Lucene search
+L
PtsecurityRecent

212496 matches found

Positive Technologies
Positive Technologies
•added 2026/09/15 12:00 a.m.•19 views

PT-2026-92109

Summary Server-Side Request Forgery SSRF vulnerability in Slab safeurl allows an attacker who controls a validated URL to reach internal network destinations the library is configured to block. Only IPv4 addresses are matched against the reserved ranges and the blocklist. Every other address is...

9CVSS5.7AI score0.0048EPSS
SaveExploits0References5
Positive Technologies
Positive Technologies
•added 2026/09/15 12:00 a.m.•35 views

PT-2026-92470

Bacularis 1.0.0 - 6.5.0 is vulnerable to Stored cross-site scripting XSS in the client address field...

5.5AI score0.00235EPSS
SaveExploits0References3
Positive Technologies
Positive Technologies
•added 2026/09/15 12:00 a.m.•34 views

PT-2026-92332

In get global config item addr of gc.c, there is a possible out-of-bounds read due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

6AI score0.00101EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
•added 2026/09/15 12:00 a.m.•33 views

PT-2026-92103

atomic-agents-stack before 1.1.0 contains a path traversal vulnerability in the dashboard HTTP server that allows remote attackers to read arbitrary files by supplying directory traversal sequences in request paths. Attackers can bypass path containment checks by including '../' segments in...

8.7CVSS6AI score0.01332EPSS
SaveExploits0References3
Positive Technologies
Positive Technologies
•added 2026/09/15 12:00 a.m.•32 views

PT-2026-92178

Dell Wyse Management Suite, versions prior to 2605.0.3.683, contain an Unrestricted Upload of File with Dangerous Type vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Remote execution...

8.6CVSS5.9AI score0.00403EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
•added 2026/09/15 12:00 a.m.•29 views

PT-2026-92594

Vulnerability in the PeopleSoft Enterprise PRTL Interaction Hub product of Oracle PeopleSoft component: Enterprise Portal. The supported version that is affected is 9.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterpris...

7.7CVSS5.7AI score0.0034EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
•added 2026/09/15 12:00 a.m.•30 views

PT-2026-93184

A vulnerability was identified in a2ui-project a2ui up to 0.10.6. Affected is an unknown function of the file renderers/web core/src/v0 9/basic catalog/functions/safe regex.ts of the component Basic Catalog. Such manipulation leads to inefficient regular expression complexity. The attack can be...

6.9CVSS5.4AI score0.00724EPSS
SaveExploits0References9
Positive Technologies
Positive Technologies
•added 2026/09/15 12:00 a.m.•14 views

PT-2026-92741

Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM component: Server Infrastructure. Supported versions that are affected are 17.0-26.7. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Deployment...

7.4CVSS5.6AI score0.00323EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
•added 2026/09/15 12:00 a.m.•34 views

PT-2026-93085

Vulnerability in the Oracle Purchasing product of Oracle E-Business Suite component: Other issue. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Purchasing. Successful attac...

8.1CVSS5.6AI score0.00362EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
•added 2026/09/15 12:00 a.m.•17 views

PT-2026-92168

In BharatMLStack up to and including v1.3.0, Trufflebox UI stores the JWT authentication token, full user object, and session ID in the browser's localStorage, which is fully accessible to any JavaScript running on the page...

5.6AI score0.00367EPSS
SaveExploits0References3
Positive Technologies
Positive Technologies
•added 2026/09/15 12:00 a.m.•14 views

PT-2026-92037

Tornado before 6.3.3 contains an HTTP request smuggling vulnerability due to improper parsing of Content-Length headers accepting non-standard characters. Attackers can send crafted HTTP requests with these characters to bypass proxy validation and smuggle requests when deployed behind certain...

9CVSS5.8AI score0.00367EPSS
SaveExploits0References3
Positive Technologies
Positive Technologies
•added 2026/09/15 12:00 a.m.•19 views

PT-2026-92066

FreeRDP server versions before 3.31.0 contain a use-after-free vulnerability in the DRDYNVC parser that dereferences a channel pointer after releasing the synchronization lock. Authenticated clients can race AUDIN channel closure messages against DRDYNVC data parsing to trigger heap-use-after-fre...

7.7CVSS6AI score0.00322EPSS
SaveExploits0References3
Positive Technologies
Positive Technologies
•added 2026/09/14 12:00 a.m.•12 views

PT-2026-91465

IBM Verify Identity Access could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malicious Web si...

