Lucene search
+L
PtsecurityRecent

212496 matches found

Positive Technologies
Positive Technologies
•added 2026/09/09 12:00 a.m.•14 views

PT-2026-89006

PocketMine-MP versions before 5.39.2 fail to validate entity despawn state when processing attack packets from clients. Attackers can exploit a race condition by attacking a disconnecting player to trigger multiple death handlers, causing inventory items and experience to drop multiple times for...

6.3CVSS5.6AI score0.00348EPSS
SaveExploits0References4
Positive Technologies
Positive Technologies
•added 2026/09/09 12:00 a.m.•12 views

PT-2026-89167

Summary On SQLite deployments, the lookup that maps an external identity to a local account does a substring match instead of an exact match. A subject value containing SQL wildcard characters therefore matches accounts the value was never issued for, and the sign-in binds to whichever account th...

8.1CVSS5.7AI score0.00599EPSS
SaveExploits1References10
Positive Technologies
Positive Technologies
•added 2026/09/09 12:00 a.m.•12 views

PT-2026-89172

Summary Any authenticated user with access to a shared terminal server could get script of their choosing to run in the Open WebUI origin itself. The in-app port preview rendered the content of a previewed port in an iframe whose sandbox always granted allow-same-origin alongside allow-scripts, a...

8.7CVSS6AI score0.00417EPSS
SaveExploits1References9
Positive Technologies
Positive Technologies
•added 2026/09/09 12:00 a.m.•13 views

PT-2026-89161

Summary A user who is demoted from admin by an identity provider keeps admin-level read and write access to every user's notes, over any Socket.IO connection that was already open when the demotion happened. Open WebUI caches the user's role on the socket at connection time, and the two SSO...

6.5CVSS5.5AI score0.00513EPSS
SaveExploits1References9
Positive Technologies
Positive Technologies
•added 2026/09/09 12:00 a.m.•15 views

PT-2026-89179

Summary Chat histories are stored as an unvalidated JSON object. The walk that reconstructs a chat's message chain detected repeats using each message's own id field while moving through the history by map key, so a message that simply omitted id was never recorded as visited. A history whose...

6.5CVSS6.4AI score0.00583EPSS
SaveExploits1References13
Positive Technologies
Positive Technologies
•added 2026/09/09 12:00 a.m.•13 views

PT-2026-89173

Summary With the Playwright web loader enabled, Open WebUI checks the address behind a user-submitted URL before allowing the request, then handed the request to the browser to perform. The browser resolved the hostname a second time, on its own, and that answer was never checked. An attacker who...

7.7CVSS5.7AI score0.00354EPSS
SaveExploits1References10
Positive Technologies
Positive Technologies
•added 2026/09/09 12:00 a.m.•166 views

PT-2026-88586

Clickjacking in TrustedWebActivities in Google Chrome on on Android prior to 153.0.8010.36 allowed a local attacker to spoof address bar via a co-installed app. Chromium security severity: Medium...

9.8CVSS6.3AI score0.00506EPSS
SaveExploits13References234
Positive Technologies
Positive Technologies
•added 2026/09/09 12:00 a.m.•18 views

PT-2026-88617

Race condition in Mobile in Google Chrome on on iOS prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. Chromium security severity: High...

9.8CVSS6.3AI score0.00506EPSS
SaveExploits12References234
Positive Technologies
Positive Technologies
•added 2026/09/09 12:00 a.m.•14 views

PT-2026-88872

The Quentn WP WordPress plugin before 1.2.15 does not properly sanitise and escape a parameter before using it in an SQL query, allowing high privilege users such as administrators to perform SQL injection attacks...

5.8AI score0.00311EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
•added 2026/09/09 12:00 a.m.•12 views

PT-2026-88923

Server side request forgery in Apache Impala versions 4.4.x and 4.5.x. Authenticated Impala users with permissions to execute the ai generate text function can exfiltrate secrets provided by the credential providers configured in the hadoop.security.credential.provider.path property of...

