Lucene search
+L
PtsecurityMost viewed

200102 matches found

Positive Technologies
Positive Technologies
•added 2026/06/03 12:0 a.m.•31 views

PT-2026-46000

Mercusys AC12G EU V1 with firmware AC12GEU V1 200909 enables WPS 2.0 by default with a weak lockout policy 60-second lockout after 10 attempts...

5.8AI score0.00139EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
•added 2026/06/03 12:0 a.m.•31 views

PT-2026-46014

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the btrfs file system where the block group tree dirty list can become corrupted. When the EXTENT TREE V2 incompat flag is set, the block group tree is unconditionally...

8.4CVSS5.8AI score0.00132EPSS
SaveExploits0
Positive Technologies
Positive Technologies
•added 2026/06/03 12:0 a.m.•31 views

PT-2026-45956

GLPI is a free asset and IT management software package. Starting in version 0.78 and prior to versions 10.0.25 and 11.0.7, a technician can delete arbitrary files from the filesystem as long as the webserver has write rights on them. Upgrade to 10.0.25 or 11.0.7 to receive a patch...

7CVSS5.9AI score0.00346EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
•added 2026/06/03 12:0 a.m.•31 views

PT-2026-45985

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the drm/panthor component where the memory subsystem can become blocked, causing flush operations to never complete. This state can be triggered by buggy GPU jobs...

6.8CVSS5.4AI score0.00147EPSS
SaveExploits0
Positive Technologies
Positive Technologies
•added 2026/06/03 12:0 a.m.•31 views

PT-2026-46085

When using React Router v7 in Framework Mode, there exists a combination of steps that could potentially allow unauthorized RCE through external requests. This first requires the application code to have an existing prototype pollution vulnerability. This can be leveraged into a 2-step attack in...

8.1CVSS5.9AI score0.00416EPSS
SaveExploits0References4
Positive Technologies
Positive Technologies
•added 2026/06/02 12:0 a.m.•31 views

PT-2026-45867

Name of the Vulnerable Software and Affected Versions OpenCTI versions prior to 7.260227.0 Description An issue exists in the rendering of email-message observable body data where the content of the body field is not appropriately sanitized. This allows for Cross-Site Scripting XSS, a technique...

6.1CVSS5.8AI score0.00149EPSS
SaveExploits0References6
Positive Technologies
Positive Technologies
•added 2026/06/02 12:0 a.m.•31 views

PT-2026-45763

Name of the Vulnerable Software and Affected Versions Progress Sitefinity versions 8.0.5700 through 13.3.7652 Description Insufficiently protected credentials in web services allow a remote authenticated attacker to obtain plain-text credentials used to connect to the Sitefinity Insight service...

8.7CVSS5.8AI score0.00319EPSS
SaveExploits0References4
Positive Technologies
Positive Technologies
•added 2026/06/02 12:0 a.m.•31 views

PT-2026-45754

Deserialization of Untrusted Data vulnerability in Elated-Themes Askka allows Object Injection. This issue affects Askka: from n/a through 1.3.1...

8.1CVSS5.8AI score0.00255EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
•added 2026/06/02 12:0 a.m.•31 views

PT-2026-46492

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 149.0.7827.53 Description An integer overflow in V8 allows a remote attacker to execute arbitrary code within a sandbox by using a specially crafted HTML page. V8 is the open-source high-performance JavaScript a...

9.6CVSS6.4AI score0.00456EPSS
SaveExploits2References438
Positive Technologies
Positive Technologies
•added 2026/06/02 12:0 a.m.•31 views

PT-2026-45789

Improper access control in the PAM account discovery feature in Devolutions Server 2026.1.19 and earlier allows an authenticated user without administrative privileges to delete network discovery scan configurations...

5.8AI score0.00138EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
•added 2026/06/02 12:0 a.m.•31 views

PT-2026-45877

Name of the Vulnerable Software and Affected Versions openSeaChest version 25.05.3 Description An out-of-bounds write exists in the --showSupportedFormats command. This occurs when a maliciously crafted NVMe device provides a bogus value in the namespace FLBAS byte, allowing one extra byte to be...

