CVE-2026-56570

HCL iControl was affected by Auto complete Enabled vulnerabilities. It involves expose sensitive information such as: Valid usernames, Email addresses used for login, Account identifiers If the system is accessed from shared environments, attackers may enumerate valid usernames through browser...

Fake Fortnite rewards are stealing players’ accounts

Fortnite scam pages like the ones below appear by the dozen every day, recycled endlessly under different names and designs. One version promises $50 from a fake superhero collaboration. Another claims it can calculate what your locker is worth. Both lead to the same destination: a fake Epic Game...

EUVD-2026-51544

HCL iControl was affected by Auto complete Enabled vulnerabilities. It involves expose sensitive information such as: Valid usernames, Email addresses used for login, Account identifiers If the system is accessed from shared environments, attackers may enumerate valid usernames through browser...

CVE-2026-56570 HCL iControl is affected by multiple security vulnerabilities.

HCL iControl was affected by Auto complete Enabled vulnerabilities. It involves expose sensitive information such as: Valid usernames, Email addresses used for login, Account identifiers If the system is accessed from shared environments, attackers may enumerate valid usernames through browser...

CVE-2026-56570 HCL iControl is affected by multiple security vulnerabilities.

HCL iControl was affected by Auto complete Enabled vulnerabilities. It involves expose sensitive information such as: Valid usernames, Email addresses used for login, Account identifiers If the system is accessed from shared environments, attackers may enumerate valid usernames through browser...

CVE-2026-56570

HCL iControl was affected by Auto complete Enabled vulnerabilities. It involves expose sensitive information such as: Valid usernames, Email addresses used for login, Account identifiers If the system is accessed from shared environments, attackers may enumerate valid usernames through browser...

CVE-2026-56570

Technical details about CVE-2026-56570 are not publicly provided in the connected documents. Monitor for updates; the available sources report exposure of usernames and emails but do not specify affected versions, vectors, or fixes.

EUVD-2025-210568

A Cross-Site Request Forgery CSRF vulnerability has been identified in multiple PHP Jabbers scripts. The lack of CSRF tokens or appropriate SameSite attributes allows an attacker to send unauthorized requests in the context of an authenticated user, leading to unauthorized administrative actions,...

CVE-2025-67651 CSRF in PHP Jabbers scripts

A Cross-Site Request Forgery CSRF vulnerability has been identified in multiple PHP Jabbers scripts. The lack of CSRF tokens or appropriate SameSite attributes allows an attacker to send unauthorized requests in the context of an authenticated user, leading to unauthorized administrative actions,...

Exploit for Improper Authorization in Microsoft

CVE-2026-54121-CertiGhost This POC is the original POC code f...

CVE-2026-18209

A flaw was found in the keycloak-services component of Keycloak, which handles OpenID Connect OIDC authentication flows. The issue occurs because the security check designed to prevent HTTP parameter pollution only inspects the query portion of a redirect URL and ignores the fragment portion. Whe...

CVE-2026-18209 Keycloak-services: keycloak-services: oidc redirect_uri fragment bypass in http parameter pollution check

A flaw was found in the keycloak-services component of Keycloak, which handles OpenID Connect OIDC authentication flows. The issue occurs because the security check designed to prevent HTTP parameter pollution only inspects the query portion of a redirect URL and ignores the fragment portion. Whe...

CVE-2026-18217 Keycloak-services: keycloak-services: saml http-redirect binding response preserves query string leading to parameter pollution

A flaw was found in the SAML protocol implementation of Keycloak, an open-source identity and access management solution. The issue occurs when Keycloak handles SAML authentication requests using the HTTP-Redirect binding. If a client is configured with a wildcard redirect URL, an attacker can...

CVE-2026-18217

A flaw was found in the SAML protocol implementation of Keycloak, an open-source identity and access management solution. The issue occurs when Keycloak handles SAML authentication requests using the HTTP-Redirect binding. If a client is configured with a wildcard redirect URL, an attacker can...

CVE-2026-55495 Cloudreve: Path Traversal in WOPI PUT_RELATIVE Allows Arbitrary File Creation in Owner Account

Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, the WOPI PUTRELATIVE handler passes X-WOPI-SuggestedTarget to URI.JoinRaw as a path rather than a filename, allowing slash and dot-dot segments to escape the source file directory and create or conditionally overwrite...

CVE-2026-55495

Summary: Cloudreve up to v4.16.x is vulnerable to a path traversal via the WOPI PUT_RELATIVE handler. The WOPI header X-WOPI-SuggestedTarget is treated as a path and joined to the source directory using URI.JoinRaw, allowing slashes and dot-dot segments to escape the source file directory and cre...

CVE-2026-55495 Cloudreve: Path Traversal in WOPI PUT_RELATIVE Allows Arbitrary File Creation in Owner Account

Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, the WOPI PUTRELATIVE handler passes X-WOPI-SuggestedTarget to URI.JoinRaw as a path rather than a filename, allowing slash and dot-dot segments to escape the source file directory and create or conditionally overwrite...

CVE-2026-55495 Cloudreve: Path Traversal in WOPI PUT_RELATIVE Allows Arbitrary File Creation in Owner Account

Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, the WOPI PUTRELATIVE handler passes X-WOPI-SuggestedTarget to URI.JoinRaw as a path rather than a filename, allowing slash and dot-dot segments to escape the source file directory and create or conditionally overwrite...

CVE-2026-6890

This CVE-2026-6890 entry, as reflected by PT-2026-66670, concerns a default-credentials vulnerability in Advantech ECU-1251D. A remote attacker could gain unauthorised SSH access via the device’s default root account with no password, because credentials are not changed during configuration. The ...

SUSE CVE-2024-21635

Memos is a privacy-first, lightweight note-taking service that uses Access Tokens to authenticate application access. When a user changes their password, the existing list of Access Tokens stay valid instead of expiring. If a user finds that their account has been compromised, they can update the...