CVE-2026-33657

CVE-2026-33657 - Inyección de HTML almacenado en notificaciones por correo electrónico de EspoCRM 9.3.3 Prueba de concepto autenticada para la inyección de HTML almacenado en las notificaciones por correo electrónico de EspoCRM 9.3.3. Resumen EspoCRM 9.3.3 renderiza los correos de notificación de...

CVE-2026-107637

pH7Builder pH7 Social Dating CMS before 18.5.0 contains an improper authorization vulnerability in the note module delete action that allows authenticated members to delete other members' note comments and categories. Attackers can submit another member's note ID in the POST id parameter to remov...

EUVD-2026-95024

pH7Builder pH7 Social Dating CMS before 18.5.0 contains an improper authorization vulnerability in the note module delete action that allows authenticated members to delete other members' note comments and categories. Attackers can submit another member's note ID in the POST id parameter to remov...

CVE-2026-107637 pH7Builder before 18.5.0 Improper Authorization via Note Module delete() Action

pH7Builder pH7 Social Dating CMS before 18.5.0 contains an improper authorization vulnerability in the note module delete action that allows authenticated members to delete other members' note comments and categories. Attackers can submit another member's note ID in the POST id parameter to remov...

CVE-2026-107637

pH7Builder (pH7 Social Dating CMS) versions prior to 18.5.0 are vulnerable to an improper authorization flaw within the note module delete() action . The root cause is a lack of profile ID checks in the database queries, which allows authenticated members to delete note comments and categories be...

CVE-2026-107637 pH7Builder before 18.5.0 Improper Authorization via Note Module delete() Action

pH7Builder pH7 Social Dating CMS before 18.5.0 contains an improper authorization vulnerability in the note module delete action that allows authenticated members to delete other members' note comments and categories. Attackers can submit another member's note ID in the POST id parameter to remov...

CVE-2026-107637 pH7Builder before 18.5.0 Improper Authorization via Note Module delete() Action

pH7Builder pH7 Social Dating CMS before 18.5.0 contains an improper authorization vulnerability in the note module delete action that allows authenticated members to delete other members' note comments and categories. Attackers can submit another member's note ID in the POST id parameter to remov...

CVE-2011-2523

你好，黑客 我们看到你做了什么。赚了一大笔钱，对吧？ 你的 GitHub 仓库已被安全加密 请向以下地址发送 0.01 BTC 以解密你的仓库 bc1qhte7j77f8uxep66w5k57kzqaqcu8ldvwe7g5gm...

CVE-2022-39802

3242933 – CVE-2022-39802 SAP Manufacturing Execution 中的文件路径遍历漏洞 基本信息 风险：严重 受影响版本： SAP MFG EXECUTION CORE 15.1 SAP MFG EXECUTION CORE 15.2 SAP MFG EXECUTION CORE 15.3 厂商 URL：https://sap.com 漏洞：文件路径遍历漏洞 报告时间：2022 年 9 月 公开公告日期：2022 年 10 月 12 日 参考：SAP Security Note 3242933 作者：RedRays R&D 描述 公告信息...

PT-2026-107996

pH7Builder pH7 Social Dating CMS before 18.5.0 contains an improper authorization vulnerability in the note module delete action that allows authenticated members to delete other members' note comments and categories. Attackers can submit another member's note ID in the POST id parameter to remov...

GO-2026-6663 SiYuan: TLS Private Keys Readable via getFile (Incomplete Blocklist) in github.com/siyuan-note/siyuan/kernel

SiYuan: TLS Private Keys Readable via getFile Incomplete Blocklist in github.com/siyuan-note/siyuan/kernel...

GO-2026-6654 SiYuan: 17 block metadata/content endpoints in kernel/api/block.go have zero publish-access filtering, reachable by anonymous publish-mode readers in github.com/siyuan-note/siyuan/kernel

SiYuan: 17 block metadata/content endpoints in kernel/api/block.go have zero publish-access filtering, reachable by anonymous publish-mode readers in github.com/siyuan-note/siyuan/kernel...

GO-2026-6635 SiYuan: The reference filter for getRefIDs checks visibility but not the password tier, disclosing that password-protected documents reference a given block in github.com/siyuan-note/siyuan/kernel

SiYuan: The reference filter for getRefIDs checks visibility but not the password tier, disclosing that password-protected documents reference a given block in github.com/siyuan-note/siyuan/kernel...

GO-2026-6626 SiYuan: getUniqueFilename passes an unvalidated client-supplied path to the filesystem, giving anonymous readers an existence oracle over the entire host filesystem in github.com/siyuan-note/siyuan/kernel

SiYuan: getUniqueFilename passes an unvalidated client-supplied path to the filesystem, giving anonymous readers an existence oracle over the entire host filesystem in github.com/siyuan-note/siyuan/kernel...

Keycloak 26.7.3 <= 26.8.0 User Session Note Mapper Access Token Exposure (CVE-2026-105302)

The version of Keycloak installed on the remote host is 26.7.3 through 26.8.0. It is, therefore, affected by a vulnerability where a User Session Note protocol mapper can expose upstream identity provider access tokens to managed clients, allowing a client to obtain a token it was not intended to...

CVE-2026-105302

A flaw was found in the User Session Note mapper of the Keycloak identity and access management solution. The issue occurs because the mapper does not validate whether a requested session note contains sensitive internal credentials, such as federated access tokens from external identity provider...

EUVD-2026-92257

A flaw was found in the User Session Note mapper of the Keycloak identity and access management solution. The issue occurs because the mapper does not validate whether a requested session note contains sensitive internal credentials, such as federated access tokens from external identity provider...

CVE-2026-105302

A flaw in the User Session Note mapper of the Keycloak identity and access management solution allows for the exposure of sensitive internal credentials. The mapper fails to validate if a requested session note contains federated access tokens from external identity providers. Consequently, a del...

CVE-2026-105302 Keycloak-services: keycloak-services: user session note mapper exposes upstream idp access tokens

A flaw was found in the User Session Note mapper of the Keycloak identity and access management solution. The issue occurs because the mapper does not validate whether a requested session note contains sensitive internal credentials, such as federated access tokens from external identity provider...

CVE-2026-105302 Keycloak-services: keycloak-services: user session note mapper exposes upstream idp access tokens

A flaw was found in the User Session Note mapper of the Keycloak identity and access management solution. The issue occurs because the mapper does not validate whether a requested session note contains sensitive internal credentials, such as federated access tokens from external identity provider...