1.8CVSS5.8AI score0.00102EPSS
SaveExploits0References4
Positive Technologies
Positive Technologies
•added 2026/06/02 12:0 a.m.•31 views

PT-2026-45683

A security flaw has been discovered in Open5GS up to 2.7.6. The impacted element is the function gmm state security mode of the file src/amf/gmm-sm.c of the component NGAP Handover. Performing a manipulation results in race condition. The attack can be initiated remotely. The complexity of an...

3.1CVSS5AI score0.00224EPSS
SaveExploits0References9
Positive Technologies
Positive Technologies
•added 2026/06/02 12:0 a.m.•31 views

PT-2026-45854

Name of the Vulnerable Software and Affected Versions authentik versions prior to 2026.2.3 Description The WS-Federation provider in this open-source identity provider validates the user-supplied wreply parameter using a raw string prefix check instead of proper URL parsing. An attacker can craft...

6.9CVSS5.8AI score0.0019EPSS
SaveExploits0References5
Positive Technologies
Positive Technologies
•added 2026/06/02 12:0 a.m.•31 views

PT-2026-46834

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 149.0.7827.53 Description A use after free issue in PDFium allows a remote attacker to execute arbitrary code within a sandbox by using a specially crafted PDF file. Use after free is a memory corruption flaw th...

9.6CVSS6.4AI score0.00985EPSS
SaveExploits2References441
Positive Technologies
Positive Technologies
•added 2026/06/02 12:0 a.m.•31 views

PT-2026-46665

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 149.0.7827.53 Description An uninitialized use in ANGLE Almost Native Graphics Layer Engine, a compatibility layer between OpenGL ES and native graphics APIs, allows a remote attacker to leak cross-origin data...

9.6CVSS5.8AI score0.00493EPSS
SaveExploits1References437
Positive Technologies
Positive Technologies
•added 2026/06/02 12:0 a.m.•31 views

PT-2026-46493

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 149.0.7827.53 Description An integer overflow in V8 allows a remote attacker to execute arbitrary code within a sandbox by using a specially crafted HTML page. V8 is the open-source high-performance JavaScript a...

9.6CVSS6.4AI score0.00456EPSS
SaveExploits2References438
Positive Technologies
Positive Technologies
•added 2026/06/02 12:0 a.m.•31 views

PT-2026-45710

Name of the Vulnerable Software and Affected Versions DeMomentSomTres Shortcodes versions prior to 1.1.2 Description The DeMomentSomTres Shortcodes plugin for WordPress contains a Stored Cross-Site Scripting issue. This occurs because the st callout function fails to properly sanitize input and...

6.4CVSS6AI score0.00181EPSS
SaveExploits0References8
Positive Technologies
Positive Technologies
•added 2026/06/02 12:0 a.m.•31 views

PT-2026-45684

Name of the Vulnerable Software and Affected Versions FoundationAgents MetaGPT versions prior to 0.8.3 Description A weakness exists in the Message.check instruct content function within the metagpt/schema.py file. Manipulation of the mapping argument can lead to deserialization, which is the...

5.3CVSS6.2AI score0.00122EPSS
SaveExploits0References14
Positive Technologies
Positive Technologies
•added 2026/06/02 12:0 a.m.•31 views

PT-2026-45857

Name of the Vulnerable Software and Affected Versions BrowserStack Runner versions prior to 0.9.6 Description An issue in the / log HTTP handler allows unauthenticated network-adjacent attackers to execute arbitrary code on the host system. The handler processes JSON request bodies by passing...

8.8CVSS6.8AI score0.00392EPSS
SaveExploits0References8
Positive Technologies
Positive Technologies
•added 2026/06/02 12:0 a.m.•31 views

PT-2026-45849

Improper input validation in NI-PAL may allow a local authenticated user to access arbitrary system memory, potentially leading to privilege escalation. This vulnerability affects NI-PAL 26.3.0 and prior versions on Windows and Linux...

8.4CVSS5.9AI score0.00107EPSS
SaveExploits0References4
Positive Technologies
Positive Technologies
•added 2026/06/01 12:0 a.m.•31 views

PT-2026-45558

Name of the Vulnerable Software and Affected Versions CodexBar versions prior to 0.32.0 Description Insecure temporary file handling in the release notarization workflow allows local attackers to access sensitive credentials or tamper with build artifacts. This is possible by exploiting predictab...

