CVE-2026-91181

Mattermost versions 11.9.x = 11.9.0, 11.8.x = 11.8.4, 11.7.x = 11.7.7, 10.11.x = 10.11.22 Fail to sanitize Team objects returned by the data retention teams endpoint which allows an authenticated user holding only the read-only Data Retention Policy permission to obtain a private team's secret...

CVE-2026-65352

An information disclosure issue was addressed with improved state management. This issue is fixed in iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2, visionOS 26.6.1. A website may be able to determine a user's IP address with Private Relay turned on...

CVE-2026-65355

An information disclosure issue was addressed with improved state management. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2, visionOS 26.6.1. A website may be able to determine a user's IP address with Private Relay turned on...

CVE-2026-65355

An information disclosure issue was addressed with improved state management. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2, visionOS 26.6.1. A website may be able to determine a user's IP address with Private Relay turned on...

EUVD-2026-78003

An information disclosure issue was addressed with improved state management. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2, visionOS 26.6.1. A website may be able to determine a user's IP address with Private Relay turned on...

CVE-2026-65355

CVE-2026-65355 is an information disclosure vulnerability in Apple Private Relay , where improper state management allowed a website to determine a user's real IP address even with Private Relay enabled. The issue is rated CVSS 4.3 (Medium) with required user interaction and low confidentiality i...

EUVD-2026-77988

An information disclosure issue was addressed with improved state management. This issue is fixed in iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2, visionOS 26.6.1. A website may be able to determine a user's IP address with Private Relay turned on...

CVE-2026-65352

CVE-2026-65352 is an information disclosure flaw in Apple's Private Relay feature, where a website may be able to determine a user's IP address even with Private Relay enabled. The issue was addressed with improved state management . Fixed versions: iOS 26.6.1 , iPadOS 26.6.1 , macOS Tahoe 26.6.2...

CVE-2026-65352

An information disclosure issue was addressed with improved state management. This issue is fixed in iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2, visionOS 26.6.1. A website may be able to determine a user's IP address with Private Relay turned on...

CVE-2026-53714

Envoy Gateway (an open-source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway) is affected by an authentication bypass in its xDS gRPC server when configured in GatewayNamespaceMode (provider.kubernetes.deploy.type=GatewayNamespace). The root cause is twof...

CVE-2022-0778

CVE-2022-0778 Description We refer to the concept of drago-96 and then rewrite a PoC based on the P12 and PEM format. You can use it to verify the CVE-2022-0778 vulns, i.e., a dangerous SSL certificate without any private password, leave it empty. If the device is affected, it may cause the CPU o...

CVE-2026-77884

Gallery - Private Photo Vault 1.0.41 starts an unauthenticated HTTP server that is reachable from the local network. The server listens on TCP port 8080 and serves files and directory listings from Android external storage...

CVE-2026-90942

Casdoor through 4.4.0 fails to properly mask the instance-wide built-in certificate private key in /api/get-certs and /api/get-cert endpoints, allowing organization administrators to retrieve it. Attackers can use the exposed private key to forge JWT tokens for any user in any organization,...

CVE-2026-77884 Gallery - Private Photo Vault 1.0.41 - Unauthenticated local-network HTTP file exposure

Gallery - Private Photo Vault 1.0.41 starts an unauthenticated HTTP server that is reachable from the local network. The server listens on TCP port 8080 and serves files and directory listings from Android external storage...

EUVD-2026-77755

Gallery - Private Photo Vault 1.0.41 starts an unauthenticated HTTP server that is reachable from the local network. The server listens on TCP port 8080 and serves files and directory listings from Android external storage...

CVE-2026-77884

Gallery – Private Photo Vault v1.0.41 (Android) starts an unauthenticated HTTP server on TCP port 8080 reachable from the adjacent network. The server exposes files and directory listings from Android external storage , allowing any device on the same local network to read private photo data with...

CVE-2026-90942 Casdoor through 4.4.0 Private Key Exposure via Certificate Endpoints

Casdoor through 4.4.0 fails to properly mask the instance-wide built-in certificate private key in /api/get-certs and /api/get-cert endpoints, allowing organization administrators to retrieve it. Attackers can use the exposed private key to forge JWT tokens for any user in any organization,...

CVE-2026-90942

Casdoor through 4.4.0 fails to properly mask the instance-wide built-in certificate private key in the /api/get-certs and /api/get-cert endpoints, allowing organization administrators to retrieve it. An attacker with this low-privilege access can use the exposed key to forge JWT tokens for any us...

EUVD-2026-77710

Casdoor through 4.4.0 fails to properly mask the instance-wide built-in certificate private key in /api/get-certs and /api/get-cert endpoints, allowing organization administrators to retrieve it. Attackers can use the exposed private key to forge JWT tokens for any user in any organization,...

CVE-2024-24919

Intro Simple POC Python script that check & leverage Check Point CVE-2024-24919 vulnerability Wrong Check Point; vulnerable to arbitrary file reading. Requirements Python 3 Pip Required Library/Module Install via PIP requests urllib3 tqdm How To Run root@kitploit: PS C:\ python CVE-2024-24919.py...