5.9AI score0.00576EPSS
SaveExploits0References3
Positive Technologies
Positive Technologies
•added 2026/09/09 12:00 a.m.•11 views

PT-2026-88924

Insufficient authorization of Data Source tables in Impala 2.7-4.5 allows a client with privileges to upload a file to remote storage and create a table to execute arbitrary Java code. Users are recommended to upgrade to version 4.5.2, which fixes this issue...

6.3AI score0.00541EPSS
SaveExploits1References3
Positive Technologies
Positive Technologies
•added 2026/09/09 12:00 a.m.•12 views

PT-2026-88941

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an External Control of File Name or Path vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to filesystem access...

7.3CVSS5.8AI score0.00332EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
•added 2026/09/09 12:00 a.m.•13 views

PT-2026-89079

Cash Collect contains an improper authorization vulnerability in the Sage AR Automation API. Insufficient tenant-level authorization checks allow authenticated users to access administrative resources belonging to other tenants by specifying a valid non predictable tenant identifier...

9CVSS5.7AI score0.00271EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
•added 2026/09/09 12:00 a.m.•15 views

PT-2026-88902

CVE-2026-79696: A Perfect 10.0 in Google's Agent Toolkit Google just shipped a fix for a vulnerability that scored a perfect 10.0 on the CVSS scale — the maximum severity a flaw can get. The bug lives in ADK, Google Cloud's Agent Development Kit for Python — the framework a growing number of team...

10CVSS6.6AI score0.0074EPSS
SaveExploits0References12
Positive Technologies
Positive Technologies
•added 2026/09/09 12:00 a.m.•13 views

PT-2026-88796

OOB write vulnerability in the rendering and composition module. Impact: Successful exploitation of this vulnerability may affect availability...

7.3CVSS5.7AI score0.0012EPSS
SaveExploits0References3
Positive Technologies
Positive Technologies
•added 2026/09/09 12:00 a.m.•15 views

PT-2026-89211

Unauthenticated Network-Exposed Turborepo Task Execution via /api/run Summary @yeger/turbo-graph starts its embedded Next.js server without binding to the loopback interface, causing it to listen on all network interfaces 0.0.0.0:29312 by default. The /api/run HTTP endpoint exposed by this server...

8.8CVSS6.4AI score0.00487EPSS
SaveExploits0References6
Positive Technologies
Positive Technologies
•added 2026/09/09 12:00 a.m.•12 views

PT-2026-88646

Incorrect type conversion or cast in Safebrowsing in Google Chrome on on Mac prior to 153.0.8010.36 allowed a remote attacker to bypass system access restrictions via a crafted file. Chromium security severity: Low...

9.8CVSS6.3AI score0.00506EPSS
SaveExploits12References234
Positive Technologies
Positive Technologies
•added 2026/09/09 12:00 a.m.•10 views

PT-2026-88919

Missing Authorization, Improper Control of Generation of Code 'Code Injection', Improper Control of Dynamically-Managed Code Resources, Use of Externally-Controlled Input to Select Classes or Code 'Unsafe Reflection' vulnerability in Apache Nutch Server Nutch REST API. This issue affects Apache...

5.7AI score0.00665EPSS
SaveExploits0References3
Positive Technologies
Positive Technologies
•added 2026/09/09 12:00 a.m.•11 views

PT-2026-88618

Observable discrepancy in Safebrowsing in Google Chrome on on iOS prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to potentially obtain sensitive information via a crafted HTML page. Chromium security severity: Medium...

9.8CVSS6.4AI score0.00506EPSS
SaveExploits12References234
Positive Technologies
Positive Technologies
•added 2026/09/09 12:00 a.m.•13 views

PT-2026-88700

Improper input validation in Safebrowsing in Google Chrome on on Android prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. Chromium security severity: Medium...

9.8CVSS6.3AI score0.00506EPSS
SaveExploits12References234
Positive Technologies
Positive Technologies
•added 2026/09/09 12:00 a.m.•30 views

PT-2026-88906

Several Newfold plugins are vulnerable to Authentication Bypass. The vulnerability exists because the plugins bundle the wp-module-data module. In the module, the authenticate method — registered on the rest authentication errors filter and therefore evaluated for every unauthenticated REST API...

