulnerable Software and Affected Versions Craft CMS versions 4.0.0-RC1 through 4.17.7 Craft CMS versions 5.0.0-RC1 through 5.9.13 Description A missing authorization issue exists in the 'assets/preview-thumb' endpoint. A Control Panel user lacking permissions to view a specific privat...

5.3CVSS6AI score0.00331EPSS
SaveExploits0References11
Positive Technologies
Positive Technologies
added 2026/06/20 12:00 a.m.33 views

PT-2026-51173

AVideo through version 26.0 contains multiple unauthenticated list.json.php endpoints in payment plugins lacking authorization checks, exposing PayPal tokens, Authorize.Net webhooks, and Bitcoin transaction records. Unauthenticated attackers can retrieve all payment transaction data including...

8.7CVSS5.8AI score0.00459EPSS
SaveExploits0References3
Positive Technologies
Positive Technologies
added 2026/06/20 12:00 a.m.33 views

PT-2026-51045

Name of the Vulnerable Software and Affected Versions Capgo versions prior to 12.128.12 Description Authenticated users can modify the mutable public.users.email variable to arbitrary addresses. The SSO provisioning endpoint trusts this value as an account-merge key. This allows an attacker to...

8.7CVSS5.9AI score0.00388EPSS
SaveExploits0References8
Positive Technologies
Positive Technologies
added 2026/06/20 12:00 a.m.33 views

PT-2026-51139

Name of the Vulnerable Software and Affected Versions WordPress Ultimate Addons for Beaver Builder version 1.2.4.1 Description An authentication bypass exists in the social media login form functionality. Attackers can gain unauthorized access by submitting a POST request to the 'admin-ajax.php'...

9.8CVSS5.9AI score0.008EPSS
SaveExploits0References8
Positive Technologies
Positive Technologies
added 2026/06/19 12:00 a.m.33 views

PT-2026-50901

Name of the Vulnerable Software and Affected Versions NI grpc-device versions prior to 2.17.0 Description Insecure default credentials exist when TLS configuration is absent and the server is bound beyond the loopback interface. This allows an unauthenticated user on the local network to gain...

9.3CVSS6.8AI score0.00434EPSS
SaveExploits0References8
Positive Technologies
Positive Technologies
added 2026/06/19 12:00 a.m.33 views

PT-2026-50989

Name of the Vulnerable Software and Affected Versions Joomla! Component VMap version 1.9.6 Description An SQL injection allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code into the latlngbound parameter. This is achieved by sending GET requests to the...

8.8CVSS6.2AI score0.00453EPSS
SaveExploits1References8
Positive Technologies
Positive Technologies
added 2026/06/19 12:00 a.m.33 views

PT-2026-51162

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 3.27.1-1.1 Description A heap-buffer-overflow write occurs during the allocation of the AVC444 YUV buffer. A heap-buffer-overflow is a memory corruption issue where data is written beyond the boundaries of a buffer...

9.8CVSS7AI score0.03665EPSS
SaveExploits19References52
Positive Technologies
Positive Technologies
added 2026/06/19 12:00 a.m.33 views

PT-2026-51079

Name of the Vulnerable Software and Affected Versions CoreWCF versions prior to 1.8.1 CoreWCF versions prior to 1.9.1 Description SAML 1.1 and SAML 2.0 token validation fails to correctly resolve the issuer signing key or enforce signed tokens when IdentityConfiguration is used with federated...

10CVSS6AI score0.00246EPSS
SaveExploits0References16
Positive Technologies
Positive Technologies
added 2026/06/19 12:00 a.m.33 views

PT-2026-50864

The security fix for CVE-2025-0728 in eclipse-threadx NetX Duo refactors error handling in the HTTP server PUT process to use a shared cleanup label, but this unified cleanup path unconditionally calls fx file close even when the file was never successfully opened. Multiple error branches jump to...

7.5CVSS5.8AI score0.0046EPSS
SaveExploits0References7
Positive Technologies
Positive Technologies
added 2026/06/19 12:00 a.m.33 views

PT-2026-51004

Name of the Vulnerable Software and Affected Versions WP Go Maps versions prior to 10.1.02 Description An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. Unauthenticated attackers can create arbitrary records in plugin...

5.3CVSS6AI score0.00342EPSS
SaveExploits0References9
Positive Technologies
Positive Technologies
added 2026/06/19 12:00 a.m.33 views

PT-2026-50924

Name of the Vulnerable Software and Affected Versions compose-rich-editor version 1.0.0-rc14 Description The compose-rich-editor library, used in HCL Verse for Android for rich text email composition, fails to properly validate HTML input. This lack of validation allows malicious content to be...

