--- title: "Tungsten Automation vulnerabilities: CVEs, CISA KEV and security advisories" url: https://radicalnotion.ai/vendor/tungsten-automation type: vendor description: "Tungsten Automation has 141 published CVEs, 0 in CISA KEV and 1 with public exploits." updated: 2026-04-23 source: RadicalNotion.AI license: CC BY-NC 4.0 (https://creativecommons.org/licenses/by-nc/4.0/) --- # Tungsten Automation vulnerabilities - **Published CVEs:** 141 - **In CISA KEV:** 0 - **With a public exploit:** 1 - **With a patch:** 137 - **Average CVSS:** 6.8 - **CVEs in the last two years:** 6 - **First CVE:** 2024-01-11 - **Latest CVE:** 2026-04-23 ## Severity breakdown | Severity | CVEs | | --- | --- | | Critical | 0 | | High | 95 | | Medium | 31 | | Low | 15 | | Unscored | 0 | ## Most affected products | Product | CVEs | | --- | --- | | [Power PDF](https://radicalnotion.ai/vendor/tungsten-automation/power-pdf) | 137 | | [TotalAgility](https://radicalnotion.ai/vendor/tungsten-automation/totalagility) | 2 | | [kofax capture](https://radicalnotion.ai/vendor/tungsten-automation/kofax-capture) | 1 | | [Tungsten Capture (formerly Kofax Capture)](https://radicalnotion.ai/vendor/tungsten-automation/tungsten-capture-formerly-kofax-capture) | 1 | ## Most common weakness types | CWE | Name | CVEs | | --- | --- | --- | | [CWE-125](https://radicalnotion.ai/cwe/cwe-125) | Out-of-bounds Read | 50 | | [CWE-787](https://radicalnotion.ai/cwe/cwe-787) | Out-of-bounds Write | 38 | | [CWE-122](https://radicalnotion.ai/cwe/cwe-122) | Heap-based Buffer Overflow | 14 | | [CWE-416](https://radicalnotion.ai/cwe/cwe-416) | Use After Free | 13 | | [CWE-119](https://radicalnotion.ai/cwe/cwe-119) | Improper Restriction of Operations within the Bounds of a Memory Buffer | 11 | | [CWE-121](https://radicalnotion.ai/cwe/cwe-121) | Stack-based Buffer Overflow | 8 | | [CWE-79](https://radicalnotion.ai/cwe/cwe-79) | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | 3 | | [CWE-306](https://radicalnotion.ai/cwe/cwe-306) | Missing Authentication for Critical Function | 1 | ## Assigning CNAs | CNA | CVEs | | --- | --- | | [zdi](https://radicalnotion.ai/cna/zdi) | 137 | | [CERT-PL](https://radicalnotion.ai/cna/cert-pl) | 3 | | [VulnCheck](https://radicalnotion.ai/cna/vulncheck) | 1 | ## CVEs by year | Year | CVEs published | | --- | --- | | 2024 | 135 | | 2025 | 5 | | 2026 | 1 | ## Latest CVEs | CVE | Title | Severity | CVSS | EPSS | CISA KEV | Published | | --- | --- | --- | --- | --- | --- | --- | | CVE-2026-23751 | Kofax Capture 6.0.0.0 Unauthenticated File Read/Write & SMB Coercion via .NET Remoting | high | 8.9 | 0.9% | No | 2026-04-23 | | CVE-2024-12547 | Tungsten Automation Power PDF JPF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability | high | 8.8 | 0.9% | No | 2025-02-11 | | CVE-2024-12548 | Tungsten Automation Power PDF JP2 File Parsing Use-After-Free Information Disclosure Vulnerability | low | 3.3 | 0.3% | No | 2025-02-11 | | CVE-2024-12549 | Tungsten Automation Power PDF JP2 File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability | high | 7.8 | 0.4% | No | 2025-02-11 | | CVE-2024-12550 | Tungsten Automation Power PDF JP2 File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability | high | 7.8 | 0.3% | No | 2025-02-11 | | CVE-2024-12551 | Tungsten Automation Power PDF JP2 File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability | high | 7.8 | 0.4% | No | 2025-02-11 | | CVE-2024-7875 | XSS in Tungsten Automation TotalAgility | medium | 5.3 | 0.5% | No | 2024-12-06 | | CVE-2024-7874 | XSS in Tungsten Automation TotalAgility | medium | 5.3 | 0.5% | No | 2024-12-06 | | CVE-2024-9755 | Tungsten Automation Power PDF JP2 File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability | high | 7.8 | 0.3% | No | 2024-11-22 | | CVE-2024-9757 | Tungsten Automation Power PDF JP2 File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability | low | 3.3 | 0.3% | No | 2024-11-22 | | CVE-2024-9761 | Tungsten Automation Power PDF PDF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability | low | 3.3 | 0.3% | No | 2024-11-22 | | CVE-2024-9735 | Tungsten Automation Power PDF JPF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability | high | 7.8 | 0.3% | No | 2024-11-22 | ## Frequently asked questions ### How many CVEs does Tungsten Automation have? Tungsten Automation has 141 published CVE records since 2024, including 6 in the last two years. ### How many Tungsten Automation CVEs are in CISA KEV? None of Tungsten Automation's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog. ### Which Tungsten Automation products have the most CVEs? The Tungsten Automation products with the most published CVEs are Power PDF, TotalAgility, kofax capture, Tungsten Capture (formerly Kofax Capture). ### What are the most common weakness types in Tungsten Automation CVEs? Tungsten Automation's CVEs most often map to these CWE weakness types: CWE-125 (Out-of-bounds Read), CWE-787 (Out-of-bounds Write), CWE-122 (Heap-based Buffer Overflow), CWE-416 (Use After Free). ### Are there public exploits for Tungsten Automation vulnerabilities? Yes — 1 of Tungsten Automation's CVEs have a known public exploit. ### What is the average severity of Tungsten Automation CVEs? The average CVSS base score across Tungsten Automation's scored CVEs is 6.8. ## Related vendors - [axiomatic-systems](https://radicalnotion.ai/vendor/axiomaticsystems) (142 CVEs) - [WPChill](https://radicalnotion.ai/vendor/wpchill) (142 CVEs) - [NEC](https://radicalnotion.ai/vendor/nec) (141 CVEs) - [Kubernetes](https://radicalnotion.ai/vendor/kubernetes) (140 CVEs) - [ruby-lang](https://radicalnotion.ai/vendor/rubylang) (140 CVEs) - [AncoraThemes](https://radicalnotion.ai/vendor/ancorathemes) (140 CVEs) - [anisha](https://radicalnotion.ai/vendor/anisha) (140 CVEs) - [Avaya](https://radicalnotion.ai/vendor/avaya) (140 CVEs) --- Source: [RadicalNotion.AI](https://radicalnotion.ai/vendor/tungsten-automation). Licensed CC BY-NC 4.0; attribute RadicalNotion.AI and link the source page when you reuse this data.