Lucene search
+L

90294 matches found

Positive Technologies
Positive Technologies
added 2026/07/01 12:0 a.m.26 views

PT-2026-54485

UltraVNC repeater through 1.8.2.2 contains a post-authentication out-of-bounds write in the allow/deny rule parser. In repeater/webgui/settings.c:225-272, after strncpy s copies a rule token into temp1rule1 25-byte destination or temp2/temp3 16-byte destination, the code unconditionally writes a...

7.2CVSS6.3AI score0.00571EPSS
SaveExploits0References7
Tenable Nessus
Tenable Nessus
added 2026/07/01 12:0 a.m.12 views

IBM WebSphere Application Server 8.5.x < 8.5.5.31 / 9.x < 9.0.5.29 (7278590)

The version of IBM WebSphere Application Server running on the remote host is affected by multiple vulnerabilities as referenced in the 7278590 advisory. - IBM WebSphere Application Server 9.0, and 8.5 is affected by a cross-site scripting vulnerability in the administrative console help system...

9.3CVSS5.9AI score0.00663EPSS
SaveExploits0References4
CVE
CVE
added 2026/07/01 12:0 a.m.28 views

CVE-2026-51946

CVE-2026-51946 describes a SQL injection vulnerability in the GoAdminGroup GoAdmin project (GoAdmin) affecting the last release, v1.2.26. The issue, exploitable via the __sort_type URL parameter on all /admin/info/{table} endpoints, could allow a remote attacker to execute arbitrary code and disc...

6.5CVSS6.2AI score0.00336EPSS
SaveExploits0References2
Drupal
Drupal
added 2026/07/01 12:0 a.m.15 views

FlowDrop - Moderately critical - Access bypass - SA-CONTRIB-2026-068

This module enables you to test and run AI-driven workflows interactively through a chat interface. The module doesn't sufficiently re-evaluate a human-in-the-loop approval gate where the workflow iterates more than once. This may result in execution of workflows that were not intended by the use...

5.4CVSS6.1AI score0.00141EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
added 2026/07/01 12:0 a.m.18 views

PT-2026-55225

Name of the Vulnerable Software and Affected Versions FlowDrop versions 0.0.0 through 1.6.0 Description A missing authorization issue allows forceful browsing. The module, which enables testing and running AI-driven workflows via a chat interface, fails to sufficiently re-evaluate human-in-the-lo...

6.2AI score0.00141EPSS
SaveExploits0References3
Positive Technologies
Positive Technologies
added 2026/07/01 12:0 a.m.14 views

PT-2026-54860

Name of the Vulnerable Software and Affected Versions Craft CMS versions 4.0.0-RC1 through 4.17.9 Craft CMS versions 5.0.0-RC1 through 5.9.9 Description Control panel users with the utility:system-messages permission can embed a file-reading payload into system email templates because the dataUrl...

6CVSS5.8AI score0.00268EPSS
SaveExploits0References10
ATTACKERKB
ATTACKERKB
added 2026/07/01 12:0 a.m.8 views

CVE-2026-51946

SQL Injection vulnerability in GoAdminGroup GoAdmin last release v1.2.26 allows a remote attacker to execute arbitrary code and obtain sensitive information via the the sorttype URL parameter on all /admin/info/table endpoints...

6.5CVSS6.2AI score0.00336EPSS
SaveExploits0References3
Positive Technologies
Positive Technologies
added 2026/07/01 12:0 a.m.12 views

PT-2026-54831

Name of the Vulnerable Software and Affected Versions MCO version 25.3.3.1 Description Insufficient authorization enforcement occurs in the '/customer/servlet/mco/webapi/admin-view-hierarchy/get-acl-tree-structure' endpoint. This allows an authenticated user with low privileges to retrieve...

7.1CVSS5.8AI score0.00193EPSS
SaveExploits0References7
OSV
OSV
added 2026/06/30 11:39 p.m.17 views

BIT-GHOST-2026-53948 Ghost: File Upload Content-Type Spoofing

Ghost is a Node.js content management system. From 6.19.4 until 6.21.1, insufficient validation of the client-supplied Content-Type on Ghost's Admin API file upload endpoint allowed uploaded files to be served from the site with an attacker-chosen content type on S3/GCS storage backends. On...

