211938 matches found
javascript-deobfuscator
javascript-deobfuscator Deobfuscator for javascript-obfuscator 5.x output. Feed it obfuscated JS, get back readable JS that runs the same. Setup Requires Node 18+. git clone https://github.com/lolcaken/javascript-deobfuscator.git cd javascript-deobfuscator npm install npm run build Usage...
CVE-2026-104875
Ente provides end-to-end encrypted cloud services and security tools. Prior to server image 2026.07.09, the POST /emergency-contacts/approve-recovery endpoint authorized approval using a client-supplied userID and updated an emergency recovery session using only its client-supplied recovery-sessi...
CVE-2026-102204
Improper link resolution before file access 'link following' in Microsoft Defender for Endpoint allows an authorized attacker to elevate privileges locally...
CVE-2026-100202
Use after free in Windows Message Queuing Queue Manager allows an unauthorized attacker to execute code over a network...
Improper Validation of Integrity Check Value
Overview Affected versions of this package are vulnerable to Improper Validation of Integrity Check Value in the Get method of the manifests type in registry/client/repository.go, which reads the response body and passes it to distribution.UnmarshalManifest without computing digest.FromBytesbody...
Improper Validation of Integrity Check Value
Overview Affected versions of this package are vulnerable to Improper Validation of Integrity Check Value in the Get method of the manifests type in registry/client/repository.go, which reads the response body and passes it to distribution.UnmarshalManifest without computing digest.FromBytesbody...
CVE-2026-56826 Shopper: Missing function-level authorization on Settings tax/zone/shipping Livewire components allows a low-privileged user to delete commerce configuration
Shopper is a Headless e-commerce Admin Panel. From 2.0.0 until 2.9.2, authenticated users who could reach the Settings pages with only accesssetting could directly invoke destructive actions through the Livewire endpoint because...
CVE-2026-56826 Shopper: Missing function-level authorization on Settings tax/zone/shipping Livewire components allows a low-privileged user to delete commerce configuration
Shopper is a Headless e-commerce Admin Panel. From 2.0.0 until 2.9.2, authenticated users who could reach the Settings pages with only accesssetting could directly invoke destructive actions through the Livewire endpoint because...
EUVD-2026-100520
Shopper is a Headless e-commerce Admin Panel. From 2.0.0 until 2.9.2, authenticated users who could reach the Settings pages with only accesssetting could directly invoke destructive actions through the Livewire endpoint because...
CVE-2026-56826 Shopper: Missing function-level authorization on Settings tax/zone/shipping Livewire components allows a low-privileged user to delete commerce configuration
Shopper is a Headless e-commerce Admin Panel. From 2.0.0 until 2.9.2, authenticated users who could reach the Settings pages with only accesssetting could directly invoke destructive actions through the Livewire endpoint because...
CVE-2026-56826
The Shopper Headless e-commerce Admin Panel (versions 2.0.0 through 2.9.2 ) is vulnerable to missing function-level authorization. Four Livewire components in the Settings area—specifically ZoneShippingOptions, Zones izDetail, Taxes izDetail, and Taxes izTaxRates—perform destructive delete and ed...
CVE-2026-104875
Ente provides end-to-end encrypted cloud services and security tools. Prior to server image 2026.07.09, the POST /emergency-contacts/approve-recovery endpoint authorized approval using a client-supplied userID and updated an emergency recovery session using only its client-supplied recovery-sessi...
CVE-2026-104875
The Ente cloud services platform is vulnerable to an authorization bypass in the POST /emergency-contacts/approve-recovery endpoint prior to server image 2026.07.09 . The root cause is an insufficiently scoped update pattern where the system authorized approval using a client-supplied userID and ...
EUVD-2026-100469
Ente provides end-to-end encrypted cloud services and security tools. Prior to server image 2026.07.09, the POST /emergency-contacts/approve-recovery endpoint authorized approval using a client-supplied userID and updated an emergency recovery session using only its client-supplied recovery-sessi...
CVE-2026-104875 Ente: Accepted emergency contact can bypass the recovery notice period
Ente provides end-to-end encrypted cloud services and security tools. Prior to server image 2026.07.09, the POST /emergency-contacts/approve-recovery endpoint authorized approval using a client-supplied userID and updated an emergency recovery session using only its client-supplied recovery-sessi...
CVE-2026-104875 Ente: Accepted emergency contact can bypass the recovery notice period
Ente provides end-to-end encrypted cloud services and security tools. Prior to server image 2026.07.09, the POST /emergency-contacts/approve-recovery endpoint authorized approval using a client-supplied userID and updated an emergency recovery session using only its client-supplied recovery-sessi...
CVE-2026-110255 Dockhand before 1.0.43 SSRF via /api/templates/compose Endpoint
Finsys Dockhand before 1.0.43 contains a response-disclosing server-side request forgery vulnerability that allows authenticated users to make the server fetch arbitrary URLs by supplying repository URL and stackfile values. Attackers can send stack templates pointing to internal services or clou...
CVE-2026-110255
Finsys Dockhand before 1.0.43 contains a response-disclosing server-side request forgery vulnerability that allows authenticated users to make the server fetch arbitrary URLs by supplying repository URL and stackfile values. Attackers can send stack templates pointing to internal services or clou...
CVE-2026-110255 Dockhand before 1.0.43 SSRF via /api/templates/compose Endpoint
Finsys Dockhand before 1.0.43 contains a response-disclosing server-side request forgery vulnerability that allows authenticated users to make the server fetch arbitrary URLs by supplying repository URL and stackfile values. Attackers can send stack templates pointing to internal services or clou...
EUVD-2026-100467
Finsys Dockhand before 1.0.43 contains a response-disclosing server-side request forgery vulnerability that allows authenticated users to make the server fetch arbitrary URLs by supplying repository URL and stackfile values. Attackers can send stack templates pointing to internal services or clou...