EUVD-2026-95024

pH7Builder pH7 Social Dating CMS before 18.5.0 contains an improper authorization vulnerability in the note module delete action that allows authenticated members to delete other members' note comments and categories. Attackers can submit another member's note ID in the POST id parameter to remov...

CVE-2026-107637 pH7Builder before 18.5.0 Improper Authorization via Note Module delete() Action

pH7Builder pH7 Social Dating CMS before 18.5.0 contains an improper authorization vulnerability in the note module delete action that allows authenticated members to delete other members' note comments and categories. Attackers can submit another member's note ID in the POST id parameter to remov...

Rust_CVE-2025-55182

CVE-2025-55182 Strumento di sfruttamento delle vulnerabilità versione Rust Panoramica del progetto Questo progetto è uno strumento di ricerca sulla sicurezza sviluppato in Rust, mirato alla vulnerabilità di esecuzione remota di codice RCE presente in [email protected]. La vulnerabilità...

CVE-2025-55182

POC per CVE-2025-55182 Nextjs Un piccolo repository contenente: test-app/: un'applicazione di test Next.js 16 React 19 che utilizza l'App Router. exploit.js: uno script di prova locale utilizzato per dimostrare e testare il comportamento del server riguardo alla gestione multipart/Next-Action...

name_reverser

== Benvenuto in Rails Rails è un framework per applicazioni web che include tutto il necessario per creare applicazioni web basate su database secondo il pattern Model-View-Control. Questo pattern divide la view chiamata anche presentazione in template "stupidi" che sono principalmente responsabi...

CVE-2024-10958-WPPA-Exploit

WordPress WP Photo Album Plus Arbitrary Shortcode Execution CVE-2024-10958 Codice PoC per la vulnerabilità di esecuzione arbitraria di shortcode non autenticata presente nel plugin WordPress WP Photo Album Plus. Dettagli Versioni interessate: = 8.8.08.007 Punteggio CVSS: 7.3 Alto Tipo di...

CVE-2026-107445

A flaw was found in Katello where the Flatpak Remote Repositories API does not properly enforce authorization when accessing a flatpak remote repository by identifier. An authenticated user with permission to view flatpak remotes in one organization may be able to access flatpak remote repository...

EUVD-2026-94693

A flaw was found in Katello where the Flatpak Remote Repositories API does not properly enforce authorization when accessing a flatpak remote repository by identifier. An authenticated user with permission to view flatpak remotes in one organization may be able to access flatpak remote repository...

Debian dla-4829 : rails - security update

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4829 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-4829-1 [email protected]...

PT-2026-107791

A flaw was found in Katello where the Flatpak Remote Repositories API does not properly enforce authorization when accessing a flatpak remote repository by identifier. An authenticated user with permission to view flatpak remotes in one organization may be able to access flatpak remote repository...

PT-2026-107996

pH7Builder pH7 Social Dating CMS before 18.5.0 contains an improper authorization vulnerability in the note module delete action that allows authenticated members to delete other members' note comments and categories. Attackers can submit another member's note ID in the POST id parameter to remov...

Why API Security Belongs in ECB Cyber Action Plans

Discover how securing shadow and zombie APIs helps banks meet the ECB cyber action plan mandates, improve posture, and mitigate AI-enabled threats...

CVE-2025-66478

1 POST / HTTP/1.1 Host: localhost:3000 User-Agent: Mozilla/5.0 Windows NT 10.0; Win64; x64 AppleWebKit/537.36 KHTML, like Gecko Chrome/60.0.3112.113 Safari/537.36 Assetnote/1.0.0 Next-Action: x X-Nextjs-Request-Id: b5dce965 Content-Type: multipart/form-data;...

Backstage: Scaffolder action input authorization bypass

Impact An authenticated user with access to affected Scaffolder templates could bypass configured action restrictions. Depending on integration credentials, this could grant unauthorized access to repositories and related source-control resources. Patches Patched in...

CVE-2026-92393

Apache YuniKorn 1.9.0 and earlier does not implement label and user annotation checks for workload UPDATE action bypassing all checks. Workloads in YuniKorn are defined as the following Kubernetes objects: "deployments", "replicasets", "statefulsets", "daemonsets", "jobs", "cronjobs". The CREATE...

EUVD-2026-94253

Apache YuniKorn 1.9.0 and earlier does not implement label and user annotation checks for workload UPDATE action bypassing all checks. Workloads in YuniKorn are defined as the following Kubernetes objects: "deployments", "replicasets", "statefulsets", "daemonsets", "jobs", "cronjobs". The CREATE...

Strutscli

StrutsExp Utilizzo strutsexp http://example.com/index.action...

WordPress Integration for Epos Now and WooCommerce plugin 4.6.0-4.11.1 - Unauthenticated Action Scheduler Queue Disclosure vulnerability

Unauthenticated Action Scheduler Queue Disclosure vulnerability discovered by Raphael P. Cigana in WordPress Plugin Integration for Epos Now and WooCommerce versions 4.6.0-4.11.1...

kit-policy

kit-policy Un framework di autorizzazione flessibile e componibile per Kit, ispirato a Action Policy di Ruby. TOC File File| Descrizione ---|--- .editorconfig| Configurazione di formattazione dell'editor .gitignore| Regole Git ignore per artefatti di build e dipendenze .tool-versions| Versioni...

CVE-2026-103323

The Integration for Epos Now and WooCommerce WordPress plugin (versions 4.6.0-4.11.1 ) is vulnerable to an unauthenticated Action Scheduler Queue Disclosure vulnerability. The root cause is a missing authorization check on one of the plugin's REST endpoints. This allows unauthenticated users to r...