5.6AI score0.00282EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
•added 2026/09/14 12:00 a.m.•15 views

PT-2026-91211

Froxlor before 2.3.7 fails to validate the mysql server parameter against a customer's allowed mysqlserver allowlist in the Mysqls.add API command. Attackers can supply a disallowed server index to create MySQL databases and users on forbidden servers, bypassing per-customer access controls...

5.3CVSS5.7AI score0.00295EPSS
SaveExploits0References3
Positive Technologies
Positive Technologies
•added 2026/09/14 12:00 a.m.•23 views

PT-2026-91189

Incorrect Authorization vulnerability in Apache Syncope. Delegated administration security checks are based on Realm hierarchy and enforced via prefix matches. Due to incorrect implementation, two sibling Realms whose names begin with the same string cannot be correctly distinguished, resulting i...

5.7AI score0.0036EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
•added 2026/09/14 12:00 a.m.•9 views

PT-2026-91632

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. Processing a maliciously crafted file may lead to unexpected app termination...

5.8AI score0.00171EPSS
SaveExploits0References8
Positive Technologies
Positive Technologies
•added 2026/09/14 12:00 a.m.•11 views

PT-2026-91587

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. An app may be able to cause unexpected system termination ...

5.8AI score0.00158EPSS
SaveExploits0References9
Positive Technologies
Positive Technologies
•added 2026/09/14 12:00 a.m.•14 views

PT-2026-91575

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. Processing a maliciously crafted asset catalog may lead to unexpected process...

5.8AI score0.00166EPSS
SaveExploits0References8
Positive Technologies
Positive Technologies
•added 2026/09/14 12:00 a.m.•13 views

PT-2026-91564

Concrete CMS 9 through 9.5.2 did not validate a CSRF token in the orphaned block removal panel action removeOrphanedBlocks. A remote attacker could craft a request that, when loaded by an authenticated user holding edit permission on the target page, deleted every block on that page's current...

7.1CVSS5.9AI score0.0024EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
•added 2026/09/14 12:00 a.m.•13 views

PT-2026-91636

The issue was addressed with improved checks. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to break out of its sandbox...

5.7AI score0.00151EPSS
SaveExploits0References4
Positive Technologies
Positive Technologies
•added 2026/09/14 12:00 a.m.•12 views

PT-2026-91688

A privacy issue was addressed by removing sensitive data. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, visionOS 27. An app may be able to bypass certain Privacy preferences...

5.7AI score0.00156EPSS
SaveExploits0References4
Positive Technologies
Positive Technologies
•added 2026/09/14 12:00 a.m.•14 views

PT-2026-91664

CVE-2026-84621: An app may be able to access sensitive user data. searchtoold is a highly privileged system daemon with TCC access to almost every single data category, yet it accepted any XPC connection with zero validation. Discovered in macOS 27.0 b1, fixed in macOS 27.0 b2...

5.7AI score0.00146EPSS
SaveExploits0References8
Positive Technologies
Positive Technologies
•added 2026/09/14 12:00 a.m.•15 views

PT-2026-91425

IBM DataStage on Cloud Pak for Data 5.4.0.0 IBM DataStage PxXMLInput operator could allow a remote authenticated attacker to obtain sensitive information due to an XML external entity XXE injection...

7.7CVSS5.8AI score0.00343EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
•added 2026/09/14 12:00 a.m.•14 views

PT-2026-91401

MikroTik RouterOS before 7.24.2 contains a path traversal vulnerability in the container package OCI/tar image extraction that allows attackers to write files outside the container root by supplying a crafted container image with symlinks pointing to arbitrary paths. Attackers can exploit...

6.9CVSS5.9AI score0.00381EPSS
SaveExploits0References3
Positive Technologies
Positive Technologies
•added 2026/09/14 12:00 a.m.•17 views

PT-2026-91509

This issue was addressed with improved checks. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to gain root privileges...

5.7AI score0.00154EPSS
SaveExploits0References4
Positive Technologies
Positive Technologies
•added 2026/09/14 12:00 a.m.•13 views

PT-2026-91400

MikroTik RouterOS before 7.23.4 long-term and 7.24.2 stable contains a stack-based buffer overflow vulnerability in the mtget binary's TFTP RRQ builder function that allows authenticated users to crash the mtget worker process by supplying a URL path of 507 bytes or more to the /tool fetch comman...

