EUVD-2026-63794

OS command injection in the api endpoint of Datiphy Data Management Center from v8.3.0 through v8.5.1 allows an authenticated administrator to execute arbitrary operating system commands as root...

EUVD-2026-63759

In OpenStack Glance through 32.0.0, the /v2/tasks API accepts type=import tasks that bypass importfilteringopts, allowing an admin to fetch internal URLs from the Glance service network aka SSRF, as long as https:// or http:// is used. This API has been available only to admins since Xena, and it...

PT-2026-79431

A vulnerability was identified in Dromara RuoYi-Vue-Plus up to 5.6.2. This issue affects the function FlwInstanceController/FlwDefinitionController/FlwCategoryController/FlwSpelController/TestLeaveController of the component Workflow Endpoint. Such manipulation leads to improper authorization. Th...

CVE-2026-62945

TREK is a collaborative travel planner. Prior to 3.1.3, TREK file upload, update, and link actions accept attacker-controlled reservationid, placeid, and assignmentid values without using findForeignLinkTarget to verify that the referenced object belongs to the file's trip. An authenticated user...

CVE-2026-72846 Lightdash Scheduled Delivery Webhook URLs Are Not Validated, Allowing Server-Side Request Forgery

Lightdash stores the webhook URL supplied with a scheduled delivery and later posts to it from sendWebhook in packages/backend/src/clients/GoogleChat/GoogleChatClient.ts and in packages/backend/src/clients/MicrosoftTeams/MicrosoftTeamsClient.ts. In affected versions both call fetch on the stored...

CVE-2026-72843 EverShop Missing Authorization on PATCH /api/customers/:id Allows Unauthenticated Account Takeover

The customer update route in EverShop is declared with "access": "public" in packages/evershop/src/modules/customer/api/updateCustomer/route.json, which causes the admin authentication middleware to call next without checking the caller, and no customer-session middleware guards the route; the on...

CVE-2026-54508

TREK , a collaborative travel planner, is affected by a blind SSRF vulnerability prior to version 3.1.0. The root cause is that importGoogleList(), importNaverList() in placeService.ts and resolveGoogleMapsUrl() in mapsService.ts validate only the initial URL via checkSsrf() but then use fetch() ...

CVE-2026-46355

BigBlueButton prior to 3.0.23 exposed the /bigbluebutton/api/handleJoinExistingUser endpoint through a routable controller action in ApiController.groovy rather than a private helper. An authenticated requester who could supply the existingUserID of an active participant was able to reuse that pa...

CVE-2026-67446

Mailpit is an email testing tool and API for developers. Prior to 1.30.4, Mailpit decodes attacker-supplied image attachments into a full raster before checking decoded dimensions, pixel count, or memory use in the GET /api/v1/message/id/part/partID/thumb endpoint. The Thumbnail handler in...

CVE-2026-67446

Mailpit , an email testing tool and API for developers, is vulnerable to a memory exhaustion issue in its thumbnail generation endpoint (GET /api/v1/message/{id}/part/{partID}/thumb). The handler in server/apiv1/thumbnails.go calls imaging.Decode() with AutoOrientation on attacker-supplied image ...

CVE-2026-67446 Mailpit: Thumbnail generation decodes unbounded image dimensions before scaling

Mailpit is an email testing tool and API for developers. Prior to 1.30.4, Mailpit decodes attacker-supplied image attachments into a full raster before checking decoded dimensions, pixel count, or memory use in the GET /api/v1/message/id/part/partID/thumb endpoint. The Thumbnail handler in...

EUVD-2026-63659

Mailpit is an email testing tool and API for developers. Prior to 1.30.4, Mailpit decodes attacker-supplied image attachments into a full raster before checking decoded dimensions, pixel count, or memory use in the GET /api/v1/message/id/part/partID/thumb endpoint. The Thumbnail handler in...

exchange-scanner

Microsoft Exchange Server 스캐너 설명 이 도구는 대상 호스트의 몇 가지 일반적인 공개 서비스를 스캔하여 Microsoft Exchange Server를 탐지하고 가능하면 소프트웨어 버전을 식별합니다. 이를 위해 다음 기법을 사용합니다. 응답 헤더, 로그인 페이지 콘텐츠, 파비콘 해시를 통한 Outlook Web AccessOWA 핑거프린팅 XML 응답을 통한 Exchange Control PanelECP 내보내기 도구 핑거프린팅 응답 헤더를 통한 Autodiscover 엔드포인트 핑거프린팅 일반 포트의...

CVE-2025-12585

MxChat Basic = 2.5.1 - MxChat – 워드프레스용 AI 챗봇 = 2.5.1 - 인증되지 않은 정보 노출 MxChat Basic 플러그인은 mxchatfetchconversationhistory AJAX 엔드포인트에서 세션 소유권을 확인하지 않으므로, 인증되지 않은 사용자가 안전하지 않은 직접 객체 참조IDOR 취약점을 통해 다른 사용자의 대화 기록과 IP 주소에 접근할 수 있습니다. TL;DR 익스플로잇 root@kitploit: TARGETSITE="http://example.com"...

CVE-2025-12135

WPBookit getparam'csscode'; $jscode= $request-getparam'jscode'; updateoption 'wpbcustomcodedata', 'csscode' = $csscode, 'jscode' = $jscode ; 코드 실행 — /core/shortcodes/class-wpbookit-shortcode-abstract.php:20-27: root@kitploit: $wpbcustomcode= getoption 'wpbcustomcodedata', 'csscode' = '', 'jscode'...

CVE-2026-61663

django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.9, renderobjectstructure fails to authorize non-PageContent objects that use PlaceholderRelationField. An active staff user without cms.usestructure or model-level view or chan...

Wagtail: Identification of documents by SHA1 hash

Impact By passing specific HTTP headers to the document serve URL endpoint, an attacker was able to determine whether a document with a given ID matched a specified SHA1 hash, regardless of any permission restrictions on the document or knowing its filename. This could allow an attacker to...

django CMS: Missing authorization in `render_object_structure` discloses non-PageContent placeholder structure to low-privileged staff

Summary The django-cms frontend-editing structure endpoint GET //admin/cms/placeholder/object//structure// did not perform an object-level authorization check for non-PageContent objects. Any authenticated, active staff user could request the structure endpoint for a frontend-editable object a...

django CMS: Structure endpoint bypasses page-view permission

Summary The structure-board endpoint renderobjectstructure renders a page's plugin structure without verifying that the requesting user is allowed to view the page. The edit and preview endpoints enforce this via renderpage, but the structure endpoint does not, allowing a low-privileged staff use...

Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison

Summary userpassword.Compare substituted a placeholder hash derived from the well-known string "hunter2" when the stored hash was empty. Submitting "hunter2" therefore matched accounts with no password hash nonexistent users and SSO-only users and a subsequent login-type check returned an HTTP 40...