7.2CVSS5.9AI score0.00129EPSS
SaveExploits0References9
Positive Technologies
Positive Technologies
•added 2026/06/01 12:0 a.m.•31 views

PT-2026-45661

Name of the Vulnerable Software and Affected Versions whisper.cpp versions prior to 1.8.3 Description A security flaw exists in the whisper model load function within the ggml/src/ggml.c file. This issue allows for a null pointer dereference, which occurs when a program attempts to read or write ...

4.8CVSS5.8AI score0.00112EPSS
SaveExploits0References16
Positive Technologies
Positive Technologies
•added 2026/06/01 12:0 a.m.•31 views

PT-2026-45413

Name of the Vulnerable Software and Affected Versions Vertex versions prior to commit fbde301b97986d5913fc4bc95f5445750d282e11 Description Vertex, a management tool for Private Tracker users to manage streaming and watching videos, is subject to path traversal. Path traversal is a flaw that allow...

8.6CVSS5.6AI score0.00414EPSS
SaveExploits1References4
Positive Technologies
Positive Technologies
•added 2026/06/01 12:0 a.m.•31 views

PT-2026-45398

The PDBM application relies on a static, hard‑coded secret embedded in the PDBM.exe executable. This secret is used by the application’s encryption routines, including the function responsible for decrypting credentials stored in the product’s configuration file. Because the secret is constant...

6.4CVSS5.8AI score0.00065EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
•added 2026/06/01 12:0 a.m.•31 views

PT-2026-45280

Name of the Vulnerable Software and Affected Versions Apache Directory LDAP API version 2.1.7 Description The LDAP client implementation fails to verify if the server certificate matches the intended LDAP hostname. Although the certificate chain is validated against a trusted authority, the lack ...

8.8CVSS5.8AI score0.00182EPSS
SaveExploits0References4
Positive Technologies
Positive Technologies
•added 2026/06/01 12:0 a.m.•31 views

PT-2026-45240

A flaw has been found in code-projects Online Hospital Management System 1.php. This impacts the function login user of the file login 1.php. Executing a manipulation of the argument Username can lead to sql injection. The attack can be executed remotely. The exploit has been published and may be...

7.5CVSS6.9AI score0.00263EPSS
SaveExploits0References7
Positive Technologies
Positive Technologies
•added 2026/06/01 12:0 a.m.•32 views

PT-2026-45276

Name of the Vulnerable Software and Affected Versions Assimp versions prior to 6.0.5 Description A use after free issue exists in the ASE File Parser component within the aiNode::aiNode function of the scene.cpp file. This flaw allows a local attacker to execute a manipulation that leads to the u...

5.3CVSS5.9AI score0.00115EPSS
SaveExploits0References26
Positive Technologies
Positive Technologies
•added 2026/06/01 12:0 a.m.•31 views

PT-2026-45352

A security vulnerability has been detected in code-projects Smart Parking System 1.0. Affected is an unknown function of the component Admin Endpoint. Such manipulation leads to missing authentication. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may b...

7.5CVSS6.7AI score0.00629EPSS
SaveExploits0References7
Positive Technologies
Positive Technologies
•added 2026/06/01 12:0 a.m.•31 views

PT-2026-45375

Name of the Vulnerable Software and Affected Versions Apache Airflow versions prior to 3.2.2 Description The Log server authorizes JWT tokens against Dag IDs by applying the str.lstrip function to the requested path segment when verifying the sub claim. Because str.lstrip removes any character fr...

3.1CVSS5.8AI score0.00358EPSS
SaveExploits0References8
Positive Technologies
Positive Technologies
•added 2026/06/01 12:0 a.m.•31 views

PT-2026-45653

Name of the Vulnerable Software and Affected Versions Kiteworks versions prior to 9.3.0 Description An Insecure Direct Object Reference IDOR issue in Kiteworks Secure Data Forms allows an authenticated user to access metadata of resources belonging to other users. This occurs because of...

4.3CVSS5.8AI score0.00142EPSS
SaveExploits0References4
Positive Technologies
Positive Technologies
•added 2026/06/01 12:0 a.m.•31 views

PT-2026-45510

FlexRIC v2.0.0 uses a uint16 t counter for xapp id assignment but stores the value in uint32 t message fields. After 65,530+ E42 SETUP REQUESTs, the 16-bit counter wraps around and produces duplicate xapp ids. The iApp port 36422 crashes when attempting to register a duplicate ID in its internal...

