Lucene search
+L

2547591 matches found

Positive Technologies
Positive Technologies
added 19 hours ago5 views

PT-2026-77112

Shop manager Arbitrary File Download in CTX Feed = 6.6.47 versions...

4.9CVSS5.2AI score
SaveExploits0References2
Positive Technologies
Positive Technologies
added 19 hours ago4 views

PT-2026-76923

Grav plugin-api before 1.0.15 contains a script injection vulnerability where the SVG sanitizer only checks for the exact extension 'svg', allowing .svgz and .xhtml files to bypass sanitization and be stored unsanitized. Attackers with api.media.write permission can upload files containing...

5.1CVSS5.3AI score
SaveExploits0References3
Positive Technologies
Positive Technologies
added 19 hours ago5 views

PT-2026-76951

ArcadeDB versions before 26.8.1 contain a missing authentication vulnerability in the Redis wire-protocol plugin that allows unauthenticated attackers to read, write, and delete data. Attackers can connect to the Redis port and execute arbitrary commands against any database on the server without...

9.8CVSS5.8AI score
SaveExploits0References3
Positive Technologies
Positive Technologies
added 19 hours ago4 views

PT-2026-76918

SiYuan before v3.7.4 contains an insufficient access control vulnerability in the /api/lute/spinBlockDOM endpoint, which is guarded only by CheckAuth middleware instead of CheckAdminRole like its sibling endpoint. Authenticated users with RoleEditor or RoleReader roles can invoke the endpoint to...

5.3CVSS5.5AI score
SaveExploits0References3
Positive Technologies
Positive Technologies
added 19 hours ago2 views

PT-2026-76931

Grav before 2.0.15 contains a stored cross-site scripting vulnerability in the audio and video media rendering through the sourceParsedownElement method. The media URL fragment is concatenated unescaped into rawHtml source elements, allowing attackers to inject arbitrary HTML and JavaScript that...

7.6CVSS5.1AI score
SaveExploits0References4
Positive Technologies
Positive Technologies
added 19 hours ago4 views

PT-2026-76924

Grav Form Plugin before 9.1.19 fails to escape field-definition properties including prepend, append, spacer text, section text, and select option labels in form templates. Attackers with form authoring privileges can inject arbitrary HTML and JavaScript that executes for all form visitors throug...

5.4CVSS5.4AI score
SaveExploits0References3
Positive Technologies
Positive Technologies
added 19 hours ago4 views

PT-2026-76943

ArcadeDB before 26.8.1 fails to bind the authenticated principal on the gRPC transaction executor thread in beginTransaction, allowing authenticated readers to execute JavaScript commands without scripting authorization checks. Attackers can execute executeCommand with a transaction ID to run...

9.9CVSS5.4AI score
SaveExploits0References3
Positive Technologies
Positive Technologies
added 19 hours ago8 views

PT-2026-76912

SpiderFoot fails to HTML-escape correlation titles built from external scan data sources including server banners and metadata. Attackers can inject malicious HTML elements with event handlers into correlation results that execute scripts in the operator's browser when the correlations view is...

9.3CVSS5.4AI score
SaveExploits0References5
Positive Technologies
Positive Technologies
added 19 hours ago3 views

PT-2026-76907

Velociraptor's web GUI allows specifying a custom type for columns in tables. The URL type takes the cell value and forms a URL which can be clicked in the GUI.The code does not limit the schemes allowed in this URL , allowing an attacker to specify a JavaScript scheme exposing the user to XSS...

8.1CVSS5.4AI score
SaveExploits0References2
Positive Technologies
Positive Technologies
added 19 hours ago2 views

PT-2026-76919

SiYuan before v3.7.4 is missing authorization checks in 17 block metadata/content endpoints in kernel/api/block.go including getRefText, checkBlockExist, and getBlockBreadcrumb. These handlers are gated only by basic authentication model.CheckAuth and lack publish-access filtering, allowing...

