Lucene search
+L
PtsecurityRecent

201714 matches found

Positive Technologies
Positive Technologies
added 2026/07/29 12:00 a.m.22 views

PT-2026-65761

The Apache Traffic Server header rewrite plugin can crash or corrupt memory during cookie operations and CIDR condition matching. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version...

8.3CVSS5.8AI score0.00349EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
added 2026/07/29 12:00 a.m.16 views

PT-2026-65920

https://www.sourcecodester.com Advocate office management system 1.0 is affected by: SQL Injection. The impact is: execute arbitrary code remote. The component is: control/activate case.php,?id=1. The attack vector is: A SQL Injection vulnerability exists in the activate case.php in parameter id...

6.3AI score0.00203EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
added 2026/07/29 12:00 a.m.20 views

PT-2026-65697

The miniOrange Social Login and Register Discord, Google, Twitter, LinkedIn WordPress plugin before 7.8.0 does not bind the one-time code used by its optional email-verification Profile Completion feature to the account it was issued for, allowing unauthenticated attackers to obtain a valid sessi...

5.9AI score0.00239EPSS
SaveExploits0References1
Positive Technologies
Positive Technologies
added 2026/07/29 12:00 a.m.10 views

PT-2026-65708

A TOTP two-factor authentication bypass vulnerability in Koollab LMS allowed an attacker to supply a client-controlled seed to generate a matching one-time password and bypass the second authentication factor, potentially enabling unauthorised access to administrator accounts...

4.8CVSS5.9AI score0.00117EPSS
SaveExploits0References1
Positive Technologies
Positive Technologies
added 2026/07/29 12:00 a.m.26 views

PT-2026-65796

TeamViewer Full Client and Host for macOS before version 15.80 contain a business logic error that can allow an authenticated attacker to bypass a configured 2FA for Connections approval flow via Unattended Access and establish a remote connection to an affected macOS host...

8CVSS5.9AI score0.00234EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
added 2026/07/29 12:00 a.m.23 views

PT-2026-65793

Joomla Extension - rolandd.com - XSS vectors in AJAX endpoint handlers RO CSVI 9.11.0...

6.1CVSS5.8AI score0.00149EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
added 2026/07/29 12:00 a.m.18 views

PT-2026-65919

Sourcecodester CASAP Automated Enrollment System 1.0 is vulnerable to SQL Injection in update password.php via the parameter new password...

6AI score0.00169EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
added 2026/07/29 12:00 a.m.25 views

PT-2026-65710

A hard-coded AWS IAM credentials vulnerability in Koollab LMS allowed an attacker to access shared multi-tenant S3 buckets and SQS queues, exposing sensitive data and enabling malicious content injection, job manipulation, or email interception...

5.4CVSS5.8AI score0.00122EPSS
SaveExploits0References1
Positive Technologies
Positive Technologies
added 2026/07/29 12:00 a.m.26 views

PT-2026-65944

Sony XAV-9500ES gpsd Buffer Overflow Arbitrary Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Sony XAV-9500ES devices. Authentication is not required to exploit this vulnerability. The specific flaw exist...

3.9CVSS5AI score0.00197EPSS
SaveExploits0References3
Positive Technologies
Positive Technologies
added 2026/07/29 12:00 a.m.19 views

PT-2026-65950

Aeon load human activity segmentation datasets Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of aeon. User interaction is required to exploit this vulnerability in that the target must visit a...

7.8CVSS7.9AI score0.00254EPSS
SaveExploits0References3
Positive Technologies
Positive Technologies
added 2026/07/29 12:00 a.m.20 views

PT-2026-65804

Joomla Extension - balbooa.com - Various CSRF vectors in the admin interface in Gridbox 2.20.2...

5.8AI score0.00126EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
added 2026/07/29 12:00 a.m.20 views

PT-2026-65830

Penelope Shell Handler is a post-exploitation shell handler for authorized security testing. Prior to 0.20.0, the Unix download implementation in penelope.py used tar.extractalllocal download folder on tar archives returned by remote sessions without validating member paths, allowing a malicious ...

5.9CVSS5.9AI score0.0025EPSS
SaveExploits0References4
Positive Technologies
Positive Technologies
added 2026/07/29 12:00 a.m.22 views

PT-2026-65726

The WP-Lister Lite for eBay plugin for WordPress is vulnerable to generic SQL Injection via the 'orderby' parameter in all versions up to, and including, 3.8.8 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it...

4.9CVSS6AI score0.00385EPSS
SaveExploits0References8
Positive Technologies
Positive Technologies
added 2026/07/29 12:00 a.m.22 views

PT-2026-65863

Care Everywhere Gateway 14.3.10 contains a hard-coded credentials vulnerability in the bundled WildFly 8.2.0.Final management interface that allows unauthenticated remote attackers to gain administrative access by using default credentials identical across all installations. Attackers can...