5.8AI score0.00488EPSS
SaveExploits1References3
Positive Technologies
Positive Technologies
•added 2026/06/01 12:0 a.m.•31 views

PT-2026-45378

Name of the Vulnerable Software and Affected Versions Apache Airflow versions prior to 3.2.2 Description The Event Log detail endpoint "GET /api/v2/eventLogs/event log id" fetches audit-log rows directly by numeric ID after performing only a generic Audit Log permission check. This differs from t...

4.3CVSS5.4AI score0.00366EPSS
SaveExploits0References14
Positive Technologies
Positive Technologies
•added 2026/06/01 12:0 a.m.•31 views

PT-2026-45555

Name of the Vulnerable Software and Affected Versions Kiteworks versions prior to 9.3.0 Description A reflected Cross-Site Scripting XSS issue in Kiteworks Secure Data Forms allows an external attacker to trick a user into executing arbitrary JavaScript code. Cross-Site Scripting is a flaw where...

8.2CVSS5.6AI score0.00289EPSS
SaveExploits0References4
Positive Technologies
Positive Technologies
•added 2026/06/01 12:0 a.m.•31 views

PT-2026-45541

Name of the Vulnerable Software and Affected Versions IBM i Access Client Solutions ACS versions 1.1.5.0 through 1.1.9.12 Description Remote code execution is possible when the software is configured to listen for requests from IBM i Navigator. Recommendations Update IBM i Access Client Solutions...

8.8CVSS6.3AI score0.00439EPSS
SaveExploits0References3
Positive Technologies
Positive Technologies
•added 2026/06/01 12:0 a.m.•31 views

PT-2026-45542

Name of the Vulnerable Software and Affected Versions IBM WebSphere Application Server version 9.0 IBM WebSphere Application Server version 8.5 Description An issue exists that allows for identity spoofing, where an attacker can impersonate another user or system identity. Recommendations At the...

9.1CVSS5.8AI score0.0033EPSS
SaveExploits0References7
Positive Technologies
Positive Technologies
•added 2026/06/01 12:0 a.m.•31 views

PT-2026-45401

A security vulnerability has been detected in itsourcecode Online House Rental System 1.0. This affects an unknown function of the file /manage tenant.php. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed...

7.5CVSS5.7AI score0.00263EPSS
SaveExploits0References7
Positive Technologies
Positive Technologies
•added 2026/06/01 12:0 a.m.•31 views

PT-2026-45550

Name of the Vulnerable Software and Affected Versions DevaslanPHP project-management versions prior to 2.0.0-beta1 Description An improper authorization issue exists in the Ticket Handler component. A remote attacker can exploit this by manipulating the recordUpdated function within the...

5.5CVSS6.1AI score0.0023EPSS
SaveExploits0References10
Positive Technologies
Positive Technologies
•added 2026/06/01 12:0 a.m.•31 views

PT-2026-45580

Name of the Vulnerable Software and Affected Versions Android affected versions not specified Description An access control flaw exists within multiple functions of WindowState.java in the Framework component. This issue allows a tapjacking or overlay attack, where a user is tricked into acceptin...

7.2CVSS5.9AI score0.00073EPSS
SaveExploits0References6
Positive Technologies
Positive Technologies
•added 2026/06/01 12:0 a.m.•31 views

PT-2026-45372

Name of the Vulnerable Software and Affected Versions Apache Airflow versions prior to 3.2.2 Description A bug in the rendered-template field handling allows the bypass of nested sensitive-key masking. When a rendered field exceeds the core max templated field length limit, the software stringifi...

6.5CVSS5.5AI score0.00348EPSS
SaveExploits0References6
Positive Technologies
Positive Technologies
•added 2026/06/01 12:0 a.m.•31 views

PT-2026-45493

Name of the Vulnerable Software and Affected Versions Nezha Monitoring versions 0.20.0 through 2.0.11 Description Authenticated agents can forge service-monitor results for services belonging to other users. The system accepts TaskResult messages from an authenticated agent based solely on whethe...

7.1CVSS5.4AI score0.00266EPSS
SaveExploits0References11
Positive Technologies
Positive Technologies
•added 2026/05/31 12:0 a.m.•31 views

PT-2026-45215

Name of the Vulnerable Software and Affected Versions Assimp versions prior to 6.0.5 Description A null pointer dereference occurs in the glTFImporter component within the Assimp::glTFImporter::ImportMeshes function of the glTFImporter.cpp file. This issue allows for local execution attacks...