8.8CVSS5.8AI score0.0291EPSS
SaveExploits1References13
Positive Technologies
Positive Technologies
•added 2026/09/09 12:00 a.m.•16 views

PT-2026-88793

Permission control vulnerability in the event notification module. Impact: Successful exploitation of this vulnerability may affect service confidentiality...

8.6CVSS5.7AI score0.00449EPSS
SaveExploits0References5
Positive Technologies
Positive Technologies
•added 2026/09/09 12:00 a.m.•21 views

PT-2026-88764

Tanium addressed a path traversal vulnerability in Tanium Data Service...

6.6CVSS5.7AI score0.0031EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
•added 2026/09/09 12:00 a.m.•13 views

PT-2026-88833

Improper access control in SettingsProvider prior to SMR Sep-2026 Release 1 allows local attackers to access sensitive information...

5.1CVSS5.7AI score0.00093EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
•added 2026/09/09 12:00 a.m.•18 views

PT-2026-89103

Dell PowerScale OneFS versions 9.12.0.0 through 9.13.1.0 contain an Insecure Temporary File vulnerability. A low privileged remote attacker could potentially exploit this vulnerability, leading to denial of service and information tampering...

5.4CVSS5.8AI score0.0039EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
•added 2026/09/08 12:00 a.m.•10 views

PT-2026-87218

Insufficient granularity of access control in SQL Server allows an authorized attacker to elevate privileges over a network...

8.8CVSS5.8AI score0.00778EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
•added 2026/09/08 12:00 a.m.•14 views

PT-2026-87509

Use of uninitialized resource in Remote Desktop Client allows an authorized attacker to execute code over a network...

8.8CVSS6.1AI score0.00913EPSS
SaveExploits0References5
Positive Technologies
Positive Technologies
•added 2026/09/08 12:00 a.m.•12 views

PT-2026-87270

Integer overflow or wraparound in Windows NTFS allows an authorized attacker to elevate privileges locally...

7.8CVSS5.7AI score0.00333EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
•added 2026/09/08 12:00 a.m.•14 views

PT-2026-87292

Buffer over-read in Windows NTFS allows an authorized attacker to execute code locally...

7.8CVSS6AI score0.00333EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
•added 2026/09/08 12:00 a.m.•13 views

PT-2026-88074

Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally...

5.5CVSS5.6AI score0.00541EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
•added 2026/09/08 12:00 a.m.•15 views

PT-2026-88495

Acrobat Reader is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue requires user interaction in that a victi...

6.3CVSS5.7AI score0.00235EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
•added 2026/09/08 12:00 a.m.•13 views

PT-2026-87867

Remote Code Execution in Windows Routing and Remote Access Service RRAS allows attacker to gain an unauthorized access to victim's machine...

8.8CVSS5.9AI score0.00923EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
•added 2026/09/08 12:00 a.m.•14 views

PT-2026-87133

snipe-it before 8.7.0 contains an incorrect calculation vulnerability in checkout request handling that allows authenticated users to corrupt the assets.requests counter through duplicate submissions and cancellations without active requests. Attackers can repeatedly call cancel endpoints without...

5.3CVSS5.7AI score0.00298EPSS
SaveExploits0References3
Positive Technologies
Positive Technologies
•added 2026/09/08 12:00 a.m.•13 views

PT-2026-87130

Snipe-IT before 8.7.0 streams the SQL entry from an uploaded backup archive directly into the MySQL/MariaDB command-line client mysql without the --binary-mode flag, so the client interprets lines beginning with backslash commands such as ! as local shell commands. An authenticated...

8.6CVSS6.1AI score0.00579EPSS
SaveExploits0References3
Positive Technologies
Positive Technologies
•added 2026/09/08 12:00 a.m.•16 views

PT-2026-87392

Exposure of private personal information to an unauthorized actor in Windows Universal Plug and Play UPnP Device Host allows an authorized attacker to disclose information locally...

