Lucene search
+L

41162 matches found

Positive Technologies
Positive Technologies
added 2026/04/16 12:0 a.m.10 views

PT-2026-33302

The authentication endpoint fails to adequately validate user-supplied input before reflecting it back in the response. This allows an attacker to inject malicious script payloads into the input parameters, which are then executed by the victim's browser. Successful exploitation can enable an...

6.1CVSS5.8AI score0.0024EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
added 2026/04/16 12:0 a.m.19 views

PT-2026-35068

Name of the Vulnerable Software and Affected Versions Authlib versions prior to 1.6.11 Description Authlib is a Python library used to build OAuth and OpenID Connect servers. A lack of Cross-Site Request Forgery CSRF protection exists in the cache feature of the 'authlib.integrations.starlette...

7.5CVSS4.8AI score0.00476EPSS
SaveExploits6References108
Snyk
Snyk
added 2026/04/15 8:22 p.m.5 views

Exposure of Private Personal Information to an Unauthorized Actor

Overview Affected versions of this package are vulnerable to Exposure of Private Personal Information to an Unauthorized Actor via the configuration API when type protection is missing for sensitive fields. An attacker can obtain confidential credentials by sending requests directly to the API...

9.3CVSS5.4AI score0.00407EPSS
SaveExploits0References2
RedhatCVE
RedhatCVE
added 2026/04/15 7:24 p.m.7 views

CVE-2026-32202

Protection mechanism failure in Windows Shell allows an unauthorized attacker to perform spoofing over a network...

4.3CVSS5.8AI score0.63686EPSS
SaveExploits3References1
RedhatCVE
RedhatCVE
added 2026/04/15 7:23 p.m.8 views

CVE-2026-32225

Protection mechanism failure in Windows Shell allows an unauthorized attacker to bypass a security feature over a network...

8.8CVSS6.2AI score0.00908EPSS
SaveExploits0References1
PyPA
PyPA
added 2026/04/15 7:16 p.m.17 views

PYSEC-2026-156

Weblate is a web based localization tool. In versions prior to 5.17, the webhook add-on did not utilize existing SSRF protections. This issue has been fixed in version 5.17. If developers are unable to update immediately, they can disable the webhook add-on as a workaround...

4.1CVSS5.7AI score0.00275EPSS
SaveExploits0References2Affected Software1
GithubExploit
GithubExploit
added 2026/04/15 9:15 a.m.129 views

File-Cleaner-

I learn from this Project w Never trust user input: Attackers c...

5.8AI score
SaveExploits0
Positive Technologies
Positive Technologies
added 2026/04/15 12:0 a.m.13 views

PT-2026-33189

Avast Premium Security Gen Self Protection Driver Exposed Dangerous Function Local Privilege Escalation Vulnerability...

5.8AI score
SaveExploits0References1
Zero Day Initiative
Zero Day Initiative
added 2026/04/15 12:0 a.m.12 views

Avast Premium Security Gen Self Protection Driver Exposed Dangerous Function Local Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on affected installations of Avast Premium Security. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the Gen Self...

7.8CVSS6.1AI score
SaveExploits0
Github Security Blog
Github Security Blog
added 2026/04/14 11:33 p.m.14 views

frp has an authentication bypass in HTTP vhost routing when routeByHTTPUser is used for access control

Summary frp contains an authentication bypass in the HTTP vhost routing path when routeByHTTPUser is used as part of access control. In proxy-style requests, the routing logic uses the username from Proxy-Authorization to select the routeByHTTPUser backend, while the access control check uses...

9.1CVSS5.9AI score0.00269EPSS
SaveExploits1References3Affected Software1
Github Security Blog
Github Security Blog
added 2026/04/14 11:13 p.m.11 views

WWBN AVideo is missing CSRF protection in objects/commentDelete.json.php enables mass comment deletion against moderators and content creators

Summary objects/commentDelete.json.php is a state-mutating JSON endpoint that deletes comments but performs no CSRF validation. It does not call forbidIfIsUntrustedRequest, does not verify a CSRF/global token, and does not check Origin/Referer. Because AVideo intentionally sets...

5.4CVSS5.5AI score0.00113EPSS
SaveExploits1References4Affected Software1
Github Security Blog
Github Security Blog
added 2026/04/14 11:12 p.m.18 views

WWBN AVideo has Multiple CSRF Vulnerabilities in Admin JSON Endpoints (Category CRUD, Plugin Update Script)

Summary Three admin-only JSON endpoints — objects/categoryAddNew.json.php, objects/categoryDelete.json.php, and objects/pluginRunUpdateScript.json.php — enforce only a role check Category::canCreateCategory / User::isAdmin and perform state-changing actions against the database without calling...

7.1CVSS6.1AI score0.00166EPSS
SaveExploits1References4Affected Software1
OSV
OSV
added 2026/04/14 11:12 p.m.10 views

GHSA-VVFW-4M39-FJQF WWBN AVideo has CSRF in configurationUpdate.json.php Enables Full Site Configuration Takeover Including Encoder URL and SMTP Credentials

Summary objects/configurationUpdate.json.php also routed via /updateConfig persists dozens of global site settings from $POST but protects the endpoint only with User::isAdmin. It does not call forbidIfIsUntrustedRequest, does not verify a globalToken, and does not validate the Origin/Referer...

8.3CVSS5.9AI score0.00173EPSS
SaveExploits1References4
Snyk
Snyk
added 2026/04/14 8:2 p.m.6 views

Protection Mechanism Failure

Overview Affected versions of this package are vulnerable to Protection Mechanism Failure in the collect process. An attacker can gain unauthorized access to restricted template functionality by leveraging insufficient sandbox restrictions when authenticated with backend access and template editi...

6.9CVSS5.7AI score0.00395EPSS
SaveExploits2References3
EUVD
EUVD
added 2026/04/14 6:30 p.m.7 views

EUVD-2026-22613

Protection mechanism failure in Windows Shell allows an unauthorized attacker to bypass a security feature over a network...

8.8CVSS5.8AI score0.00908EPSS
SaveExploits0References2
EUVD
EUVD
added 2026/04/14 6:30 p.m.9 views

EUVD-2026-22333

A insufficiently protected credentials vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4 all versions, FortiSandbox PaaS 5.0.1 through 5.0.5 may allow an authenticathed administrator to read LDAP server credentials via client-side inspection...

2.7CVSS5.8AI score0.00305EPSS
SaveExploits0References2
NVD
NVD
added 2026/04/14 6:17 p.m.8 views

CVE-2026-32225

Protection mechanism failure in Windows Shell allows an unauthorized attacker to bypass a security feature over a network...

8.8CVSS0.00908EPSS
SaveExploits0References1
NVD
NVD
added 2026/04/14 6:17 p.m.6 views

CVE-2026-32202

Protection mechanism failure in Windows Shell allows an unauthorized attacker to perform spoofing over a network...

4.3CVSS0.63686EPSS
SaveExploits3References4
NVD
NVD
added 2026/04/14 6:17 p.m.6 views

CVE-2026-32171

Insufficiently protected credentials in Azure Logic Apps allows an authorized attacker to elevate privileges over a network...

8.8CVSS0.0044EPSS
SaveExploits0References1
ATTACKERKB
ATTACKERKB
added 2026/04/14 4:58 p.m.11 views

CVE-2026-32225

Protection mechanism failure in Windows Shell allows an unauthorized attacker to bypass a security feature over a network...

8.8CVSS5.8AI score0.00908EPSS
SaveExploits0References2Affected Software21
Rows per page
Query Builder