Lucene search
+L
PtsecurityRecent

212496 matches found

Positive Technologies
Positive Technologies
•added 2026/09/09 12:00 a.m.•14 views

PT-2026-88777

Tanium addressed an information disclosure vulnerability in Comply...

4.3CVSS5.7AI score0.00301EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
•added 2026/09/09 12:00 a.m.•15 views

PT-2026-89712

These are all security issues fixed in the perl-Authen-SASL-2.210.0-1.1 package on the GA media of openSUSE Tumbleweed...

9.8CVSS5.9AI score0.00468EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
•added 2026/09/09 12:00 a.m.•14 views

PT-2026-89154

SQL injection vulnerability in PbootCMS versions 3.2.0 through 3.2.5 allows an authenticated user to modify arbitrary user account fields including passwords and roles via crafted parameters to the User/mod interface, enabling account takeover...

5.8AI score0.00291EPSS
SaveExploits1References3
Positive Technologies
Positive Technologies
•added 2026/09/09 12:00 a.m.•34 views

PT-2026-88963

TL;DR. The FortiPAM Chrome extension 1M+ users, used for Privileged Access Management, allowed any site to set the browser's proxy for the session, alongside allowing any site to create a new tab and send screen recordings of it to an attacker's server. That makes for trivial phishing attacks whi...

5.6AI score0.00377EPSS
SaveExploits1References5
Positive Technologies
Positive Technologies
•added 2026/09/09 12:00 a.m.•13 views

PT-2026-88896

The YITH WooCommerce Waitlist Premium plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 3.35.0. This is due to the add user in waiting list function registered on the wp ajax yith wcwtl add user action being missing both a capability check and a nonce...

8.8CVSS5.7AI score0.00239EPSS
SaveExploits0References3
Positive Technologies
Positive Technologies
•added 2026/09/09 12:00 a.m.•15 views

PT-2026-88875

The WPLP Cookie Consent WordPress plugin before 4.4.2 does not perform nonce or capability checks on one of its cookie scanner AJAX actions, allowing any authenticated user, such as a subscriber, to read back the automated scan schedule the administrator configured...

5.7AI score0.0027EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
•added 2026/09/09 12:00 a.m.•18 views

PT-2026-88925

Potential problem for users of the org.apache.parquet.crypto.keytools package in Apache Parquet, versions 1.12 to 1.18. This package enables users to encrypt Parquet files via an envelope encryption mechanism that wraps encrypts data keys via a Key Management Service KMS. On the reader side, the...

5.7AI score0.00361EPSS
SaveExploits0References3
Positive Technologies
Positive Technologies
•added 2026/09/09 12:00 a.m.•17 views

PT-2026-88858

The Loops & Logic WordPress plugin before 4.3.0 does not restrict its public template-data action to the data a visitor is permitted to see, allowing unauthenticated users to read arbitrary user records including email addresses and roles and arbitrary site options...

5.7AI score0.00351EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
•added 2026/09/09 12:00 a.m.•15 views

PT-2026-88944

Parse Server versions = 9.0.0 9.10.1-alpha.7 contain an authentication bypass in the built-in LDAP authentication adapter. The adapter forwarded the client-supplied password to the directory without verifying that a password had been supplied, and treated any non-error response from the directory...

9.1CVSS5.7AI score0.00511EPSS
SaveExploits0References3
Positive Technologies
Positive Technologies
•added 2026/09/09 12:00 a.m.•17 views

PT-2026-88768

The FireBox – WooCommerce Popup Builder, Exit Intent Popup, Email Optin & Cart Abandonment plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 3.1.10 via the value function. This is due to a trivially bypassable regex blacklist in Executer::allowedToR...

8.8CVSS6.1AI score0.00939EPSS
SaveExploits0References7
Positive Technologies
Positive Technologies
•added 2026/09/09 12:00 a.m.•12 views

PT-2026-89048

Incorrect Permission Assignment for Critical Resource vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute Pardus LightDM Greeter allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Pardus LightDM Greeter: before 0.4.15...

7.1CVSS5.8AI score0.00143EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
•added 2026/09/09 12:00 a.m.•12 views

PT-2026-88946

SiYuan versions = 3.8.1 contain an incomplete fix for CVE-2026-32767 GHSA-j7wh-x834-p3r7. The prior fix commit d5e2d0bc added an administrator check for SQL mode method=2 in POST /api/search/fullTextSearchBlock, but the endpoint still does not enforce the application's read-only boundary: for...