5.5CVSS5.7AI score0.00479EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
•added 2026/09/08 12:00 a.m.•14 views

PT-2026-87794

Heap-based buffer overflow in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally...

7.8CVSS5.9AI score0.00333EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
•added 2026/09/08 12:00 a.m.•16 views

PT-2026-87711

Use after free in Windows DWM Core Library allows an authorized attacker to elevate privileges over a network...

7.1CVSS6.2AI score0.0057EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
•added 2026/09/08 12:00 a.m.•11 views

PT-2026-87598

Use after free in Windows Services for NFS ONCRPC XDR Driver allows an unauthorized attacker to execute code over a network...

9.8CVSS8.8AI score0.00974EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
•added 2026/09/08 12:00 a.m.•15 views

PT-2026-87226

🚨 SQL Server 2025 admins: patch CVE-2026-67373 now. An authenticated attacker can turn a crafted query into remote code execution—because apparently databases needed an “execute anything” feature. https://t.co/1vG0qS5kO6 MicrosoftSecurity Msrc Cve202667373 https://t.co/EYU7o7cD4n...

8.8CVSS5.9AI score0.00913EPSS
SaveExploits0References3
Positive Technologies
Positive Technologies
•added 2026/09/08 12:00 a.m.•12 views

PT-2026-87680

Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network...

8.8CVSS6.3AI score0.00819EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
•added 2026/09/08 12:00 a.m.•12 views

PT-2026-87311

🛠️ XPS isn’t just printer-file wallpaper: CVE-2026-68897 can elevate privileges across Windows clients and servers. Patch it, verify the build—and stop trusting “Important” to mean harmless. https://t.co/pCI6y6OSI4 MicrosoftSecurity Msrc Cve202668897 https://t.co/BfOMN4UXI5...

7CVSS5.7AI score0.0027EPSS
SaveExploits0References5
Positive Technologies
Positive Technologies
•added 2026/09/08 12:00 a.m.•13 views

PT-2026-87600

Incorrect calculation of buffer size in Windows iSCSI allows an unauthorized attacker to execute code over a network...

8.8CVSS6.3AI score0.00819EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
•added 2026/09/08 12:00 a.m.•22 views

PT-2026-88450

🔴 CISA flags hardcoded credential flaw in CareCam Pro IP cameras deployed globally ANJIA AJL33PC0801 IP camera firmware linuxlinux202008261138 svn13796, U-Boot 2010.06 compiled Aug 26 2020 contains hardcoded bootloader credentials. An attacker with physical access can exploit CVE-2026-85083 to ga...

7CVSS5.6AI score0.00294EPSS
SaveExploits0References5
Positive Technologies
Positive Technologies
•added 2026/09/08 12:00 a.m.•12 views

PT-2026-87884

Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network...

8.8CVSS6.3AI score0.00819EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
•added 2026/09/08 12:00 a.m.•16 views

PT-2026-87089

A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on the server...

8.8CVSS6.7AI score0.01492EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
•added 2026/09/08 12:00 a.m.•15 views

PT-2026-87085

A Missing Authorization vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on the server...

9.9CVSS6.7AI score0.01237EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
•added 2026/09/08 12:00 a.m.•14 views

PT-2026-87885

Buffer over-read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network...

6.5CVSS5.7AI score0.00922EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
•added 2026/09/08 12:00 a.m.•11 views

PT-2026-88328

Adobe Experience Manager is affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the...

5.4CVSS5.7AI score0.00277EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
•added 2026/09/08 12:00 a.m.•14 views

PT-2026-87654

Server-side request forgery ssrf in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network...

6.5CVSS5.7AI score0.0084EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
•added 2026/09/08 12:00 a.m.•14 views

PT-2026-88332

Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting XSS vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in...

5.4CVSS5.9AI score0.00255EPSS
SaveExploits0References2
Total number of security vulnerabilities212496