CVE-2026-81027

one-api gates one of its two channel-pinning paths and not the other. middleware/auth.go permits a request to name a specific channel either through a suffix on the API key or through a URL path parameter. The suffix path is reached only after model.IsAdmin succeeds and otherwise rejects the...

CVE-2026-81032

NebulaGraph exposes its runtime configuration over an unauthenticated HTTP service. Each daemon starts the web service defined in src/webservice/WebService.cpp, whose bind address defaults to all interfaces, and registers routes for reading and writing gflags alongside status and statistics...

CVE-2026-54553

Starlette-Admin is a fast, beautiful and extensible administrative interface framework for FastAPI and Starlette applications. Prior to 0.16.1, the list API does not validate user-supplied orderby and structured where field names against the configured sortablefields and searchablefields...

tryhackme-moniker-link

tryhackme-moniker-link Documentazione del mio laboratorio pratico Moniker Link CVE-2024-21413 completato su TryHackMe. Moniker Link CVE-2024-21413 — Laboratorio TryHackMe Panoramica Questo repository documenta il mio studio pratico in una stanza di TryHackMe. L'obiettivo di questo esercizio era...

CVE-2026-79068

A flaw was found in Google Chrome's StreamsAPI. A remote attacker could exploit improper resource exposure by crafting a malicious HTML page. This could potentially allow the attacker to bypass the web origin policy and gain access to a privileged page...

Starlette-Admin's unvalidated `order_by` parameter allows ordering by hidden columns (info-exposure oracle) and HTTP 500 DoS

Summary Affected versions of Starlette-Admin prior to 0.16.1 do not properly validate user-supplied sort and search parameters against the configured field allowlists. While the administrative UI restricts available fields based on field configuration, the backend accepts arbitrary field names...

CVE-2026-54553 Starlette-Admin: Unvalidated `order_by` parameter allows ordering by hidden columns (info-exposure oracle) and HTTP 500 DoS

Starlette-Admin is a fast, beautiful and extensible administrative interface framework for FastAPI and Starlette applications. Prior to 0.16.1, the list API does not validate user-supplied orderby and structured where field names against the configured sortablefields and searchablefields...

CVE-2026-54553

Starlette-Admin , an administrative interface framework for FastAPI/Starlette applications, is affected by an unvalidated order_by parameter in its list API prior to 0.16.1 . The backend does not validate user-supplied order_by and structured where field names against the configured sortable_fiel...

EUVD-2026-66559

Starlette-Admin is a fast, beautiful and extensible administrative interface framework for FastAPI and Starlette applications. Prior to 0.16.1, the list API does not validate user-supplied orderby and structured where field names against the configured sortablefields and searchablefields...

openssl: SSL_select_next_proto buffer overread

A flaw was found in OpenSSL. Affected versions of this package are vulnerable to Information Exposure through the SSLselectnextproto function. This flaw allows an attacker to cause unexpected application behavior or a crash by exploiting the buffer overread condition when the function is called...

EUVD-2026-66423

Rently Smart Home versions 20.1.0 and prior are vulnerable to an Insufficiently Protected Credentials vulnerability. This could allow an attacker to retrieve pins including the Master Pin, overriding standard user permissions...

CVE-2026-75960

Rently Smart Home versions 20.1.0 and prior are affected by an Insufficiently Protected Credentials vulnerability that allows an attacker to retrieve PINs, including the Master Pin , thereby overriding standard user permissions. CISA rates this HIGH severity (CVSS 3.1: 8.1, CVSS 4.0: 8.7) with a ...

CVE-2024-11396

CVE-2024-11396 Event Monster = 1.4.3 - Esposizione di informazioni tramite l'esportazione della lista dei visitatori Descrizione Il plugin Event Monster – Event Management, Tickets Booking, Upcoming Event per WordPress è vulnerabile all'esposizione di informazioni in tutte le versioni fino alla...

CVE-2023-47529

CVE-2023-47529 Cloud Templates & Patterns collection = 1.2.2 - Esposizione di informazioni sensibili tramite file di log root@kitploit: Description: The Cloud Templates & Patterns collection plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including,...

CVE-2023-30146

CVE-2023-30146 - Exploit per Webcam Assmann/HooToo - Esposizione di Dati Sensibili Descrizione È stato scoperto un problema nelle IP camera dei marchi HooToo e Assmann. Il firmware memorizza le credenziali di amministratore e utente nel backup in chiaro. Il backup può essere recuperato e...

CVE-2022-39196-

CVE-2022-39196 Blackboard CMS – Berechtigungserweiterung Blackboard Learn Version 1.10.1 ermöglicht es remote authentifizierten Benutzern, unbeabsichtigte Dateien zu lesen, indem sie Studentenanmeldeinformationen eingeben und dann direkt eine bestimmte webapps/bbcms/execute/ URL aufrufen...

CVE-2023-3350

CVE-2023-3349 / CVE-2023-3350 | IBERMATICA RPS 2019 Sicherheitsforschung, die eine nicht authentifizierte Offenlegung von Informationen und einen kryptografischen Designfehler in IBERMATICA RPS 2019 dokumentiert. Die Schwachstellen können miteinander verkettet werden, um Anwendungsprotokolle...

EUVD-2026-66345

Efence developed by Thinking Software Technology has a SQL Injection vulnerability. Unauthenticated remote attackers can access file upload functionality and read database contents...

nginx

CVE-2017-7529 당승표@portfolio10 Riepilogo Questo laboratorio riproduce la vulnerabilità della cache CVE-2017-7529 che si verifica durante l'elaborazione delle richieste Range nel server Nginx, e il comportamento effettivo della vulnerabilità Vulnerabilità: possibile esposizione di dati memorizzati...

Password-Strength-Evaluator

Password Strength Evaluator Password Strength Evaluator ist ein Tool, das die Stärke von Passwörtern bewertet und Empfehlungen zur Verbesserung ihrer Sicherheit gibt. Dieses Tool prüft außerdem mithilfe der Have I Been Pwned -API, ob Ihr Passwort in einem Datenleck offengelegt wurde. Darüber hina...