CVE-2026-27579-CORS-Misconfiguration-Leading-to-Authenticated-Data-Exposure

CVE-2026-27579 – CORS 오구성으로 인한 인증된 데이터 노출 📌 권고 참조 CVE ID: CVE-2026-27579 GHSA: GHSA-qh5m-p8jh-hx88 공급업체: karnop 제품: realtime-collaboration-platform 심각도: HIGH CVSS 7.4 벡터: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N 🧠 취약점 개요 realtime-collaboration-platform 프로젝트에는 Appwrite 백엔드 구성에 CORS 오구성 이 존재했습니...

CVE-2026-87032 Tanium addressed an information disclosure vulnerability in Tanium Server.

Tanium addressed an information disclosure vulnerability in Tanium Server...

CVE-2026-87032

Tanium Server is affected by an information disclosure vulnerability addressed by Tanium, per advisory TAN-2026-033 . The assigned CVSS 3.1 base score is 4.3 (MEDIUM) , with a network vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and a low confident...

DEBIAN-CVE-2026-87563

Origin validation error in Paint in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-87605

Missing authorization in Contacts in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to potentially obtain sensitive information via a crafted HTML page. Chromium security severity: Low...

EUVD-2026-74386

Information leak in ServiceWorker in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to obtain sensitive information via a crafted HTML page. Chromium security severity: Medium...

EUVD-2026-75132

An issue was discovered in Cyrus IMAP before 3.12.4. CalDAV/CardDAV multiget bypasses a per-href ACL. An authenticated DAV user with some shared access to another user's calendar or address book could read even unshared events or contacts by including the target hrefs in a calendar-multiget or...

CVE-2023-49367

CVE-2023-49367 - Раскрытие чувствительных данных Раскрытие чувствительных данных в веб-панели принтера Kyocera Производитель: Kyocera Corporation Затронутые версии: Command Center RX - EXOSYS M5521cdn Описание После подключения к интерфейсу адресной книги Kyocera в отправленных пакетах можно...

CVE-2026-78627

The Okta Hyperdrive Integration installer does not mask the OAuth client secret when passed as an MSI property. The credential is recorded in plaintext in the installer log, the Application Event Log, and the process command line, all of which are readable by an authenticated local user on the...

CVE-2026-75998

ColdFusion is affected by an Improper Access Control vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files and directories outside the intended access scope. Exploitation of this issue does not require user interaction...

CVE-2024-43917

CVE-2024-43917 Этот скрипт демонстрирует уязвимость SQL-инъекции, обнаруженную в плагине TI WooCommerce Wishlist для WordPress, версий до 2.8.2 CVE-2024-43917. Уязвимость позволяет неаутентифицированным пользователям выполнять произвольные SQL-команды в базе данных сайта, потенциально раскрывая...

CVE-2026-81387

Exposure of sensitive system information to an unauthorized control sphere in Microsoft Office Excel allows an unauthorized attacker to disclose information locally...

SnipRecover-CLI

SnipRecover CLI CVE-2023-28303에 취약한 Windows 캡처 도구 PNG 캡처의 탐지 및 복원 SnipRecover CLI 는 다음과 같은 기능을 위해 설계된 최소한의 의존성 없는 명령줄 유틸리티입니다: Windows 캡처 도구 취약점CVE‑2023‑28303에 의해 수정된 PNG 파일을 탐지 합니다. IEND 청크 이후에 추가된 압축 데이터를 복구하여 원본 이미지를 복원 합니다. 기본적으로 복원된 이미지는 RGBA 및 1920×1080 해상도를 사용하며, 출력 경로를 지정하지 않으면 도구는...

CVE-2026-82069 Improper Redaction of Query Literals in MongoDB Server Query Statistics Serialization on Sharded Cluster Router

A security issue in MongoDB Server's query statistics serialization on the router allows users with monitoring privileges to access unredacted search query text from other users' operations. An improper conditional check in the serialization logic causes the data redaction mechanism to be bypasse...

Atarim < 4.2.2 - Sensitive Information Exposure

Vito Peleg Atarim = 4.2 contains an insertion of sensitive information into sent data vulnerability caused by improper handling of embedded sensitive data, letting attackers retrieve embedded sensitive data remotely, exploit requires no special privileges. id: CVE-2025-60188 info: name: Atarim...

firefox: thunderbird: Information disclosure in the DOM: Push Subscriptions component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Information disclosure in the DOM: Push Subscriptions component...

CVE-2024-6678

CVE-2024-6678 - GitLab: Pipeline Schedule Arbitrary User Trigger PoC for CVE-2024-6678 Описание уязвимости GitLab позволяет пользователям вручную запускать расписания CI/CD-пайплайнов Pipeline Schedules через кнопку «Play». Уязвимость состоит в том, что функция «play» позволяет любому пользовател...

CVE-2026-82586

Improper Protection of Alternate Path vulnerability in ash-project ashlua allows a user-supplied Lua script to read attributes that are not on the exposed-field allow-list. AshLua exposes Ash resources to Lua scripts, gated by a manifest declaring which fields are exposed. The read action's...

EUVD-2026-72542

Improper Protection of Alternate Path vulnerability in ash-project ashlua allows a user-supplied Lua script to read attributes that are not on the exposed-field allow-list. AshLua exposes Ash resources to Lua scripts, gated by a manifest declaring which fields are exposed. The read action's...

CVE-2025-14847

MongoDB CVE-2025-14847 취약점 탐지 도구 MongoDB 메모리 누수 취약점 CVE-2025-14847 탐지 도구 ⚠️ 중요 알림: 이 도구는 승인된 보안 테스트 및 취약점 평가에만 사용하십시오. 승인되지 않은 사용은 법률 위반이 될 수 있습니다. 📋 목차 취약점 설명 기능 특징 설치 사용 방법 테스트 환경 구축 출력 예시 탐지 원리 수정 권장 사항 면책 조항 🔍 취약점 설명 CVE-2025-14847 은 MongoDB Zlib 압축 프로토콜 처리 과정에서 발생하는 심각한 메모리 누수 취약점입니다. 공격자는...