8.7CVSS5.8AI score0.00444EPSS
SaveExploits0References4
Positive Technologies
Positive Technologies
•added 2026/09/09 12:00 a.m.•15 views

PT-2026-88791

The Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails plugin for WordPress is vulnerable to SQL Injection via the 'status' parameter in all versions up to, and including, 1.31.0 due to insufficient escaping on the user supplied parameter and lack of sufficient...

4.9CVSS5.7AI score0.00307EPSS
SaveExploits0References9
Positive Technologies
Positive Technologies
•added 2026/09/09 12:00 a.m.•18 views

PT-2026-88762

The Contact Form to DB by BestWebSoft – Messages Database Plugin For WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via cntctfrm contact dropdown Parameter in all versions up to, and including, 1.7.5 due to insufficient input sanitization and output escaping. This mak...

7.2CVSS5.9AI score0.00236EPSS
SaveExploits0References5
Positive Technologies
Positive Technologies
•added 2026/09/09 12:00 a.m.•18 views

PT-2026-89104

Dell PowerScale OneFS, versions 9.5.0.0 through 9.7.1.15, versions 9.8.0.0 through 9.13.1.0, and versions prior to 9.15.0.0, contain an Incorrect Authorization vulnerability. A low privileged adjacent network attacker could potentially exploit this vulnerability, leading to unauthorized...

3.5CVSS5.8AI score0.00185EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
•added 2026/09/09 12:00 a.m.•15 views

PT-2026-88856

The WP Travel WordPress plugin before 12.0.2 does not properly verify that the requester owns the booking targeted by its bank-deposit slip submission, allowing an unauthenticated attacker who knows the target customer's email address to change that customer's booking payment state and attach a...

5.7AI score0.00192EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
•added 2026/09/09 12:00 a.m.•19 views

PT-2026-88772

Tanium addressed an improper access controls vulnerability in Comply...

5.4CVSS5.7AI score0.00287EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
•added 2026/09/09 12:00 a.m.•11 views

PT-2026-89039

Snipe-IT before 8.7.0 fails to validate username case sensitivity during SAML authentication, allowing attackers to authenticate as different users by registering IdP accounts with accent or case variants of victim usernames. Attackers can exploit the default utf8mb4 unicode ci database collation...

8.6CVSS5.7AI score0.00571EPSS
SaveExploits1References3
Positive Technologies
Positive Technologies
•added 2026/09/09 12:00 a.m.•17 views

PT-2026-88910

Missing authentication for critical function vulnerability in Yordam Informatics Technology Consulting, Training, and Electronic Systems Industry and Trade Inc. Library Reservation System allows Input Data Manipulation. This issue affects Library Reservation System: before v22.2...

4.3CVSS5.7AI score0.00185EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
•added 2026/09/09 12:00 a.m.•17 views

PT-2026-88836

Use after free in DualDAR prior to SMR Sep-2026 Release 1 allows local privileged attackers to execute arbitrary code with root privilege...

9.3CVSS7AI score0.00118EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
•added 2026/09/09 12:00 a.m.•9 views

PT-2026-89029

Snipe-IT versions 8.2.0 through 8.6.x fixed in 8.7.0 contain an incorrect authorization flaw in app/Http/Controllers/Users/UsersController::update. The single-user edit route assigned the activated field from the request payload before evaluating the canEditAuthFields authorization gate, so an...

5.4CVSS5.7AI score0.00384EPSS
SaveExploits1References4
Positive Technologies
Positive Technologies
•added 2026/09/09 12:00 a.m.•19 views

PT-2026-88866

The Groundhogg — CRM, Newsletters, and Marketing Automation WordPress plugin before 4.7.2 does not restrict the redirect target of its email preference confirmation flow to the site's own host, allowing unauthenticated attackers to redirect visitors to an arbitrary external URL by way of a crafte...

5.9AI score0.0029EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
•added 2026/09/09 12:00 a.m.•23 views

PT-2026-88994

tirreno, a security framework, has a session fixation issue in versions prior to 0.10.0. During authentication, tirreno validates the user's credentials and establishes the authenticated session, but it does not call session regenerate id afterward. As a result, the session identifier is not...

5.3CVSS5.5AI score0.0047EPSS
SaveExploits0References3
Positive Technologies
Positive Technologies
•added 2026/09/09 12:00 a.m.•16 views

PT-2026-89240

This module enables you to add key-based authentication on a per-user basis. The module doesn't cache per user, potentially allowing an attacker to view another user's authentication keys, if the attacker has the same permissions. This vulnerability is mitigated by the fact that the site must hav...

