Lucene search
+L

77492 matches found

Positive Technologies
Positive Technologies
added 6 days ago2 views

PT-2026-70995

Name of the Vulnerable Software and Affected Versions Velociraptor affected versions not specified Description Velociraptor allows scheduling new collections via VQL queries in notebooks. While scheduling a new collection typically requires the COLLECT CLIENT permission, this requirement is not...

8.2CVSS5.4AI score0.00232EPSS
SaveExploits0References4
Tenable Nessus
Tenable Nessus
added 6 days ago9 views

GitLab 12.0 < 19.0.6 / 19.1 < 19.1.4 / 19.2 < 19.2.2 (CVE-2026-6821)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - GitLab has remediated an issue in GitLab EE affecting all versions from 12.0 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated...

4.3CVSS5.6AI score0.00281EPSS
SaveExploits0References5
Tenable Nessus
Tenable Nessus
added 6 days ago7 views

GitLab 17.7 < 19.0.6 / 19.1 < 19.1.4 / 19.2 < 19.2.2 (CVE-2026-18244)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - Missing Authorization in GitLab CVE-2026-18244 Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number. %NASLMINLEVEL 80900 C...

4.3CVSS5.5AI score0.00205EPSS
SaveExploits0References4
Positive Technologies
Positive Technologies
added 6 days ago4 views

PT-2026-71119

In WhatsUp Gold versions released before 2026.0.2, an improper authorization vulnerability in the Scheduled Reports API allows any authenticated user to invoke restricted actions...

4.3CVSS5.2AI score0.00161EPSS
SaveExploits0References4
Positive Technologies
Positive Technologies
added 6 days ago5 views

PT-2026-71352

Name of the Vulnerable Software and Affected Versions IBM DOORS Next versions 7.0.3 through 7.0.3 Interim Fix 018 Description An authenticated user can bypass security logic to perform unauthorized activities. Recommendations Update IBM DOORS Next to a version later than 7.0.3 Interim Fix 018...

10CVSS5.2AI score0.00316EPSS
SaveExploits0References4
Positive Technologies
Positive Technologies
added 6 days ago4 views

PT-2026-71088

RustFS is a distributed object storage system built in Rust. From 1.0.0-alpha.64 until 1.0.0-rc.1, RustFS external OPA authorization enabled by RUSTFS POLICY PLUGIN URL in crates/iam/src/sys.rs sets PreparedIamAuth.needs existing object tag incorrectly for PreparedIamMode::Opa, causing maybe merg...

7.5CVSS5.3AI score0.00346EPSS
SaveExploits0References5
Positive Technologies
Positive Technologies
added 6 days ago5 views

PT-2026-71233

SiYuan v3.7.4-alpha.1 a pre-release; the endpoint does not exist in stable v3.7.3 or earlier contains an information disclosure vulnerability in the /api/av/getAttributeViewFieldViews endpoint. The route is registered with CheckAuth only and applies no publish-access filtering, so reader-role...

6.9CVSS5.3AI score0.00237EPSS
SaveExploits0References3
Positive Technologies
Positive Technologies
added 6 days ago5 views

PT-2026-71103

Name of the Vulnerable Software and Affected Versions Puppet affected versions not specified Description An authenticated user can view private Puppet module metadata even if they do not have the required repository read access. Recommendations At the moment, there is no information about a newer...

4.3CVSS5.2AI score0.00204EPSS
SaveExploits0References4
Positive Technologies
Positive Technologies
added 6 days ago4 views

PT-2026-71160

Name of the Vulnerable Software and Affected Versions IBM i versions 7.3 through 7.6 Description Improper authorization in the handling of high-authority threads allows a remote authenticated attacker to escalate privileges. Recommendations At the moment, there is no information about a newer...

9.9CVSS5.3AI score0.00258EPSS
SaveExploits0References5
Tenable Nessus
Tenable Nessus
added 6 days ago7 views

GitLab 19.1 < 19.1.4 / 19.2 < 19.2.2 (CVE-2026-19228)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.1.4 and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user to cause AI usa...

