CVE-2015-3073

CVE-2015-3073 この脆弱性により、リモート攻撃者はAdobe Readerの脆弱なインストール環境においてAPI制限を回避することが可能です。この脆弱性を悪用するにはユーザーの操作が必要であり、標的となるユーザーが悪意のあるページにアクセスするか、悪意のあるファイルを開く必要があります。 具体的な欠陥はAFParseDateに存在します。特定のJavaScript命令を含む特別に細工されたPDFを作成することで、JavaScript APIの制限を回避することが可能です。リモート攻撃者はこの脆弱性を悪用して任意のコードを実行する可能性があります。...

CVE-2025-31161

CVE-2025-31161 - CrushFTP 認証バイパスエクスプロイト この Python スクリプトは、CrushFTP の認証バイパス脆弱性である CVE-2025-31161 を悪用し、認証されていない攻撃者が getUserList API エンドポイントからユーザー一覧を取得できるようにします。 機能 CrushAuth および AWS4-HMAC-SHA256 ヘッダーによる認証バイパス ユーザー名の取得と表示（-l オプション） 完全な XML 出力をファイルに保存（-o オプション） オプションのプロキシサポート 使用方法 python3...

CVE-2025-9074

CVE-2025-9074 – Windows/macOS Docker Desktop における完全な Docker エスケープ 📌 説明 Docker Desktop は、内部の Docker Engine API を http://192.168.65.7:2375 で実行中の あらゆる コンテナに公開します。認証もアクセス制御もありません。 エンジン自体がホストのファイルシステムをマウントできるため、コンテナはこの API を呼び出してホストドライブをバインドマウントする新しいコンテナを作成 し、そのコンテナを使って任意のホストファイルを読み書き...

CVE-2026-103281

Ghost npm package 'ghost' versions from 3.23.0 up to, but not including, 6.23.0 expose API keys to users with low-privilege staff accounts. An authenticated low-privilege staff user can read API keys returned by the Admin API, which are intended to be available only to higher-privileged users...

CVE-2026-103275

Ghost 5.42.2 before 6.58.0 contains an information disclosure vulnerability in the Admin API bulk post and page edit and delete endpoints, which accept filters on restricted fields such as authors.password, because of an incomplete fix for CVE-2026-70590. Staff-level attackers can infer other sta...

CVE-2026-103271

Ghost versions from 4.0.0 before 6.63.0 contain a content API vulnerability that allows unauthenticated visitors to access gated post content. Attackers can bypass content restrictions by directly querying the content API to retrieve restricted posts without authentication...

CVE-2026-103272

Ghost versions from 2.10.0 before 6.63.0 contain a staff enumeration vulnerability in the content API that allows unauthenticated attackers to leak user data. Attackers can observe discrepancies in API metadata responses to enumerate staff members and extract sensitive information without...

CVE-2026-103264

Fleet versions before 4.87.0 contain an authentication bypass vulnerability in the device API that accepts hostnames and hardware serials as authentication tokens in addition to device UUIDs. Unauthenticated attackers who know or guess these non-secret identifiers can authenticate as iOS/iPadOS...

CVE-2026-103281 Ghost 3.23.0 before 6.23.0 API Key Exposure via Admin API

Ghost npm package 'ghost' versions from 3.23.0 up to, but not including, 6.23.0 expose API keys to users with low-privilege staff accounts. An authenticated low-privilege staff user can read API keys returned by the Admin API, which are intended to be available only to higher-privileged users...

CVE-2026-103281 Ghost 3.23.0 before 6.23.0 API Key Exposure via Admin API

Ghost npm package 'ghost' versions from 3.23.0 up to, but not including, 6.23.0 expose API keys to users with low-privilege staff accounts. An authenticated low-privilege staff user can read API keys returned by the Admin API, which are intended to be available only to higher-privileged users...

EUVD-2026-90674

Ghost npm package 'ghost' versions from 3.23.0 up to, but not including, 6.23.0 expose API keys to users with low-privilege staff accounts. An authenticated low-privilege staff user can read API keys returned by the Admin API, which are intended to be available only to higher-privileged users...

CVE-2026-103281

The Ghost (npm package 'ghost') content management system versions 3.23.0 up to, but not including, 6.23.0 contains a vulnerability where it exposes API keys to users with low-privilege staff accounts. The root cause allows an authenticated low-privilege staff user to read API keys returned by th...

EUVD-2026-90668

Ghost 5.42.2 before 6.58.0 contains an information disclosure vulnerability in the Admin API bulk post and page edit and delete endpoints, which accept filters on restricted fields such as authors.password, because of an incomplete fix for CVE-2026-70590. Staff-level attackers can infer other sta...

CVE-2026-103275 Ghost 5.42.2 before 6.58.0 Password Hash Disclosure

Ghost 5.42.2 before 6.58.0 contains an information disclosure vulnerability in the Admin API bulk post and page edit and delete endpoints, which accept filters on restricted fields such as authors.password, because of an incomplete fix for CVE-2026-70590. Staff-level attackers can infer other sta...

CVE-2026-103275

The Ghost content management system (versions 5.42.2 before 6.58.0 ) is vulnerable to an information disclosure vulnerability. The issue exists in the Admin API bulk post, and the page edit and delete endpoints, which allow filters on restricted fields like authors.password . This is caused by an...

EUVD-2026-90665

Ghost versions from 2.10.0 before 6.63.0 contain a staff enumeration vulnerability in the content API that allows unauthenticated attackers to leak user data. Attackers can observe discrepancies in API metadata responses to enumerate staff members and extract sensitive information without...

CVE-2026-103272 Ghost 2.10.0 before 6.63.0 Staff Enumeration via Content API

Ghost versions from 2.10.0 before 6.63.0 contain a staff enumeration vulnerability in the content API that allows unauthenticated attackers to leak user data. Attackers can observe discrepancies in API metadata responses to enumerate staff members and extract sensitive information without...

CVE-2026-103272 Ghost 2.10.0 before 6.63.0 Staff Enumeration via Content API

Ghost versions from 2.10.0 before 6.63.0 contain a staff enumeration vulnerability in the content API that allows unauthenticated attackers to leak user data. Attackers can observe discrepancies in API metadata responses to enumerate staff members and extract sensitive information without...

CVE-2026-103272

Ghost versions from 2.10.0 before 6.63.0 are affected by a staff enumeration vulnerability within the content API . This flaw allows unauthenticated attackers to leak sensitive user data by observing discrepancies in API metadata responses . While the vulnerability allows for the enumeration of s...

EUVD-2026-90664

Ghost versions from 4.0.0 before 6.63.0 contain a content API vulnerability that allows unauthenticated visitors to access gated post content. Attackers can bypass content restrictions by directly querying the content API to retrieve restricted posts without authentication...