5.3CVSS6.1AI score0.00488EPSS
SaveExploits0References3
Positive Technologies
Positive Technologies
•added 2026/09/14 12:00 a.m.•14 views

PT-2026-91253

In Siglet current and past versions the refresh token handler do not enforce proof of possession of the issuer DID...

6.3CVSS5.7AI score0.00169EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
•added 2026/09/14 12:00 a.m.•14 views

PT-2026-91541

An issue existed in the handling of snapshots. The issue was resolved with improved permissions logic. This issue is fixed in macOS Golden Gate 27. An app may be able to access protected user data...

5.7AI score0.00174EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
•added 2026/09/14 12:00 a.m.•13 views

PT-2026-91705

A logic issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27. An app may be able to bypass Gatekeeper checks...

5.7AI score0.00152EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
•added 2026/09/14 12:00 a.m.•11 views

PT-2026-91701

A parsing issue in the handling of directory paths was addressed with improved path validation. This issue is fixed in macOS Golden Gate 27, macOS Sonoma 14.8.8. An app may be able to access sensitive user data...

5.7AI score0.00183EPSS
SaveExploits0References3
Positive Technologies
Positive Technologies
•added 2026/09/14 12:00 a.m.•14 views

PT-2026-91208

LaraDashboard versions 0.9.2 through 1.2.2 contain a path traversal vulnerability in the core-upgrade backup handling. CoreUpgradeController and BackupService e.g. BackupService::deleteBackup concatenate the user-supplied backup file/filename value directly onto the backup directory path without...

8.6CVSS6.2AI score0.0082EPSS
SaveExploits0References3
Positive Technologies
Positive Technologies
•added 2026/09/14 12:00 a.m.•22 views

PT-2026-91089

Stack-based buffer overflow vulnerability exists in Remote I/O Coupler Unit Server Type CPSN-MCB271-. Receiving a specially crafted request created and sent by a remote attacker may cause a denial-of-service DoS condition...

5.3CVSS6.1AI score0.00492EPSS
SaveExploits0References3
Positive Technologies
Positive Technologies
•added 2026/09/14 12:00 a.m.•13 views

PT-2026-91285

In Eclipse Ankaios versions 0.1.0 through 1.0.2, the agent creates workload files and Control Interface named pipes FIFOs under a predictable path derived from the agent name and a hash of the workload's runtime configuration. If a directory or FIFO already exists at that path when the agent...

8.4CVSS5.7AI score0.00112EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
•added 2026/09/14 12:00 a.m.•15 views

PT-2026-91478

An authentication issue was addressed with improved state management. This issue is fixed in iOS 27 and iPadOS 27. An attacker with physical access to an unlocked device may be able to view Wi-Fi passwords without authentication...

5.7AI score0.00225EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
•added 2026/09/14 12:00 a.m.•19 views

PT-2026-91079

An exposure of information through directory listing issue exists in CONPROSYS M2M Gateway Series and CONPROSYS M2M Controller Series. Accessing a specific URL on this product may allow a remote unauthenticated attacker to obtain the directory list without authentication...

5.3CVSS5.8AI score0.00445EPSS
SaveExploits0References3
Positive Technologies
Positive Technologies
•added 2026/09/14 12:00 a.m.•11 views

PT-2026-91681

A denial-of-service issue was addressed with improved input validation. This issue is fixed in iOS 27 and iPadOS 27. A remote attacker may be able to cause a denial-of-service...

5.8AI score0.00394EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
•added 2026/09/14 12:00 a.m.•13 views

PT-2026-91207

LaraDashboard versions 0.9.0 through 1.2.2 fail to sanitize SVG file content during media upload, allowing authenticated users with only the media.create permission to upload malicious SVG files containing script tags. When any user including administrators opens the stored SVG file served inline...

5.4CVSS5.6AI score0.00235EPSS
SaveExploits0References3
Positive Technologies
Positive Technologies
•added 2026/09/14 12:00 a.m.•12 views

PT-2026-91743

Activiti through 7.1.0.M6 fails to validate hash-brace deferred expressions in process variables, allowing attackers to bypass expression filtering. Attackers can inject expressions beginning with that are stored and later evaluated in the full Spring context when a mail task uses variable-backed...

7.1CVSS5.7AI score0.00422EPSS
SaveExploits0References6
Positive Technologies
Positive Technologies
•added 2026/09/14 12:00 a.m.•14 views

PT-2026-91251

A flaw has been found in GPAC up to f1219cde. This issue affects the function gf node list get child of the file scenegraph/base scenegraph.c of the component MP4Box. This manipulation of the argument Target causes null pointer dereference. The attack is possible to be carried out remotely. The...