8.5CVSS5.5AI score0.0023EPSS
SaveExploits0References4
Tenable Nessus
Tenable Nessus
added 6 days ago8 views

GitLab 16.0 < 19.0.6 / 19.1 < 19.1.4 / 19.2 < 19.2.2 (CVE-2026-4879)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - GitLab has remediated an issue in GitLab EE affecting all versions from 16.0 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated...

4.3CVSS5.6AI score0.00243EPSS
SaveExploits0References5
Positive Technologies
Positive Technologies
added 6 days ago6 views

PT-2026-71133

Name of the Vulnerable Software and Affected Versions Apache Airflow versions prior to 3.3.1 Description In deployments using multi-team mode with a team-aware auth manager, the asset materialization endpoint POST /api/v2/assets/asset id/materialize and the XCom result check on wait dag run until...

6.5CVSS5.3AI score0.00328EPSS
SaveExploits0References10
Positive Technologies
Positive Technologies
added 6 days ago5 views

PT-2026-71028

The WPC Admin Columns WordPress plugin before 2.3.4 does not have authorisation checks in one of its AJAX actions, allowing users with a role as low as subscriber to read arbitrary user, post and term metadata, including data belonging to administrators...

6.5CVSS5.4AI score0.00219EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
added 6 days ago3 views

PT-2026-71285

An authorization bypass vulnerability in LXD due to a timing flaw during configuration merging allows an authenticated attacker to bypass target project restrictions during cross-project instance copies. When copying an instance to a target project, LXD performs restriction checks before...

9.9CVSS5.2AI score0.00196EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
added 6 days ago4 views

PT-2026-71283

An authorization bypass vulnerability in LXD allows an authenticated attacker to bypass project-level container isolation restrictions. When a project is configured with restrictions on container privileges such as enforcing restricted.containers.privilege=isolated, LXD fails to enforce the...

4.3CVSS5.4AI score0.00213EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
added 6 days ago3 views

PT-2026-71196

The Microsoft Container Migration Solution Accelerator is a multi-service application that provides a multi-agent, AI-driven migration solution for moving container service configurations to Azure Kubernetes Service. In version 2.1.2 and earlier, a security vulnerability was identified in the...

8.7CVSS5.4AI score0.00677EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
added 6 days ago5 views

PT-2026-71130

Name of the Vulnerable Software and Affected Versions Apache Airflow versions prior to 3.3.1 Description An authorization flaw exists in the Backfill API where a discrepancy in how the backfill id path segment is parsed allows an authenticated user with edit permissions on any single Dag to perfo...

7.5CVSS5.2AI score0.00416EPSS
SaveExploits0References10
Tenable Nessus
Tenable Nessus
added 6 days ago12 views

GitLab 19.1 < 19.1.4 / 19.2 < 19.2.2 (CVE-2026-18433)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.1.4 and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user to read policy...

4.3CVSS5.6AI score0.00243EPSS
SaveExploits0References5
NVD
NVD
added last week9 views

CVE-2026-73249

calibre is an e-book manager. Prior to 9.12.0, the calibre Content Server endpoint POST /book-update-annotations/libraryid/bookid/fmt in src/calibre/srv/books.py omits needsdbwrite=True, causing Router.dispatch to skip ctx.checkforwriteaccess before updateannotations passes attacker-controlled JS...

7.5CVSS0.00248EPSS
SaveExploits0References3
Cvelist
Cvelist
added last week27 views

CVE-2026-73249 calibre Content Server `/book-update-annotations` Missing Write Authorization Check Allows Unauthorized Annotation Modification

calibre is an e-book manager. Prior to 9.12.0, the calibre Content Server endpoint POST /book-update-annotations/libraryid/bookid/fmt in src/calibre/srv/books.py omits needsdbwrite=True, causing Router.dispatch to skip ctx.checkforwriteaccess before updateannotations passes attacker-controlled JS...

7.5CVSS0.00248EPSS
SaveExploits0References3
Rows per page
Query Builder