CVE-2026-33435

Weblate: Remote code execution during project backup restoration in versions prior to 5.17 due to backups not filtering Git/Mercurial config files. Fixed in 5.17. Remediation: upgrade to 5.17+ or restrict access to backups (backups are only accessible to users who can create projects).

CVE-2026-33435 Weblate: Remote code execution during backup restoration

Weblate is a web based localization tool. In versions prior to 5.17, the project backup didn't filter Git and Mercurial configuration files which could lead to remote code execution under certain circumstances. This issue has been fixed in version 5.17. If developers are unable to update...

CVE-2026-33435 Weblate: Remote code execution during backup restoration

Weblate is a web based localization tool. In versions prior to 5.17, the project backup didn't filter Git and Mercurial configuration files which could lead to remote code execution under certain circumstances. This issue has been fixed in version 5.17. If developers are unable to update...

PT-2026-33118

OpenProject is an open-source project management application. In versions prior to 17.3.0, 2FA OTP verification in the confirm otp action of the two factor authentication module has no rate limiting, lockout mechanism, or failed-attempt tracking. The existing brute force block after failed logins...

PT-2026-33116

Weblate is a web based localization tool. In versions prior to 5.17, the project backup didn't filter Git and Mercurial configuration files which could lead to remote code execution under certain circumstances. This issue has been fixed in version 5.17. If developers are unable to update...

Powershell Profile Persistence

This Metasploit module establishes persistence by modifying a PowerShell profile script, which is automatically executed when PowerShell starts. The module supports multiple profile scopes current user or all users and safely backs up any existing profile prior to modification, enabling clean...

CVE-2026-32892

Chamilo LMS is a learning management system. Prior to 1.11.38 and 2.0.0-RC.3, Chamilo LMS contains an OS Command Injection vulnerability in the file move function. The move function in fileManage.lib.php passes user-controlled path values directly into exec shell commands without using...

EUVD-2024-20629

An exposure of sensitive information to an unauthorized actor vulnerability in Fortinet FortiNDR 7.6.0, FortiNDR 7.4.0 through 7.4.8, FortiNDR 7.2 all versions, FortiNDR 7.1 all versions, FortiNDR 7.0 all versions, FortiVoice 7.0.0 through 7.0.1 may allow a remote authenticated attacker with at...

CVE-2024-23104

An exposure of sensitive information to an unauthorized actor vulnerability in Fortinet FortiNDR 7.6.0, FortiNDR 7.4.0 through 7.4.8, FortiNDR 7.2 all versions, FortiNDR 7.1 all versions, FortiNDR 7.0 all versions, FortiVoice 7.0.0 through 7.0.1 may allow a remote authenticated attacker with at...

CVE-2024-23104

An exposure of sensitive information to an unauthorized actor vulnerability in Fortinet FortiNDR 7.6.0, FortiNDR 7.4.0 through 7.4.8, FortiNDR 7.2 all versions, FortiNDR 7.1 all versions, FortiNDR 7.0 all versions, FortiVoice 7.0.0 through 7.0.1 may allow a remote authenticated attacker with at...

CVE-2024-23104

Technical details (affected products, components, versions, root cause, impact, remediation) are not publicly available in the provided Connected documents. Monitor for updates; update specifics may be added in future disclosures.

CVE-2024-23104

An exposure of sensitive information to an unauthorized actor vulnerability in Fortinet FortiNDR 7.6.0, FortiNDR 7.4.0 through 7.4.8, FortiNDR 7.2 all versions, FortiNDR 7.1 all versions, FortiNDR 7.0 all versions, FortiVoice 7.0.0 through 7.0.1 may allow a remote authenticated attacker with at...

CVE-2026-6227 BackWPup <= 5.6.6 - Authenticated (Administrator+) Local File Inclusion via 'block_name' Parameter

The BackWPup plugin for WordPress is vulnerable to Local File Inclusion via the blockname parameter of the /wp-json/backwpup/v1/getblock REST endpoint in all versions up to, and including, 5.6.6 due to a non-recursive strreplace sanitization of path traversal sequences. This makes it possible for...

CVE-2024-23104: Exposure of Sensitive Information to an Unauthorized Actor

An exposure of sensitive information to an unauthorized actor vulnerability in Fortinet FortiNDR 7.6.0, FortiNDR 7.4.0 through 7.4.8, FortiNDR 7.2 all versions, FortiNDR 7.1 all versions, FortiNDR 7.0 all versions, FortiVoice 7.0.0 through 7.0.1 may allow a remote authenticated attacker with at...

PT-2026-32649

An exposure of sensitive information to an unauthorized actor vulnerability in Fortinet FortiNDR 7.6.0, FortiNDR 7.4.0 through 7.4.8, FortiNDR 7.2 all versions, FortiNDR 7.1 all versions, FortiNDR 7.0 all versions, FortiVoice 7.0.0 through 7.0.1 may allow a remote authenticated attacker with at...

Fortinet FortiNDR 信息泄露漏洞

Fortinet FortiNDR is a network detection and response solution provided by the American company Fortinet. Versions of Fortinet FortiNDR such as 7.6.0, 7.4.0 to 7.4.8, 7.2, 7.1, 7.0, as well as FortiVoice 7.0.0 to 7.0.1 have information leakage vulnerabilities. These vulnerabilities stem from the...

PT-2026-40497

Уязвимость программного средства защиты данных посредством резервного копирования PowerProtect Data Domain операционных систем Dell EMC Data Domain Operating System DD OS связана с непринятием мер по нейтрализации специальных элементов. Эксплуатация уязвимости может позволить нарушителю выполнить...

The vulnerability of the backup server of the Veeam Backup & Replication software allows a perpetrator to execute arbitrary code. This vulnerability targets systems for cloud, virtual, and physical environments.

The vulnerability of the backup server of the Veeam Backup & Replication solution for cloud, virtual, and physical systems is related to access control errors. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code remotely...

The vulnerability of the backup server of the Veeam Backup & Replication software allows a perpetrator to execute arbitrary code. This vulnerability targets systems for cloud, virtual, and physical environments.

The vulnerability of the backup server of the Veeam Backup & Replication solution for cloud, virtual, and physical systems is related to access control errors. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code remotely...

The vulnerability of Veeam Backup & Replication’s protection mechanism for cloud, virtual, and physical systems, related to access control errors, allows attackers to execute arbitrary code.

The vulnerability of Veeam Backup & Replication’s protection mechanisms for cloud, virtual, and physical systems stems from access control errors. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code remotely...