CVE-2024-36401-GeoServer-RCE

RCE-уязвимость в GeoServer CVE-2024-36401 - скрипт обнаружения CVE-2024-36401 — это критическая уязвимость безопасности, затрагивающая GeoServer, сервер с открытым исходным кодом для обмена геопространственными данными, и GeoTools, библиотеку Java с открытым исходным кодом, предоставляющую...

VulnerableSpringDataRest

Уязвимое приложение Spring DataRest Это намеренно уязвимое приложение Spring Data REST для тестирования и демонстрации уязвимости CVE-2017-8046 и проблем тестирования внедрения команд и удаленного выполнения кода через REST API. Оно поддерживает Swagger UI для использования с инструментами, где...

EUVD-2026-81596

vm2: Sandboxed code can read and write host-realm memory via Node's shared Buffer pool...

grafana: grafana: Information disclosure via unrevoked access tokens in paused shared dashboards

A flaw was found in Grafana. This vulnerability allows information disclosure because pausing a shared dashboard fails to revoke access tokens for endpoints serving initialization data. An unauthenticated remote attacker possessing the link to a paused dashboard can exploit this flaw to retrieve...

CVE-2026-93528

📌 CVE-2026-93528: Неавторизованное раскрытие данных заказов в NP Quote Request for WooCommerce • Тип уязвимости: Раскрытие конфиденциальных данных CWE-200 • Затронутое ПО: woo-rfq-for-woocommerce 2.4.16 • Первоначальный исследователь: Murad Islamzada • Производитель: Neah Plugins Cyrus 1. Обзор и...

grafana: grafana: Information disclosure via unrevoked access tokens in paused shared dashboards

A flaw was found in Grafana. This vulnerability allows information disclosure because pausing a shared dashboard fails to revoke access tokens for endpoints serving initialization data. An unauthenticated remote attacker possessing the link to a paused dashboard can exploit this flaw to retrieve...

CVE-2026-21589

This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center. Crowd Data Center, Crucible and Fisheye. This Arbitrary File Access vulnerability allows an unauthenticated attacker to access specific fil...

CVE-2026-21589

This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center. Crowd Data Center, Crucible and Fisheye. This Arbitrary File Access vulnerability allows an unauthenticated attacker to access specific fil...

CVE-2026-21589

This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center. Crowd Data Center, Crucible and Fisheye. This Arbitrary File Access vulnerability allows an unauthenticated attacker to access specific fil...

CVE-2026-21589

An Arbitrary File Access vulnerability exists in multiple Atlassian products, including Bitbucket , Confluence , Jira Software , Jira Service Management , Bamboo , Crowd , Crucible , and Fisheye . This flaw allows an unauthenticated remote attacker to access specific files within the web applicat...

zygote-CVE-2024-31317

Zygote Toolkit - CVE-2024-31317 Это набор инструментов, использующий CVE-2024-31317 для извлечения приватных данных приложений через ADB или запуска оболочки с UID приложения. Уязвимость затрагивает Android версий с 9 по 14 с уровнем патча безопасности 2024-06-01 или ниже. Матрица поддержки...

CVE-2026-103629

An integer overflow flaw was found in the Skia component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/562038679...

CVE-2026-103621

An integer overflow flaw was found in the Compositing component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/556268833...

BL00DYM4RY

🎭 BloodyMary — симулятор троянского фишинга 📋 Описание BloodyMary — это образовательный инструмент троян-вирус или программа-вымогатель для обучения специалистов по кибербезопасности, имитирующий реалистичные фишинговые атаки с элементами социальной инженерии. Этот проект создан для повышения...

CVE-2026-97257

Deserialization of Untrusted Data vulnerability in PressTigers Simple Event Planner simple-event-planner allows Object Injection.This issue affects Simple Event Planner: from n/a through 1.5.7...

CVE-2026-93617

Deserialization of Untrusted Data vulnerability in WP Sunshine Sunshine Photo Cart sunshine-photo-cart allows Object Injection.This issue affects Sunshine Photo Cart: from n/a through 3.7.1...

CVE-2026-71298

A flaw was found in maestro. A remote attacker could exploit a SQL injection vulnerability in the orderBy query parameter of its REST API list endpoints. This flaw, which does not require authentication, allows for read-only blind extraction of data from the database...

CVE-2026-71299

A flaw was found in Maestro. Its REST API write endpoints were registered without proper authentication middleware. This allows a remote attacker to perform unauthorized write operations, such as creating, modifying, or deleting consumers and resource bundles. This could lead to data integrity...

CVE-2026-71297

A flaw was found in the maestro gRPC broker. This vulnerability allows a remote attacker, with a valid client certificate, to bypass authentication. This bypass enables the attacker to subscribe to other consumers' event streams, leading to unauthorized information disclosure, or to publish forge...

CVE-2026-105696

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the get-page RPC accepts a share-link permission object with blanket read access but does not verify that the caller-selected page-id belongs to the link's authorized pages set. An attacker with both a valid share link and...