5.5AI score
SaveExploits0References2
Positive Technologies
Positive Technologies
•added 2026/09/09 12:00 a.m.•29 views

PT-2026-89132

SQL injection in the RelatedProduct block in Mageplaza Blog for Magento 2 mageplaza/magento-2-blog-extension through 4.3.2 allows remote unauthenticated attackers to execute arbitrary SQL commands and read arbitrary database contents via the id parameter to /mpblog/post/view...

8.6CVSS6.4AI score0.00475EPSS
SaveExploits0References3
Positive Technologies
Positive Technologies
•added 2026/09/09 12:00 a.m.•10 views

PT-2026-89081

Dell PowerScale OneFS, Versions 9.5.0.0 through 9.7.1.0, Versions 9.8.0.0 through 9.10.1.0, and Versions 9.11.0.0 through 9.14.0.1, contain a command injection vulnerability. An admin privileged local attacker could potentially exploit this vulnerability, leading to elevation of privileges to roo...

6.7CVSS6AI score0.00535EPSS
SaveExploits0References1
Positive Technologies
Positive Technologies
•added 2026/09/09 12:00 a.m.•14 views

PT-2026-88885

The Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'wrapper' Shortcode Attribute in all versions up to, and including, 3.2.4 due to insufficient input sanitization and output...

6.4CVSS6AI score0.002EPSS
SaveExploits0References9
Positive Technologies
Positive Technologies
•added 2026/09/09 12:00 a.m.•10 views

PT-2026-89023

Snipe-IT before 8.7.0 fails to properly gate Laravel Passport's OAuth client management routes, allowing any authenticated user to register OAuth clients with attacker-controlled redirect URIs. Attackers can trick administrators into approving consent screens, then exchange authorization codes fo...

8.5CVSS5.6AI score0.00342EPSS
SaveExploits1References3
Positive Technologies
Positive Technologies
•added 2026/09/09 12:00 a.m.•16 views

PT-2026-89082

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability. A low privileged attacker with local access could potentially exploit...

5.5CVSS5.8AI score0.01803EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
•added 2026/09/09 12:00 a.m.•10 views

PT-2026-88940

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Restriction of Excessive Authentication Attempts vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading ...

7.5CVSS5.8AI score0.005EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
•added 2026/09/09 12:00 a.m.•8 views

PT-2026-89088

In the Linux kernel, the following vulnerability has been resolved: HID: core: fix number/pointer type confusion on long items When fetch item is called by hid scan report on an item with HID ITEM TAG LONG, it stores a pointer to the item data in item-data.longdata instead of storing a value...

7.5CVSS5.8AI score0.00322EPSS
SaveExploits0References126
Positive Technologies
Positive Technologies
•added 2026/09/09 12:00 a.m.•11 views

PT-2026-89086

These are all security issues fixed in the kernel-devel-7.2.5-1.1 package on the GA media of openSUSE Tumbleweed...

8.8CVSS7.3AI score0.00434EPSS
SaveExploits2References126
Positive Technologies
Positive Technologies
•added 2026/09/09 12:00 a.m.•12 views

PT-2026-89095

In the Linux kernel, the following vulnerability has been resolved: vlan: fix skb under panic and races when toggling HW VLAN offload Toggling hardware VLAN TX offload NETIF F HW VLAN CTAG TX or NETIF F HW VLAN STAG TX on a lower device invokes vlan transfer features, which dynamically changed...

5.8AI score0.00243EPSS
SaveExploits0References120
Positive Technologies
Positive Technologies
•added 2026/09/09 12:00 a.m.•16 views

PT-2026-88811

An issue was discovered in the mirage-crypto package before 2.2.0 for OCaml. The AES.GCM.authenticate decrypt into and Chacha20.authenticate decrypt into functions write the decrypted plaintext into a caller-provided buffer and only then compares the tag. On a forged tag, the functions returns...

6.2CVSS5.8AI score0.00107EPSS
SaveExploits0References1
Positive Technologies
Positive Technologies
•added 2026/09/09 12:00 a.m.•12 views

PT-2026-88898

Use of less trusted source vulnerability in PayTR Payment and Electronic Money Institution Inc. PayTR Virtual Pos iFrame API v9x WHMCS Module allows Exploitation of Trusted Identifiers. This issue affects PayTR Virtual Pos iFrame API v9x WHMCS Module: from v9.0.0 before v9.0.3...

9.1CVSS5.8AI score0.00144EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
•added 2026/09/09 12:00 a.m.•15 views

PT-2026-88868

The WPLP Cookie Consent WordPress plugin before 4.4.2 does not have capability or nonce checks on some of its A/B testing actions, allowing any authenticated user, such as a subscriber, to overwrite the cookie banner configuration shown to every visitor and to irreversibly reset the stored A/B te...