9.8CVSS6.6AI score0.00801EPSS
SaveExploits0References4
Positive Technologies
Positive Technologies
added 2026/07/29 12:00 a.m.15 views

PT-2026-65707

An improper access control vulnerability in Koollab LMS allowed an unauthenticated attacker to read another user's name, internal identifier, scores, lesson status, lesson position, and cached lesson state via the SCORM API endpoint...

3.7CVSS5.9AI score0.00166EPSS
SaveExploits0References1
Positive Technologies
Positive Technologies
added 2026/07/29 12:00 a.m.18 views

PT-2026-65824

veraPDF PDF parser is a PDF parser for veraPDF. Prior to 1.30.2 and 1.31.23, veraPDF-parser contains a denial-of-service vulnerability in veraPDF-parser/src/main/java/org/verapdf/pd/font/type1/Type1FontProgram.java and veraPDF-parser/src/main/java/org/verapdf/parser/postscript/PSOperator.java,...

6.9CVSS6AI score0.00302EPSS
SaveExploits0References5
Positive Technologies
Positive Technologies
added 2026/07/29 12:00 a.m.23 views

PT-2026-65910

Name of the Vulnerable Software and Affected Versions OliveTin versions 3000.2.0 through 3000.16.0 Description OS command injection is possible because the checkShellArgumentSafety function in service/internal/executor/arguments.go fails to treat regex: custom argument types as unsafe for Shell...

6.6CVSS5.8AI score0.00997EPSS
SaveExploits0References8
Positive Technologies
Positive Technologies
added 2026/07/29 12:00 a.m.24 views

PT-2026-65680

The WowStore – Store Builder & Product Blocks for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'filterMobileText' Block Attribute in all versions up to, and including, 4.4.24 due to insufficient input sanitization and output escaping. This makes it possible fo...

6.4CVSS6AI score0.00188EPSS
SaveExploits0References6
Positive Technologies
Positive Technologies
added 2026/07/29 12:00 a.m.19 views

PT-2026-65818

Name of the Vulnerable Software and Affected Versions Autodesk AutoCAD affected versions not specified Description A heap-based overflow occurs when Autodesk AutoCAD parses a maliciously crafted DXF file. This issue allows an attacker to cause a system crash, read sensitive information, or execut...

7.8CVSS5.8AI score0.00189EPSS
SaveExploits0References5
Positive Technologies
Positive Technologies
added 2026/07/29 12:00 a.m.19 views

PT-2026-65853

Logging operator automates the deployment and configuration of Kubernetes logging pipelines. Prior to 6.6.0, the Fluentd configuration renderer FluentRender in pkg/sdk/logging/model/render/fluent.go writes CRD strings such as Flow record transformer.records values directly into fluent.conf withou...

9.9CVSS6.1AI score0.00426EPSS
SaveExploits0References4
Positive Technologies
Positive Technologies
added 2026/07/29 12:00 a.m.16 views

PT-2026-65722

Improper Access Control vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 9.0.0 through 9.1.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.1.15 or 10.1.4, which fixes the issue...

9.3CVSS5.8AI score0.00309EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
added 2026/07/29 12:00 a.m.18 views

PT-2026-65693

The UsersWP WordPress plugin before 1.2.67 does not validate the selected authentication provider in its two-factor login handler, allowing an attacker who already knows a user's credentials to bypass the second authentication factor and log in as that user...

5.9AI score0.00254EPSS
SaveExploits0References1
Positive Technologies
Positive Technologies
added 2026/07/29 12:00 a.m.20 views

PT-2026-65836

Xlight FTP Server before 3.9.5 contains a pre-authentication heap buffer overflow vulnerability that allows remote unauthenticated attackers to write past the end of a heap buffer by sending a malformed SSH client identification string. A logic error in the recv loop's termination condition uses ...

9.8CVSS6.2AI score0.00617EPSS
SaveExploits0References3
Positive Technologies
Positive Technologies
added 2026/07/29 12:00 a.m.13 views

PT-2026-65694

The PayU CommercePro Plugin WordPress plugin through 3.8.9 does not verify the payment-gateway signature before applying order modifications, allowing unauthenticated attackers to tamper with the totals, shipping and metadata of arbitrary WooCommerce orders...

5.9AI score0.00182EPSS
SaveExploits0References1
Positive Technologies
Positive Technologies
added 2026/07/29 12:00 a.m.15 views

PT-2026-65900

Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. In versions 1.88.0 up to but not including 1.107.1 and 2.0.0b1 up to but not including 2.5.0, the UI adapters AG-UI via Agent.to ag ui/AGUIAdapter, and Vercel AI via VercelAIAdapter use sanitize...

