CVE-2024-52317

🚨🚨CVE-2024-52317🚨🚨 CVE-2024-52317 - Apache Tomcat HTTP/2 데이터 유출 취약점 개요 CVE-2024-52317은 Apache Tomcat의 HTTP/2 구현에 영향을 미치는 취약점입니다. 이 문제는 HTTP/2 요청 및 응답 리소스의 부적절한 재사용으로 인해 발생하며, 사용자 간 데이터 유출로 이어질 수 있습니다. 즉, 한 사용자의 민감한 데이터가 다른 사용자에게 전송되는 응답에 포함될 가능성이 있습니다. 영향받는 버전 다음 Apache Tomcat 버전이 취약합니다: 버전 시리즈|...

CVE-2026-33555

HAProxy H3/QUIC スタンドアロン FIN ボディ検証バイパスによる HTTP リクエストスマグリング 完全な記事はこちら : https://r3verii.github.io/cve/2026/04/14/haproxy-h3-standalone-fin-smuggling.html 概要 HAProxy の HTTP/3 実装における脆弱性により、攻撃者は実際のボディサイズと一致しない Content-Length ヘッダーを含む HTTP リクエストを送信できます。HAProxy はこの不正なリクエストを、宣言された Content-Length...

CVE-2025-46818

CVE-2025-46818 – Redis Lua 샌드박스 교차 사용자 탈출 Redis 8.2.1에서 더 이상 사용되지 않는 Lua API와 변경 가능한 메타테이블을 통한 샌드박스 탈출. 개요 Redis 8.2.1은 더 이상 사용되지 않는 Lua 내장 함수getfenv, setfenv, newproxy를 스크립트에 노출하고 기본 타입의 메타테이블을 잠그지 않습니다. 공격자는 공유 메타테이블에 메서드를 주입하고, 권한 있는 환경을 캡처하여 다른 사용자의 권한으로 명령을 실행할 수 있습니다. 환경 Redis 서버 8.2.1또는...

CVE-2026-54519

CVE-2026-54519 ai-agent-automation에서 메모리 API에 소유권 검사가 누락되어 교차 사용자 메모리 읽기 및 삭제가 가능했습니다. 기본 권고: GHSA-qv97-83w4-ff86 연구자 크레딧: @chaitanyagarware 한눈에 보기 필드| 값 ---|--- CVE| CVE-2026-54519 GHSA| GHSA-qv97-83w4-ff86 프로젝트| vmDeshpande/ai-agent-automation 패키지| backend 생태계| npm 심각도| 높음 CVSS| 8.8,...

CVE-2026-96283 Flatpak: flatpak: flatpak-system-helper cross-user cancelpull orphans another user's ongoing pull

By calling org.freedesktop.Flatpak.SystemHelper.CancelPull on another user's pull, the pull is not actually cancelled but removed from internal tracking, making it impossible for the owning user to stop it. Ongoing pulls cannot be stopped...

CVE-2026-96283

By calling org.freedesktop.Flatpak.SystemHelper.CancelPull on another user's pull, the pull is not actually cancelled but removed from internal tracking, making it impossible for the owning user to stop it. Ongoing pulls cannot be stopped...

CVE-2026-96283 Flatpak: flatpak: flatpak-system-helper cross-user cancelpull orphans another user's ongoing pull

By calling org.freedesktop.Flatpak.SystemHelper.CancelPull on another user's pull, the pull is not actually cancelled but removed from internal tracking, making it impossible for the owning user to stop it. Ongoing pulls cannot be stopped...

CVE-2026-96283

The Flatpak software suite is affected by a cross-user vulnerability where calling org.freedesktop.Flatpak.SystemHelper.CancelPull on another user's pull operation removes it from internal tracking without actually cancelling the action. This results in orphaned pulls that the owning user cannot ...

CVE-2026-77293 TREK: Cross-user note-file deletion (IDOR / Broken Access Control)

TREK is a collaborative travel planner. Prior to 3.3.0, the DELETE /api/trips/:tripId/collab/notes/:noteId/files/:fileId endpoint authorizes an authenticated user against the attacker-controlled tripId but deleteNoteFile in server/src/services/collabService.ts resolves the target only by note and...

WordPress WP OAuth Server ( Login with WordPress ) plugin < 6.4.0 - Subscriber+ Cross-User Account Takeover vulnerability

Subscriber+ Cross-User Account Takeover vulnerability discovered by vuxvinh in WordPress Plugin WP OAuth Server versions 6.4.0...

GHSA-GVF2-2RH5-MPGF OpenC3 COSMOS: Stored, cross-user XSS via Telemetry screen BUTTON widget

Summary A user who can save a telemetry screen permission systemset can embed JavaScript in a screen BUTTON widget. The BUTTON widget evals the stored button text in the browser when the button is activated, and screens are shared content rendered to other users in the scope. As a result, an...

OpenC3 COSMOS: Stored, cross-user XSS via Telemetry screen BUTTON widget

Summary A user who can save a telemetry screen permission systemset can embed JavaScript in a screen BUTTON widget. The BUTTON widget evals the stored button text in the browser when the button is activated, and screens are shared content rendered to other users in the scope. As a result, an...

CVE-2026-84150 Directorist < 8.9.5 - Subscriber+ Cross-User Favorites Read and Write via REST Favorites Endpoint

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.5 does not verify that the target user of a REST route matches the authenticated caller before reading and modifying that user's saved favorites, allowing any authenticated user with...

CVE-2026-84150

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin is vulnerable in versions before 8.9.5 . The application fails to verify if the target user of a REST route matches the authenticated caller when accessing or modifying saved favorites. This allows any auth...

WordPress Directorist: AI-Powered Business Directory, Listings & Classified Ads plugin < 8.9.5 - Subscriber+ Cross-User Favorites Read and Write vulnerability

Subscriber+ Cross-User Favorites Read and Write vulnerability discovered by Revanth Hari Narayana Matte in WordPress Plugin Directorist versions 8.9.5...

CVE-2026-84150 Directorist < 8.9.5 - Subscriber+ Cross-User Favorites Read and Write via REST Favorites Endpoint

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.5 does not verify that the target user of a REST route matches the authenticated caller before reading and modifying that user's saved favorites, allowing any authenticated user with...

CVE-2026-79314

A horizontal privilege escalation vulnerability exists in x-ui 0.3.2 . An authenticated user can perform unauthorized cross-user modification of data by submitting a request referencing a target resource identifier. The root cause is that the update path fails to verify if the target resource bel...

PT-2026-97018

Name of the Vulnerable Software and Affected Versions GNU wget Windows builds from eternallybored.org affected versions not specified Description A local cross-user code execution issue exists due to a hardcoded configuration file path at C:msys64 that can be written to by unprivileged users. Thi...

CVE-2026-77520 MaxKB: Homepage ranking leaks application IDs that workflow application-nodes can use to invoke another user's application

MaxKB is an open-source AI assistant for enterprise. In 2.10.2-lts and earlier, a normal user in the same workspace can obtain another user's applicationid from the homepage application question-ranking endpoint when the published victim application has ranking activity in the selected date range...

CVE-2026-77520 MaxKB: Homepage ranking leaks application IDs that workflow application-nodes can use to invoke another user's application

MaxKB is an open-source AI assistant for enterprise. In 2.10.2-lts and earlier, a normal user in the same workspace can obtain another user's applicationid from the homepage application question-ranking endpoint when the published victim application has ranking activity in the selected date range...