5.7AI score0.00254EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
•added 2026/09/09 12:00 a.m.•18 views

PT-2026-89049

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Certificate Validation vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to unauthorized access...

3.7CVSS5.8AI score0.00188EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
•added 2026/09/09 12:00 a.m.•13 views

PT-2026-88874

The Sunshine Photo Cart WordPress plugin before 3.7 does not validate that a client-supplied price identifier belongs to the item being purchased when it is added to the cart, allowing unauthenticated users to buy items at a lower price defined elsewhere on the site and complete an order at that...

5.6AI score0.00304EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
•added 2026/09/09 12:00 a.m.•16 views

PT-2026-88805

Unvalidated memory boundary could result in arbitrary code execution. The vulnerability exists in the code developed specifically for HP projects...

8.2CVSS6.5AI score0.00125EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
•added 2026/09/09 12:00 a.m.•9 views

PT-2026-89157

In versions prior to 7.10.2 a path traversal vulnerability in the /attachRemoteFiles endpoint of Fortra's GoAnywhere MFT allows Web Users with both Secure Folders and Secure Mail permissions to escape their sandboxed home directory, achieving arbitrary file read...

7.7CVSS5.8AI score0.00393EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
•added 2026/09/09 12:00 a.m.•11 views

PT-2026-89137

Buffer Overflow vulnerability in GPAC c2dee3aff638cd96f9617ac5b17dc2868cd90ef3 allows an attacker to execute arbitrary code via the nhntdmx process function. Fixed in fac50e6a12ac27ffabdd5d3080b51afcc44ad8d6...

6.6AI score0.00208EPSS
SaveExploits0References3
Positive Technologies
Positive Technologies
•added 2026/09/09 12:00 a.m.•13 views

PT-2026-89182

The Bluetooth Classic BR/EDR L2CAP receive handler bt l2cap br recv in subsys/bluetooth/host/classic/l2cap br.c dispatched inbound data PDUs based only on the destination channel ID, without checking that the target channel had reached the BT L2CAP CONNECTED state. A dynamic channel is assigned i...

5.4CVSS6AI score0.00159EPSS
SaveExploits0References3
Positive Technologies
Positive Technologies
•added 2026/09/09 12:00 a.m.•15 views

PT-2026-89069

After spoofing the device and obtaining one user confirmation, an attacker may be able to cause the application to transmit firmware through an unauthenticated and unsigned update channel...

8.5CVSS5.7AI score0.00265EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
•added 2026/09/09 12:00 a.m.•10 views

PT-2026-88936

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Exposure of Sensitive System Information Due to Uncleared Debug Information vulnerability. An unauthenticated attacker with physical access could potentially exploit this...

2.4CVSS5.7AI score0.00197EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
•added 2026/09/09 12:00 a.m.•12 views

PT-2026-88891

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains a Server-Side Request Forgery SSRF vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to denial of service...

7.3CVSS5.9AI score0.00341EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
•added 2026/09/09 12:00 a.m.•10 views

PT-2026-88903

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Certificate Validation vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to protection mechanism...

5.6CVSS5.8AI score0.00154EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
•added 2026/09/09 12:00 a.m.•9 views

PT-2026-88969

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Insertion of Sensitive Information into Log File vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to informati...

3.3CVSS5.7AI score0.00136EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
•added 2026/09/09 12:00 a.m.•11 views

PT-2026-89011

Snipe-IT through 8.6.3 does not neutralize formula elements in the "unaccepted assets" acceptance report CSV export. ReportsController::postAssetAcceptanceReport builds the CSV by hand stripping commas and joining rows manually and, unlike the six sibling exports in the same controller, never...

6.5CVSS5.8AI score0.0041EPSS
SaveExploits1References4
Positive Technologies
Positive Technologies
•added 2026/09/09 12:00 a.m.•10 views

PT-2026-89008

Snipe-IT 8.6.3 and earlier do not check the return value of Storage::put when writing the signature PNG and the generated acceptance PDF in AccountAcceptanceController::store. On filesystem drivers that return false instead of throwing on a write failure for example the local disk with restrictiv...

3.1CVSS5.9AI score0.00357EPSS
SaveExploits1References3
Positive Technologies
Positive Technologies
•added 2026/09/09 12:00 a.m.•10 views

PT-2026-89010

Snipe-IT versions before 8.7.0 fail to sanitize the category EULA text field before rendering it in checkout confirmation emails. Attackers with low-privilege permissions can inject markdown image syntax or raw HTML img tags pointing to local files or remote URLs, which the mail auto-embed librar...

8.5CVSS5.7AI score0.00351EPSS
SaveExploits1References6
Total number of security vulnerabilities212496