DDOS-RootSec

RootSec アーカイブ RootSec アーカイブの概要 RootSec アーカイブ へようこそ。DDOSツール、スキャナー、ボットネット、エクスプロイトなどに関する究極のリソースです。アーカイブには以下が含まれます: Mirai エディット: 非公開版および公開版 QBot エディット: 非公開版および公開版 その他のボットネット亜種: 多様なコレクションとカスタムビルド エクスプロイト : 最新の脆弱性 スキャナー : QBot および Mirai 手法 : レイヤー4、レイヤー7、UDP、およびTCP ブルートフォーサー : パスワードクラッキングツール 脆弱性リスト :...

CVE-2026-87975

A flaw was found in Django. When handling model formsets where primary keys can be modified through form fields, the application does not properly validate submitted key values against the authorized query scope. A remote attacker with permission to submit form data can exploit this issue by...

CVE-2026-70481

CVE-2026-70481 Open WebUI、影響を受けるバージョン0.5.0〜0.10.2、0.11.0で修正済み。重要度：中、CVSS 5.4、CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L、CWE-284およびCWE-862。 backend/openwebui/routers/channels.pyでは、メッセージ更新・削除ハンドラがチャンネルタイプによって分岐しており、2つの分岐は異なる条件を問い合わせます。グループおよびダイレクトメッセージのチャンネルは投稿者のみが対象です。 if channel.type in 'group'...

CVE-2026-100259

In JetBrains YouTrack before 2026.2.18991 improper access control on Gantt chart allowed edits by users with view-only access...

CVE-2026-100259

In JetBrains YouTrack before 2026.2.18991 improper access control on Gantt chart allowed edits by users with view-only access...

CVE-2026-100259: Incorrect Authorization

In JetBrains YouTrack before 2026.2.18991 improper access control on Gantt chart allowed edits by users with view-only access...

CVE-2026-92226

The Joomla! Core component is vulnerable to improper ACL checks affecting various webservice edit tasks in versions 4.0.0-5.4.8 and 6.0.0-6.1.3 . This flaw allows unauthorized users to perform edit actions on items that are otherwise uneditable. The CVSS 4.0 score is 7.0 (High) with a network att...

EUVD-2026-89087

Joomla! Core - 20260913 - Core - Improper ACL checks for varous webservice edit tasks in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - An improper access check allows unauthorized users to perform edit actions on otherwise uneditable items...

GO-2026-6484 Mattermost doesn't validate channel ownership of an existing subscription before applying edits in github.com/mattermost/mattermost-server

Mattermost doesn't validate channel ownership of an existing subscription before applying edits in github.com/mattermost/mattermost-server...

SUSE CVE-2026-72810

SiYuan versions before v3.7.4 contain a publish-boundary bypass vulnerability in WebSocket broadcast sessions that allows anonymous readers to receive unfiltered edits. Attackers can establish a WebSocket connection to the publish surface and passively receive real-time content events including...

CVE-2026-72810: Missing Authorization

SiYuan versions before v3.7.4 contain a publish-boundary bypass vulnerability in WebSocket broadcast sessions that allows anonymous readers to receive unfiltered edits. Attackers can establish a WebSocket connection to the publish surface and passively receive real-time content events including...

PT-2026-85357

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-mw8r-mw84-88v2. This link is maintained to preserve external references. Original Description SiYuan versions before v3.7.4 contain a publish-boundary bypass vulnerability in WebSocket broadcast sessions that...

CVE-2026-16269

The Newsletters WordPress plugin before 4.16 does not strictly compare its API authentication key, allowing unauthenticated attackers to bypass the API authentication via type juggling and perform privileged actions such as modifying subscriber records and sending emails, when the optional API ha...

CVE-2026-16269 Newsletters < 4.16 - Unauthenticated API Authentication Bypass via Type Juggling

The Newsletters WordPress plugin before 4.16 does not strictly compare its API authentication key, allowing unauthenticated attackers to bypass the API authentication via type juggling and perform privileged actions such as modifying subscriber records and sending emails, when the optional API ha...

CVE-2026-16269

The Newsletters WordPress plugin before 4.16 does not strictly compare its API authentication key, allowing unauthenticated attackers to bypass the API authentication via type juggling and perform privileged actions such as modifying subscriber records and sending emails, when the optional API ha...

EulerOS 2.0 SP11 : sed (EulerOS-SA-2026-3103)

According to the versions of the sed packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : When sed is invoked with both -i in-place edit and --follow-symlinks, the function opennextfile performs two separate, non-atomic filesystem operatio...

EUVD-2026-54152

Frappe is a full-stack web application framework. Prior to 16.18.0, the Workspace Save API accepts a controlled workspace identifier from any authenticated user without enforcing workspace ownership, allowing modification of another user's private workspace and persistent script injection. This...

CVE-2026-47185 Frappe Has Broken Access Control in its Workspace Save API

Frappe is a full-stack web application framework. Prior to 16.18.0, the Workspace Save API accepts a controlled workspace identifier from any authenticated user without enforcing workspace ownership, allowing modification of another user's private workspace and persistent script injection. This...

CVE-2026-17583 Thermo Fisher Applied Biosystems Genetic Analyzers Missing Support for Integrity Check

The affected Thermo Fisher Applied Biosystems Genetic Analyzers are vulnerable because .fsa/.hid output files can be edited. An attacker could tamper with these files, altering DNA data and resulting in inaccurate DNA test outcomes...

DRUPAL-CONTRIB-2026-093

This module provides formatters to allow in-place editing in a View or other display full content, teaser.... The module doesn't sufficiently check access when editing entities. A malicious user could craft requests to allow them to modify any field on any entity. This vulnerability is mitigated ...