6.5CVSS5.9AI score0.00197EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
added 2026/07/29 12:00 a.m.21 views

PT-2026-65786

Joomla Extension - balbooa.com - Authenticated arbitrary file upload in Gridbox 2.20.2 - File upload methods allows authenticated attackers to upload arbitrary files. Turns into an authenticated RCE if combined with CVE-2026-65884 as the required account can be created by the attacker...

9.4CVSS5.9AI score0.00292EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
added 2026/07/29 12:00 a.m.19 views

PT-2026-65906

kishan0725 Hospital Management System 4.0 is vulnerable to SQL Injection in /betweendates-detailsreports.php...

6AI score0.0026EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
added 2026/07/29 12:00 a.m.18 views

PT-2026-65706

An improper access control vulnerability in Koollab LMS allowed an unauthenticated attacker to forcibly terminate the session of any user given their email address via the login kickout endpoint, resulting in a denial of service...

3.7CVSS5.9AI score0.00196EPSS
SaveExploits0References1
Positive Technologies
Positive Technologies
added 2026/07/29 12:00 a.m.20 views

PT-2026-65897

Name of the Vulnerable Software and Affected Versions mcp versions prior to 0.23.0 Description The MCP::Server::Transports::StreamableHTTPTransport component in the mcp gem does not expire sessions by default. Consequently, repeated initialize requests lead to the retention of unbounded...

5.3CVSS5.8AI score0.00308EPSS
SaveExploits0References8
Positive Technologies
Positive Technologies
added 2026/07/29 12:00 a.m.19 views

PT-2026-65894

Name of the Vulnerable Software and Affected Versions Flyto2 Core versions prior to 2.26.6 Description The workflow engine variable resolver expands $env.VAR for any host environment variable without an allowlist or capability policy check. This allows a workflow parameter to bypass the default...

8.6CVSS5.9AI score0.00359EPSS
SaveExploits0References8
Positive Technologies
Positive Technologies
added 2026/07/29 12:00 a.m.17 views

PT-2026-65961

GIMP TIF File Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a...

7.8CVSS8AI score0.00359EPSS
SaveExploits0References3
Positive Technologies
Positive Technologies
added 2026/07/29 12:00 a.m.19 views

PT-2026-65953

GStreamer MRF File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. User interaction is required to exploit this vulnerability in that the target must visit a...

7.8CVSS7.9AI score0.00229EPSS
SaveExploits0References3
Positive Technologies
Positive Technologies
added 2026/07/29 12:00 a.m.26 views

PT-2026-65874

Name of the Vulnerable Software and Affected Versions openSUSE Tumbleweed python311-pip versions prior to 26.2-1.1 Description pip incorrectly handles doubly-encoded package URLs from indexes. This allows files to be installed to arbitrary locations on disk, even when installing wheels pre-compil...

5.6CVSS6AI score0.00292EPSS
SaveExploits0References22
Positive Technologies
Positive Technologies
added 2026/07/29 12:00 a.m.29 views

PT-2026-65828

VMware ESX contains an insufficient logging vulnerability. A malicious administrator could exploit this issue to perform certain operations without them being logged...

2.7CVSS6AI score0.00402EPSS
SaveExploits0References3
Positive Technologies
Positive Technologies
added 2026/07/29 12:00 a.m.20 views

PT-2026-65954

GStreamer OGG File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. User interaction is required to exploit this vulnerability in that the target must visit a...

7.8CVSS8AI score0.00238EPSS
SaveExploits0References3
Positive Technologies
Positive Technologies
added 2026/07/29 12:00 a.m.22 views

PT-2026-65718

Inconsistent Interpretation of HTTP Requests 'HTTP Request/Response Smuggling' vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 10.0.0 through 10.1.3, from 9.0.0 through 9.2.14. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fixes the iss...

7.2CVSS5.8AI score0.00326EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
added 2026/07/29 12:00 a.m.21 views

PT-2026-65820

A maliciously crafted DWG or DXF file, when parsed through Autodesk AutoCAD, can force an Out-of-Bounds Read vulnerability. A malicious actor can leverage this vulnerability to cause a crash or disclose sensitive information...

5.5CVSS5.8AI score0.00176EPSS
SaveExploits0References4
Positive Technologies
Positive Technologies
added 2026/07/28 12:00 a.m.17 views

PT-2026-65464

Name of the Vulnerable Software and Affected Versions Apache ActiveMQ Broker versions prior to 5.19.9 Apache ActiveMQ Broker versions 6.0.0 through 6.2.7 Apache ActiveMQ All versions prior to 5.19.9 Apache ActiveMQ All versions 6.0.0 through 6.2.7 Apache ActiveMQ versions prior to 5.19.9 Apache...

