CVE-2026-106579 ImageMagick: Policy Bypass when using coder as the domain.

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31 and 6.9.13-56, a crafted image can bypass an ImageMagick security policy that uses coder as its domain, potentially allowing data prohibited by the policy to be read. This issue is fix...

EUVD-2026-94405

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31 and 6.9.13-56, a crafted image can bypass an ImageMagick security policy that uses coder as its domain, potentially allowing data prohibited by the policy to be read. This issue is fix...

CVE-2026-106579

The ImageMagick image manipulation software is vulnerable to a policy bypass in versions prior to 7.1.2-31 and 6.9.13-56 . A crafted image can bypass security policies using coder as the domain, potentially allowing the unauthorized reading of data prohibited by the policy. The issue is addressed...

CVE-2026-107278 MISP Object Sync Drops Objects and Attributes When Description Is Empty

MISP contains a validation flaw in its object synchronization logic. When a MISP Object is created without a description, it is stored correctly on the originating instance. However, when that object is replicated to another MISP instance via the sync mechanism, the receiving instance's validatio...

CVE-2026-107278

The MISP platform contains a validation flaw in its object synchronization logic affecting versions

EUVD-2026-94400

MISP contains a validation flaw in its object synchronization logic. When a MISP Object is created without a description, it is stored correctly on the originating instance. However, when that object is replicated to another MISP instance via the sync mechanism, the receiving instance's validatio...

CVE-2026-107278 MISP Object Sync Drops Objects and Attributes When Description Is Empty

MISP contains a validation flaw in its object synchronization logic. When a MISP Object is created without a description, it is stored correctly on the originating instance. However, when that object is replicated to another MISP instance via the sync mechanism, the receiving instance's validatio...

CVE-2026-107278 MISP Object Sync Drops Objects and Attributes When Description Is Empty

MISP contains a validation flaw in its object synchronization logic. When a MISP Object is created without a description, it is stored correctly on the originating instance. However, when that object is replicated to another MISP instance via the sync mechanism, the receiving instance's validatio...

cve-2025-25257

CVE-2025-25257 - 実験環境 実験アーキテクチャ 環境はFortiWebの脆弱なコンポーネントをシミュレートします 脆弱なエンドポイント : /api/system/fabric/config インジェクションベクター : HTTP Authorization: Bearer ヘッダー メカニズム : 直接SQL連結 Pythonのf-string 認証 : なし 完全バイパス データベース : SQLite デモ用 cve-2025-25257 ├── Dockerfile ├── docker-compose.yml ├── requirements.txt ├──...

immich-exfiltration-demo

Демонстрация кибербезопасности: Immich exfiltration CVE-2026-35455 Демонстрация концепции кибербезопасности для CVE-2026-35455, демонстрирующая автоматическую генерацию API-ключей и утечку данных, ведущие к полному захвату учётной записи и постоянному несанкционированному доступу. Узнайте больше:...

CVE-2026-80902

A flaw was found in the Linux kernel's sun6i-dma component. When Direct Memory Access DMA transfers are terminated, active descriptors are not correctly reclaimed. This issue leads to a permanent memory leak and can also cause corruption of internal data structures within the kernel...

EUVD-2026-94381

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32, delegate symlink cleanup does not check the MAGICKSHREDPASSES environment variable, allowing a local privileged workflow to overwrite a file with random data. This issue is fixed in...

CVE-2026-106563

Backstage is an open framework for building developer portals. Prior to 0.21.8, the @backstage/plugin-kubernetes-backend package is affected by improper entity validation in deprecated kubernetes services endpoint. An authenticated user with Kubernetes read permissions could access Kubernetes...

How the Wiz Red Agent caught a Fortune 500 firm’s data exposure (that other tools missed)

Traditional DSPM and classification tools scan from the inside out. Thinking like an attacker, the Red Agent found a public page exposing sensitive data in minutes...

CVE-2025-39247

CVE-2025-39247 Цель: HikCentral Professional HCMP, центральный сервер VMS CVE: CVE-2025-39247 — Уязвимость контроля доступа CVSS 3.1: 8.6 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N Затрагиваемые версии: V2.3.1 – V2.6.2 и V3.0.0 Исправлено в: V2.6.3 / V3.0.1 / Fix-Pack CVE-2025-39247 Раскрыто: 2025-08-28...

CVE-2024-10220-demo

이 저장소에는 README가 없습니다...

CVE-2026-46438

wger is a free, open-source workout and fitness manager. Prior to version 2.6, an authenticated attacker can inject arbitrary workout log entries into any other user's SlotEntry by supplying the victim's slotentry ID in a POST /api/v2/workoutlog/ request. The slotentry foreign key is not included...

GO-2026-6662 SiYuan: /history/*path and /repo/diff/*path potentially exposing historical snapshots of data/.siyuan/publishAccess.json and data/templates/* in github.com/siyuan-note/siyuan/kernel

SiYuan: /history/path and /repo/diff/path potentially exposing historical snapshots of data/.siyuan/publishAccess.json and data/templates/ in github.com/siyuan-note/siyuan/kernel...

CVE-2026-46438 wger: Cross-User Data Corruption via Missing Ownership Check on WorkoutLog.slot_entry

wger is a free, open-source workout and fitness manager. Prior to version 2.6, an authenticated attacker can inject arbitrary workout log entries into any other user's SlotEntry by supplying the victim's slotentry ID in a POST /api/v2/workoutlog/ request. The slotentry foreign key is not included...

CVE-2026-46438 wger: Cross-User Data Corruption via Missing Ownership Check on WorkoutLog.slot_entry

wger is a free, open-source workout and fitness manager. Prior to version 2.6, an authenticated attacker can inject arbitrary workout log entries into any other user's SlotEntry by supplying the victim's slotentry ID in a POST /api/v2/workoutlog/ request. The slotentry foreign key is not included...