NextPass

🚀 NextPass गोपनीयता-केंद्रित AI पासवर्ड शब्दकोश जनरेटर। Next Pass एक विशेष पासवर्ड शब्दकोश जनरेटर है जो पासवर्ड उत्पन्न करने के लिए नियम-आधारित तर्क और बड़े भाषा मॉडल दोनों का उपयोग करता है। सुरक्षा शोधकर्ताओं के लिए डिज़ाइन किया गया, यह चलते-फिरते पासवर्ड शब्दकोश उत्पन्न करने के लिए ऑफ़लाइन जनरे...

wp2shell

wp2shell पूर्व-प्रमाणीकरण रिमोट कोड निष्पादन WordPress कोर के खिलाफ। CVE-2026-60137 WPQuery के authornotin / authorexclude पैरामीटर में SQLi को CVE-2026-63030 REST API बैच-रूट कन्फ्यूजन के साथ जोड़ता है अप्रमाणित RCE के लिए। प्रभावित संस्करण रेंज| स्थिति ---|--- = 6.8.5| प्रभावित नहीं कोई बैच...

CVE-2026-78412

Velociraptor's WatchEvent gRPC API can specify the OrgId of the org from which events should be streamed. The server checks the API permissions against the caller's Org instead of the requested Org. This allows a user with API access in one org to read events from another org for which they have ...

CVE-2026-104968

Plane is an open-source project management tool. Prior to 1.4.0, GET /api/workspaces/slug/entity-search/?querytype=usermention returns workspace-member display names, UUIDs, and avatar URLs to any authenticated user who knows the workspace slug, even when the caller is not a workspace member. The...

CVE-2026-104966

Plane is an open-source project management tool. Prior to 1.4.0, two endpoint families fail to verify that nested resource identifiers belong to the workspace and project named in the URL. An authenticated user can read or modify estimates from another workspace through PATCH...

CVE-2026-104960

Plane is an open-source project management tool. Prior to 1.4.0, Plane exposes the workspace-scoped GET /api/assets/v2/workspaces/workspaceslug/download/assetid/ endpoint for project-bound FileAsset objects without enforcing access to the asset's owning project. An authenticated user who belongs ...

CVE-2026-104962

Plane is an open-source project management tool. Prior to 1.4.0, GET /api/v1/workspaces/slug/projects/projectid/members/ returns the complete project-member roster, including each member's email address, first and last name, display name, avatar, and role. ProjectMemberPermission gates the...

CVE-2026-104893

Plane is an open-source project management tool. Prior to 1.4.0, GET /api/users/api-tokens/ allows an authenticated user to retrieve API-token records, while PATCH /api/users/api-tokens/tokenid/ allows the user to modify the token's allowedratelimit field without server-side validation or a maxim...

CVE-2025-8110-gogs-poc

CVE-2025-8110 — Gogs मनमानी फ़ाइल लेखन PoC Gogs में एक प्रमाणित मनमानी फ़ाइल लेखन के लिए प्रूफ-ऑफ-कॉन्सेप्ट। रिपॉजिटरी के बाहर इशारा करने वाली एक सिम्बोलिक लिंक वाले रिपॉजिटरी को पुश करके और फिर API के माध्यम से उस लिंक की सामग्री को अपडेट करके, एक प्रमाणित उपयोगकर्ता Gogs चलाने वाले खाते के...

CVE-2026-57811

CVE-2026-57811 — Realtyna Organic IDX + WPL Real Estate ثغرة تنفيذ الأوامر عن بُعد غير مصادق عليها -red.svg ثغرة حرجة لتنفيذ الأوامر عن بُعد غير مصادق عليها CVSS 10.0 — Realtyna Organic IDX + WPL Real Estate ≤ 5.2.0 تستغل هذه الأداة CVE-2026-57811 ، وهي ثغرة حرجة في إضافة ووردبريس Realtyna Organi...

CVE-2026-104968 Plane: Cross-workspace member enumeration via /api/workspaces/{slug}/entity-search/

Plane is an open-source project management tool. Prior to 1.4.0, GET /api/workspaces/slug/entity-search/?querytype=usermention returns workspace-member display names, UUIDs, and avatar URLs to any authenticated user who knows the workspace slug, even when the caller is not a workspace member. The...

CVE-2026-104968 Plane: Cross-workspace member enumeration via /api/workspaces/{slug}/entity-search/

Plane is an open-source project management tool. Prior to 1.4.0, GET /api/workspaces/slug/entity-search/?querytype=usermention returns workspace-member display names, UUIDs, and avatar URLs to any authenticated user who knows the workspace slug, even when the caller is not a workspace member. The...

EUVD-2026-92488

Plane is an open-source project management tool. Prior to 1.4.0, two endpoint families fail to verify that nested resource identifiers belong to the workspace and project named in the URL. An authenticated user can read or modify estimates from another workspace through PATCH...

WordPress WooCommerce Multivendor Marketplace – REST API plugin <= 1.6.3 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Lee chul woong in WordPress Plugin WooCommerce Multivendor Marketplace – REST API versions = 1.6.3...

CVE-2026-78412

Velociraptor's WatchEvent gRPC API is vulnerable to an authorization bypass (CWE-639). The server incorrectly validates API permissions against the caller's organization rather than the requested organization's OrgId . This flaw allows an authenticated user with API access in one organization to ...

CVE-2026-78412 WatchEvent API streams another organization's live events

Velociraptor's WatchEvent gRPC API can specify the OrgId of the org from which events should be streamed. The server checks the API permissions against the caller's Org instead of the requested Org. This allows a user with API access in one org to read events from another org for which they have ...

EUVD-2026-92485

Velociraptor's WatchEvent gRPC API can specify the OrgId of the org from which events should be streamed. The server checks the API permissions against the caller's Org instead of the requested Org. This allows a user with API access in one org to read events from another org for which they have ...

CVE-2026-78412 WatchEvent API streams another organization's live events

Velociraptor's WatchEvent gRPC API can specify the OrgId of the org from which events should be streamed. The server checks the API permissions against the caller's Org instead of the requested Org. This allows a user with API access in one org to read events from another org for which they have ...

EUVD-2026-92483

Plane is an open-source project management tool. Prior to 1.4.0, GET /api/v1/workspaces/slug/projects/projectid/members/ returns the complete project-member roster, including each member's email address, first and last name, display name, avatar, and role. ProjectMemberPermission gates the...

CVE-2026-104960 Plane: Authorization bypass in workspace-scoped asset download endpoint exposes secret project file assets to non-project workspace users

Plane is an open-source project management tool. Prior to 1.4.0, Plane exposes the workspace-scoped GET /api/assets/v2/workspaces/workspaceslug/download/assetid/ endpoint for project-bound FileAsset objects without enforcing access to the asset's owning project. An authenticated user who belongs ...