CVE-2026-105783 Joplin Web Clipper pairing allows cross-origin theft of a permanent API token

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.13, when Joplin Desktop is running with the opt-in Web Clipper server enabled, the server in packages/lib/ClipperServer.ts sends Access-Control-Allow-Origin: and allows an...

CVE-2026-105783 Joplin Web Clipper pairing allows cross-origin theft of a permanent API token

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.13, when Joplin Desktop is running with the opt-in Web Clipper server enabled, the server in packages/lib/ClipperServer.ts sends Access-Control-Allow-Origin: and allows an...

EUVD-2026-92870

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.13, when Joplin Desktop is running with the opt-in Web Clipper server enabled, the server in packages/lib/ClipperServer.ts sends Access-Control-Allow-Origin: and allows an...

CVE-2026-105783

The Joplin note-taking application (prior to version 3.7.13 ) is vulnerable to cross-origin theft of a permanent API token when the optional Web Clipper server is enabled. The root cause is located in packages/lib/ClipperServer.ts, where the server sends Access-Control-Allow-Origin: * and fails t...

CVE-2026-105762 Dify: Unauthenticated Server-Side Request Forgery in /console/api/remote-files/upload endpoint

Dify is an open-source LLM app development platform. Prior to 1.13.0, the /console/api/remote-files/upload endpoint in api/controllers/web/remotefiles.py accepted an attacker-controlled URL without authentication and caused the Dify server to retrieve it. A remote attacker could use the endpoint ...

EUVD-2026-92852

Dify is an open-source LLM app development platform. Prior to 1.16.0, the PUT /console/api/apps/appid/server endpoint in api/controllers/console/app/mcpserver.py used AppMCPServerController.put to retrieve an AppMCPServer by the client-supplied server ID without verifying that the server belonged...

CVE-2026-105761 Dify: IDOR in AppMCPServer PUT Endpoint Allows Modification of Other Apps' MCP Servers

Dify is an open-source LLM app development platform. Prior to 1.16.0, the PUT /console/api/apps/appid/server endpoint in api/controllers/console/app/mcpserver.py used AppMCPServerController.put to retrieve an AppMCPServer by the client-supplied server ID without verifying that the server belonged...

CVE-2026-105761 Dify: IDOR in AppMCPServer PUT Endpoint Allows Modification of Other Apps' MCP Servers

Dify is an open-source LLM app development platform. Prior to 1.16.0, the PUT /console/api/apps/appid/server endpoint in api/controllers/console/app/mcpserver.py used AppMCPServerController.put to retrieve an AppMCPServer by the client-supplied server ID without verifying that the server belonged...

CVE-2026-105761

The open-source LLM app development platform Dify contains an Insecure Direct Object Reference (IDOR) vulnerability in versions prior to 1.16.0 . The root cause is located in api/controllers/console/app/mcp_server.py, where the PUT /console/api/apps//server endpoint uses AppMCPServerController.pu...

CVE-2026-105761 Dify: IDOR in AppMCPServer PUT Endpoint Allows Modification of Other Apps' MCP Servers

Dify is an open-source LLM app development platform. Prior to 1.16.0, the PUT /console/api/apps/appid/server endpoint in api/controllers/console/app/mcpserver.py used AppMCPServerController.put to retrieve an AppMCPServer by the client-supplied server ID without verifying that the server belonged...

CVE-2022-3172

CVE-2022-3172 演示 运行 poc.sh 创建资源 chmod +x poc.sh ./poc.sh 使用 Curl curl https://kubernetes.default.svc/apis/metrics.k8s.io/v2beta1/ -k -H "Authorization: Bearer token"...

VulnerableSpringDataRest

易受攻击的 Spring DataRest 应用 这是一个特意构建的 Spring Data REST 应用程序，用于测试和演示 CVE-2017-8046 漏洞，以及通过 REST API 测试命令注入和远程代码执行所面临的挑战。 它支持 Swagger UI，以便与那些依赖 Swagger 文档进行发现和爬取的工具配合使用，例如 OWASP ZAP（Zed Attack Proxy）的 Swagger 插件。 使用方法 在本地克隆仓库 使用 Maven 构建 运行于 关于该项目在渗透测试练习中如何使用的更多详细信息，请参阅...

EUVD-2026-91120

Langflow: Title Authenticated Remote Code Execution in validatecode via Malicious Decorators Description...

github.com/grafana/grafana: Grafana: Information disclosure via alert rules list API

A flaw was found in Grafana. An authenticated user can query the alert rules list Application Programming Interface API to access alert rules stored in restricted folders they lack permission to read. When access restrictions are evaluated and a user has no readable folders, folder filtering is...

grafana: grafana: Dashboard modification lockout via forged file-provisioning metadata

A flaw was found in Grafana. An authenticated user with Editor permissions can set file-provisioning metadata when creating a dashboard through the dashboard API due to a missing authorization check. Consequently, the dashboard is treated as externally managed by configuration files, preventing...

github.com/grafana/grafana: Grafana: Information disclosure via alert rules list API

A flaw was found in Grafana. An authenticated user can query the alert rules list Application Programming Interface API to access alert rules stored in restricted folders they lack permission to read. When access restrictions are evaluated and a user has no readable folders, folder filtering is...

grafana: grafana: Dashboard modification lockout via forged file-provisioning metadata

A flaw was found in Grafana. An authenticated user with Editor permissions can set file-provisioning metadata when creating a dashboard through the dashboard API due to a missing authorization check. Consequently, the dashboard is treated as externally managed by configuration files, preventing...

CVE-2025-81110-PoC

CVE-2025-81110-PoC Gogs中PutContents API对符号链接处理不当，导致本地代码执行。 本仓库包含针对Gogs 0.13.0之前版本中一个严重漏洞的专业级利用程序。该利用程序利用了一个逻辑缺陷：Gogs API在更新仓库内容时未能验证文件类型。通过注入指向服务器端Git钩子（pre-receive）的符号链接，认证用户可以恶意脚本覆盖钩子的内容。随后的Git推送操作将触发该脚本在运行Gogs服务的用户（通常是root）上下文中执行。 符号链接注入：攻击者推送指向内部仓库钩子（例如...

CVE-2025-9074

CVE-2025-9074 – Docker Desktop Windows 容器→主机写入（通过暴露的引擎 API） 作者： w01f 状态： 概念验证（仅用于教育/授权测试） 概述 本项目演示了 CVE-2025-9074 的概念验证，该漏洞涉及 Docker Desktop for Windows 某些版本中的配置错误/暴露问题——Docker 引擎 HTTP API （位于 http://192.168.65.7:2375）可从容器内访问（有时也可通过 SSRF 访问），使攻击者能够创建一个带有 bind mount 的容器，挂载到 Windows 主机驱动器，并向主机写入文件。...

CVE-2026-11991-Exploit

CVE-2026-11991 — FlowForms 未授权表单发布 已认证（贡献者及以上）授权绕过，可在 FlowForms ≤ 1.1.1 中发布任意草稿表单 漏洞概述 属性| 值 ---|--- CVE ID| CVE-2026-11991 CVSS 评分| 6.2 — 中危 CVSS 向量| AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N/E:H/RL:O/RC:C CWE| CWE-639（通过用户可控密钥绕过授权） 产品| FlowForms — WordPress 对话式表单构建插件 受影响版本| 所有版本，最高至 1.1.1 修复版本| 1.1.2...