4.8CVSS5.9AI score0.00113EPSS
SaveExploits0References8
Positive Technologies
Positive Technologies
•added 2026/05/30 12:0 a.m.•31 views

PT-2026-45100

A flaw has been found in TRENDnet TEW-432BRP 3.10B20. The impacted element is the function formSetUrlFilter of the file /goform/formSetUrlFilter. This manipulation of the argument keyword list/keyword causes stack-based buffer overflow. The attack is possible to be carried out remotely. The explo...

9CVSS6.2AI score0.00447EPSS
SaveExploits0References5
Positive Technologies
Positive Technologies
•added 2026/05/30 12:0 a.m.•31 views

PT-2026-45077

Name of the Vulnerable Software and Affected Versions Traccar Client versions prior to 9.7.20 Description The application registers a custom org.traccar.client://config deep-link scheme that allows the silent modification of persistent configuration settings without user confirmation or...

9.3CVSS5.3AI score0.00323EPSS
SaveExploits0References6
Positive Technologies
Positive Technologies
•added 2026/05/30 12:0 a.m.•31 views

PT-2026-45078

Name of the Vulnerable Software and Affected Versions SocketCAN affected versions not specified Description The SocketCAN implementation contains an out-of-bounds read issue. The function zcan sendto ctx validates the length of a user-provided buffer containing a socketcan frame object using only...

7.8CVSS6AI score0.00167EPSS
SaveExploits1References10
Positive Technologies
Positive Technologies
•added 2026/05/29 12:0 a.m.•31 views

PT-2026-44953

Name of the Vulnerable Software and Affected Versions JetBrains TeamCity versions prior to 2026.1 Description Remote code execution is possible through the Perforce connection settings. Recommendations Update to version 2026.1...

8.8CVSS6.2AI score0.13026EPSS
SaveExploits0References6
Positive Technologies
Positive Technologies
•added 2026/05/29 12:0 a.m.•31 views

PT-2026-45041

Name of the Vulnerable Software and Affected Versions Admidio versions prior to 5.0.10 Description An issue exists in the modules/documents-files.php file where state-changing operations are gated by checking the hasUploadRight function on the folder uuid URL parameter. However, the move save...

8.1CVSS5.2AI score0.00212EPSS
SaveExploits0References4
Positive Technologies
Positive Technologies
•added 2026/05/29 12:0 a.m.•31 views

PT-2026-44948

Name of the Vulnerable Software and Affected Versions JetBrains YouTrack versions prior to 2026.1.13162 Description Stored Cross-Site Scripting XSS, a flaw where malicious scripts are permanently stored on the target server, is possible within project notification templates. Recommendations Updat...

8.7CVSS5.8AI score0.00206EPSS
SaveExploits0References5
Positive Technologies
Positive Technologies
•added 2026/05/29 12:0 a.m.•31 views

PT-2026-44963

Name of the Vulnerable Software and Affected Versions JetBrains IntelliJ IDEA versions prior to 2026.1 xXE Description An issue exists in the UI Designer form parser, which is the component responsible for processing the layout and design files of the user interface. Recommendations Update to...

3.3CVSS5.8AI score0.00109EPSS
SaveExploits0References7
Positive Technologies
Positive Technologies
•added 2026/05/29 12:0 a.m.•31 views

PT-2026-44967

Name of the Vulnerable Software and Affected Versions KMW CCTV Security Cameras affected versions not specified Description An issue exists that allows an unauthenticated attacker to remotely reset the administrator password to a known value. This action grants full access to the camera settings...

9.1CVSS5.8AI score0.00624EPSS
SaveExploits0References9
Positive Technologies
Positive Technologies
•added 2026/05/29 12:0 a.m.•31 views

PT-2026-44903

Name of the Vulnerable Software and Affected Versions Dokploy versions prior to 0.29.1 Description Dokploy is a self-hostable Platform as a Service PaaS. A command injection issue exists in the deleteRegistry function within the packages/server/src/services/registry.ts file. The application...

8.8CVSS6AI score0.00841EPSS
SaveExploits0References3
Total number of security vulnerabilities5000