6.3CVSS5.8AI score0.00157EPSS
SaveExploits0References4
Positive Technologies
Positive Technologies
added 2026/06/19 12:00 a.m.33 views

PT-2026-50878

Name of the Vulnerable Software and Affected Versions SIMA GmbH Bondix versions prior to 1.25.7.6 Description OS command injection exists in the environment and tunnel configuration functionality on Linux. An authenticated attacker with configuration write access can execute arbitrary...

8.6CVSS6.2AI score0.01316EPSS
SaveExploits0References6
Positive Technologies
Positive Technologies
added 2026/06/19 12:00 a.m.33 views

PT-2026-50889

Name of the Vulnerable Software and Affected Versions NI grpc-device versions prior to 2.17.0 Description An out-of-bounds read occurs in the NI grpc-device streaming API because of a missing bounds check. This issue can lead to a denial of service if an attacker provides a specially crafted writ...

8.7CVSS5.9AI score0.00488EPSS
SaveExploits0References6
Positive Technologies
Positive Technologies
added 2026/06/19 12:00 a.m.33 views

PT-2026-50934

Name of the Vulnerable Software and Affected Versions Quiz Deluxe version 3.7.4 Description An SQL injection allows unauthenticated attackers to execute arbitrary SQL commands through the 'ajaxaction.flag question' task. Attackers can inject malicious SQL code via the stu quiz id or flag quest...

8.8CVSS6.3AI score0.00492EPSS
SaveExploits1References7
Positive Technologies
Positive Technologies
added 2026/06/19 12:00 a.m.33 views

PT-2026-50997

Joomla! Component JoomCRM 1.1.1 contains an SQL injection vulnerability that allows authenticated attackers to execute arbitrary SQL queries by injecting malicious code through the deal id parameter. Attackers can send GET requests to index.php with option=com joomcrm&view=contacts and inject SQL...

7.1CVSS6.2AI score0.00367EPSS
SaveExploits0References5
Positive Technologies
Positive Technologies
added 2026/06/19 12:00 a.m.33 views

PT-2026-50951

Name of the Vulnerable Software and Affected Versions Joomla! Component Twitch Tv version 1.1 Description An SQL injection allows unauthenticated attackers to execute arbitrary SQL queries. This is achieved by injecting malicious code through the username and id parameters. Attackers can send GET...

8.8CVSS6.2AI score0.00449EPSS
SaveExploits0References7
Positive Technologies
Positive Technologies
added 2026/06/18 12:00 a.m.33 views

PT-2026-51526

Name of the Vulnerable Software and Affected Versions GPAC MP4Box version 2.4 Description A NULL pointer dereference exists in the gf isom add track kind function within the isomedia/isom write.c file. This issue allows a remote attacker to trigger a Denial of Service DoS by processing a speciall...

7.8CVSS5.8AI score0.00383EPSS
SaveExploits1References16
Positive Technologies
Positive Technologies
added 2026/06/18 12:00 a.m.33 views

PT-2026-50775

Name of the Vulnerable Software and Affected Versions bpm-release versions prior to v1.4.30 Description A container-to-host privilege escalation exists where the setupBpmLogs function follows symlinks for bpm.log during open and chown operations. A compromised process within a bpm container can...

6.9CVSS6.1AI score0.00167EPSS
SaveExploits0References5
Positive Technologies
Positive Technologies
added 2026/06/18 12:00 a.m.33 views

PT-2026-50657

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in OceanWP Ocean Product Sharing allows Stored XSS. This issue affects Ocean Product Sharing: from n/a through 2.2.2...

5.9CVSS5.2AI score0.00138EPSS
SaveExploits0References1
Positive Technologies
Positive Technologies
added 2026/06/18 12:00 a.m.33 views

PT-2026-50714

Name of the Vulnerable Software and Affected Versions WP EasyPay versions prior to 4.4.0 Description Cross-Site Request Forgery CSRF allows an attacker to induce a user to perform actions they did not intend to do by tricking their browser into sending a forged request to the application...

6.5CVSS5.9AI score0.00176EPSS
SaveExploits0References5
Positive Technologies
Positive Technologies
added 2026/06/18 12:00 a.m.33 views

PT-2026-50746

Name of the Vulnerable Software and Affected Versions Docker MCP Plugin affected versions not specified Description A flaw in the OCI image label parsing allows an attacker to inject arbitrary arguments into the docker run command line. This occurs because the io.docker.server.metadata label is...

8.7CVSS6.3AI score
SaveExploits0
Total number of security vulnerabilities5000