7.5CVSS5.1AI score0.00376EPSS
SaveExploits0References23
Positive Technologies
Positive Technologies
added 2026/07/28 12:00 a.m.13 views

PT-2026-65540

sqlite3 provides Ruby bindings for the SQLite3 embedded database. In version 2.9.4 and earlier, redefining a SQLite function with a different arity frees the previously registered function handler while SQLite may still reference it, resulting in a use-after-free. This issue is fixed in version...

2CVSS5.8AI score0.00107EPSS
SaveExploits0References5
Positive Technologies
Positive Technologies
added 2026/07/28 12:00 a.m.14 views

PT-2026-65424

Improper exposure of the MCP server in alibabacloud-rds-openapi-mcp-server allows remote attackers to invoke exposed MCP tools via network access to an MCP endpoint listening on all network interfaces by default...

5.8CVSS5.9AI score0.0024EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
added 2026/07/28 12:00 a.m.41 views

PT-2026-65645

Summary The Diameter AVP decoder in github.com/gopacket/gopacket computes dataLength := avp.Length - uint32headerSize without first ensuring avp.Length = headerSize. When the Vendor flag is set, headerSize is 12, but the only length guard upstream rejects avp.Length CWE-770 unbounded allocation...

6.9CVSS6.5AI score
SaveExploits0References5
Positive Technologies
Positive Technologies
added 2026/07/28 12:00 a.m.17 views

PT-2026-65488

Schreibfaul1 ESP32-audioI2S 3.4.5 has a buffer overflow vulnerability in the MP3Decoder::decode function of the MP3 decoder due to missing size validation on untrusted mainDataBegin and nSlots values...

6.2AI score0.00307EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
added 2026/07/28 12:00 a.m.24 views

PT-2026-65449

The WPBot – AI ChatBot for Live Support, Lead Generation, AI Services plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 8.5.9 via the wpbot send email transcript free. This makes it possible for unauthenticated attackers to exfiltrate full...

5.3CVSS5.8AI score0.00273EPSS
SaveExploits0References7
Positive Technologies
Positive Technologies
added 2026/07/28 12:00 a.m.18 views

PT-2026-65487

Missing authentication for critical function vulnerability in Universal Software Inc. UKBS allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects UKBS: through 28072026. NOTE: The vendor was contacted and it was learned that the product is not supported...

8.8CVSS5.8AI score0.00215EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
added 2026/07/28 12:00 a.m.18 views

PT-2026-65567

Name of the Vulnerable Software and Affected Versions IBM Sterling B2B Integrator versions 6.2.0.0 through 6.2.0.5 2 IBM Sterling B2B Integrator versions 6.2.1.0 through 6.2.1.1 2 IBM Sterling B2B Integrator versions 6.2.2.0 through 6.2.2.0 1 IBM Sterling File Gateway versions 6.2.0.0 through...

8.1CVSS5.7AI score0.00276EPSS
SaveExploits0References3
Positive Technologies
Positive Technologies
added 2026/07/28 12:00 a.m.13 views

PT-2026-65531

An Improper Input Validation in the BlackBerry UEM Management Console of BlackBerry UEM 12.23.0 QF8 and earlier allows Arbitrary File Download and Potential Denial of Service...

5.9CVSS5.9AI score0.00157EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
added 2026/07/28 12:00 a.m.22 views

PT-2026-65517

Name of the Vulnerable Software and Affected Versions Rouille versions 0.4.0 through 3.6.2 Description An HTTP response splitting issue exists where remote attackers can inject arbitrary response headers by embedding carriage return 0x0D or line feed 0x0A bytes into input they control. This can...

5.4CVSS5.5AI score0.00241EPSS
SaveExploits1References22
Positive Technologies
Positive Technologies
added 2026/07/28 12:00 a.m.24 views

PT-2026-65446

The Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 7.3.2 via the automator google contacts fetch labels, automator mautic segment fetch, automator mautic tags fetch, and...

7.5CVSS5.8AI score0.00499EPSS
SaveExploits0References15
Positive Technologies
Positive Technologies
added 2026/07/28 12:00 a.m.20 views

PT-2026-65441

Quick.CMS is vulnerable to Local File Inclusion LFI in the admin.php endpoint via the p parameter. An authenticated attacker with admin privileges can include arbitrary files located within the application's directory structure via a crafted HTTP request. Successful exploitation allows disclosure...

5.1CVSS5.9AI score0.00307EPSS
SaveExploits0References3
Positive Technologies
Positive Technologies
added 2026/07/28 12:00 a.m.13 views

PT-2026-65581

IBM Aspera Faspex 5 5.0.0 through 5.0.15.4 has addressed a vulnerability related to session management...

8.2CVSS5.8AI score0.00225EPSS
SaveExploits0References1
Total number of security vulnerabilities201714