5.3CVSS4.5AI score0.00688EPSS
SaveExploits0References10
Positive Technologies
Positive Technologies
•added 2026/09/14 12:00 a.m.•14 views

PT-2026-91158

A security flaw has been discovered in Open5GS up to 2.7.x. Affected is the function amf nnrf try old amf discovery fallback of the file src/amf/nnrf-handler.c of the component Old AMF Discovery Fallback. The manipulation of the argument discovery option results in use after free. The attack may ...

8.3CVSS7.1AI score0.00527EPSS
SaveExploits0References8
Positive Technologies
Positive Technologies
•added 2026/09/14 12:00 a.m.•12 views

PT-2026-91173

A vulnerability was identified in Gitlawb openclaude up to 0.30.0. Impacted is the function waitForCallback of the file src/services/api/xaiOAuthCallback.ts of the component xAI OAuth Callback Handler. The manipulation of the argument Error leads to denial of service. Remote exploitation of the...

5.3CVSS4.9AI score0.00562EPSS
SaveExploits0References7
Positive Technologies
Positive Technologies
•added 2026/09/14 12:00 a.m.•13 views

PT-2026-91406

A weakness has been identified in cosmicstack-labs mercury-agent up to 1.2.0. This affects the function PermissionManager.checkShellCommand of the file mercury-agent/src/capabilities/permissions.ts of the component Shell Permission Manifest. Executing a manipulation can lead to information...

4.8CVSS4.7AI score0.00149EPSS
SaveExploits0References7
Positive Technologies
Positive Technologies
•added 2026/09/14 12:00 a.m.•13 views

PT-2026-91502

An integer overflow was addressed with improved input validation. This issue is fixed in macOS Golden Gate 27. Processing a maliciously crafted file may lead to a denial-of-service or potentially disclose memory contents...

5.7AI score0.00148EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
•added 2026/09/14 12:00 a.m.•15 views

PT-2026-91214

LangBot's plugin runtime pip package langbot plugin through 0.4.17 starts a debug WebSocket server on 0.0.0.0:5401 /plugin/ws whose authentication is gated on plugin debug key, which defaults to an empty string and is never set by the upstream repository, Docker image, or docker-compose which...

8.8CVSS5.9AI score0.00572EPSS
SaveExploits0References3
Positive Technologies
Positive Technologies
•added 2026/09/14 12:00 a.m.•26 views

PT-2026-91090

Insufficiently protected credentials issue exists in Remote I/O Coupler Unit Server Type CPSN-MCB271-. If this vulnerability is exploited, sensitive information may be restored from a backup file...

8.2CVSS5.7AI score0.00303EPSS
SaveExploits0References3
Positive Technologies
Positive Technologies
•added 2026/09/14 12:00 a.m.•13 views

PT-2026-91689

A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. A local app may be able to read a persistent account identifier...

5.7AI score0.00141EPSS
SaveExploits0References7
Positive Technologies
Positive Technologies
•added 2026/09/14 12:00 a.m.•13 views

PT-2026-91512

An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in iOS 26.6.1 and iPadOS 26.6.1, macOS Sequoia 15.8, macOS Tahoe 26.6.2, tvOS 27, visionOS 27, watchOS 27. An app may be able to cause unexpected system termination or corrupt kernel memory...

5.8AI score0.00162EPSS
SaveExploits0References7
Positive Technologies
Positive Technologies
•added 2026/09/14 12:00 a.m.•10 views

PT-2026-91459

IBM Langflow OSS 1.0.0 through 1.11.2 is vulnerable to server-side request forgery SSRF. This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks...

5.4CVSS5.7AI score0.00181EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
•added 2026/09/14 12:00 a.m.•14 views

PT-2026-91455

Skipper is an HTTP router and reverse proxy for service composition. Prior to 0.27.35, the opaAuthorizeRequestWithBody filter in filters/openpolicyagent/openpolicyagent.go can allow an oversized declared Content-Length request to bypass a deny-on-presence Rego policy because...

8.2CVSS5.8AI score0.00464EPSS
SaveExploits0References4
Positive Technologies
Positive Technologies
•added 2026/09/14 12:00 a.m.•13 views

PT-2026-91615

A double free issue was addressed with improved memory management. This issue is fixed in macOS Golden Gate 27. An app may be able to cause unexpected system termination...

5.8AI score0.00153EPSS
SaveExploits0References2
Total number of security vulnerabilities212496