8.7CVSS5.3AI score
SaveExploits0References3
Positive Technologies
Positive Technologies
added 19 hours ago2 views

PT-2026-76944

ArcadeDB versions before 26.8.1 contain a server-side request forgery vulnerability in the IMPORT DATABASE command where the security validator resolves and checks hostnames but the subsequent connection re-resolves the raw URL and follows redirects. Authenticated attackers can bypass the validat...

7.1CVSS5.5AI score
SaveExploits0References3
Positive Technologies
Positive Technologies
added 19 hours ago4 views

PT-2026-77212

Dell PowerStore SDNAS, contains an Out-of-bounds Write vulnerability in the SMB/CIFS. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Denial of service and Remote execution. This is a Critical vulnerability as a remote user could send a...

9.8CVSS5.7AI score
SaveExploits0References1
OSV
OSV
added 19 hours ago2 views

UBUNTU-CVE-2026-19968

A weakness has been identified in Open Asset Import Library Assimp 17c12da. The affected element is the function Assimp::MDLImporter::ReadFaces3DGSMDL7 in the library code/AssetLib/LWO/LWOLoader.h of the component 3DGS MDL7 Model Parser. Executing a manipulation can lead to heap-based buffer...

5.3CVSS5.9AI score0.00373EPSS
SaveExploits0References10
Positive Technologies
Positive Technologies
added 19 hours ago3 views

PT-2026-77149

CSV export functionality in Brainstorm Force SureForms version, = 2.1.1, fails to neutralize spreadsheet formula characters in user-controlled form field names before generating CSV exports, which allows a remote attacker to execute spreadsheet formulas on an administrator's workstation when the...

5.6AI score
SaveExploits0References3
Positive Technologies
Positive Technologies
added 19 hours ago3 views

PT-2026-76928

Grav before 2.0.15 contains a stored cross-site scripting vulnerability in the detectXss function where unpaired quotes in unquoted attribute values bypass event-handler detection. Authenticated editors can inject event handlers like onerror= that pass validation and execute in visitor browsers...

9.3CVSS4.9AI score
SaveExploits0References3
Positive Technologies
Positive Technologies
added 19 hours ago4 views

PT-2026-77200

Joomla! Core - 20260810 - Unrestricted uploads of SHTML files in Joomla 1.0.0-5.4.7, 6.0.0-6.1.2 - The default list of dangerous files did not include SHTML files. On servers that executed these files, that could lead to code execution...

8.9CVSS5.5AI score
SaveExploits0References4
Positive Technologies
Positive Technologies
added 19 hours ago6 views

PT-2026-76913

Bastillion fails to properly validate request URI paths in its controller dispatcher, allowing unauthenticated attackers to bypass authentication filters by prefixing requests with arbitrary path segments. Attackers can access administrative controllers to read user listings, create manager...

9.8CVSS5.5AI score
SaveExploits0References6
Trellix
Trellix
added 19 hours ago3 views

Stitching the Kill Chain: Detecting NTDS.dit Exfiltration with Trellix Helix Correlation

Stitching the Kill Chain: Detecting NTDS.dit Exfiltration with Trellix Helix Correlation By Adithya Chandra and Maulik Maheta · August 18, 2026 Executive Summary While attackers continuously cycle through new tooling, their underlying techniques remain remarkably consistent. Credential theft from...

6.4AI score
SaveExploits0
Redos
Redos
added 19 hours ago3 views

ROS-20260818-73-0038

The vulnerability in xrdp is related to buffer overflow in dynamic memory. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

9.8CVSS6.5AI score0.00609EPSS
SaveExploits0
Redos
Redos
added 19 hours ago2 views

ROS-20260818-73-0025

The vulnerability in MariaDB relates to the failure to take measures to neutralize special elements used in the operating system commands. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

8CVSS6AI score0.00588EPSS
SaveExploits0
Rows per page
Query Builder