5.4CVSS5.5AI score0.00133EPSS
SaveExploits0References2
NVD
NVD
added 2026/06/30 11:17 p.m.15 views

CVE-2026-56233

Capgo before 12.128.2 contains a path traversal vulnerability in the builder upload proxy that allows authenticated users with build permissions to bypass upload restrictions. Attackers can append traversal sequences to the upload path, which are normalized by the WHATWG URL parser, enabling acce...

8.7CVSS0.00451EPSS
SaveExploits0References2
OSV
OSV
added 2026/06/30 10:8 p.m.9 views

CVE-2026-57995 phpMyFAQ - Privilege Escalation via Missing Self-Rights Constraint in GroupController::updatePermissions

phpMyFAQ before 4.1.5 contains a privilege escalation vulnerability in GroupController::updatePermissions that allows GROUPEDIT administrators to grant arbitrary rights to groups without verifying they hold those rights themselves. A delegated administrator can exploit this by assigning high-valu...

8.7CVSS6AI score
SaveExploits0References4
OSV
OSV
added 2026/06/30 10:8 p.m.8 views

CVE-2026-56233 Capgo - SSRF and Privilege Escalation via Path Traversal in Builder Upload Proxy

Capgo before 12.128.2 contains a path traversal vulnerability in the builder upload proxy that allows authenticated users with build permissions to bypass upload restrictions. Attackers can append traversal sequences to the upload path, which are normalized by the WHATWG URL parser, enabling acce...

8.7CVSS6AI score
SaveExploits0References4
Cvelist
Cvelist
added 2026/06/30 8:50 p.m.47 views

CVE-2026-11594 IBM WebSphere Application Server is affected by multiple cross-site scripting vulnerabilities

IBM WebSphere Application Server 9.0, and 8.5 is affected by a cross-site scripting vulnerability in the administrative console...

8.5CVSS0.00173EPSS
SaveExploits0References1
NVD
NVD
added 2026/06/30 8:17 p.m.18 views

CVE-2026-11712

IBM WebSphere Application Server 9.0, and 8.5 is affected by a cross-site scripting vulnerability in the administrative console help system...

9.3CVSS0.00336EPSS
SaveExploits0References1
NVD
NVD
added 2026/06/30 8:17 p.m.17 views

CVE-2026-11595

IBM WebSphere Application Server 9.0, and 8.5 could allow a remote attacker to obtain sensitive information from the administrative console's integrated help system...

7.5CVSS0.00663EPSS
SaveExploits0References1
NVD
NVD
added 2026/06/30 8:17 p.m.16 views

CVE-2026-11708

IBM WebSphere Application Server 9.0, and 8.5 is affected by a cross-site scripting vulnerability in the administrative console's integrated help system...

9.3CVSS0.0036EPSS
SaveExploits0References1
NVD
NVD
added 2026/06/30 8:17 p.m.9 views

CVE-2026-11546

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is affected by a server-side request forgery vulnerability with the adminCenter-1.0 feature enabled...

9.8CVSS0.00222EPSS
SaveExploits0References1
Vulnrichment
Vulnrichment
added 2026/06/30 7:51 p.m.11 views

CVE-2026-11546 IBM WebSphere Application Server Liberty is affected by a server-side request forgery vulnerability

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is affected by a server-side request forgery vulnerability with the adminCenter-1.0 feature enabled...

7.1CVSS5.8AI score0.00222EPSS
SaveExploits0References1
ATTACKERKB
ATTACKERKB
added 2026/06/30 7:51 p.m.10 views

CVE-2026-11546

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is affected by a server-side request forgery vulnerability with the adminCenter-1.0 feature enabled...

7.1CVSS5.8AI score0.00222EPSS
SaveExploits0References2Affected Software1
CVE
CVE
added 2026/06/30 7:50 p.m.26 views

CVE-2026-11595

CVE-2026-11595 affects IBM WebSphere Application Server 9.0 and 8.5. The IBM Security Bulletin describes a path traversal vulnerability in the administrative console’s integrated help system that could allow a remote attacker to obtain sensitive information. Affected products/versions include Web...

7.5CVSS5.8AI score0.00663EPSS
SaveExploits0References1Affected Software1
Rows per page
Query Builder