Flare 安全漏洞

Flare is a file-sharing platform developed by Zachary Lowery. Versions of Flare prior to 1.7.2 contained security vulnerabilities. These vulnerabilities stemmed from the lack of verification of the password for password-protected files at the thumbnail endpoint, allowing unauthorized access to...

Flare 安全漏洞

Flare is a file-sharing platform developed by Zachary Lowery. Versions of Flare prior to 1.7.2 contained security vulnerabilities. These vulnerabilities stemmed from the fact that raw and direct file routing only prevented unauthenticated users from accessing private files. This allowed any...

PT-2026-23794

Name of the Vulnerable Software and Affected Versions PinchTab versions prior to 0.7.7 Description PinchTab is a standalone HTTP server designed to provide AI agents with direct control over a Chrome browser. A Server-Side Request Forgery SSRF condition exists in the /download endpoint. This allo...

PT-2026-23695

Surreal ToDo 0.6.1.2 contains a local file inclusion vulnerability that allows unauthenticated attackers to read arbitrary files by manipulating the content parameter. Attackers can supply directory traversal sequences through the content parameter in index.php to access sensitive system files li...

Idno 操作系统命令注入漏洞

Idno is a social content publishing platform developed by Idno OpenSource. Versions of Idno prior to 1.6.4 contained a vulnerability related to operating system command injection. This vulnerability stemmed from write operations on linked import files and path traversal through templates, which...

Cryptomator 安全漏洞

Cryptomator is a simple digital self-defense tool from the Cryptomator community. It is used to protect data. Versions of Cryptomator prior to 1.19.0 have security vulnerabilities; these vulnerabilities stem from the possibility of leaking plaintext paths into log files, which could lead to...

Busting VPN myths: What a VPN can do for your privacy and what it can’t

Privacy Busting VPN myths: What a VPN can do for your privacy and what it can’t Share March 6th, 2026 If you’re reading this blog, you have probably heard of or used a VPN before. The truth is, VPNs are incredibly useful! They are one of the most effective tools for protecting your online privacy...

MarkUs 安全漏洞

MarkUs is an open-source Ruby on Rails and React web application used for submitting and grading student assignments. Versions of MarkUs prior to 2.9.4 contained a security vulnerability. This vulnerability stemmed from allowing course instructors to upload YAML files to create or update entities...

PT-2026-23717

Name of the Vulnerable Software and Affected Versions Navtor NavBox affected versions not specified Description An Absolute Path Traversal issue exists in Navtor NavBox. The application’s HTTP service does not properly sanitize user-supplied path input. Remote attackers can exploit this by...

PT-2026-23660

Name of the Vulnerable Software and Affected Versions AppEngine affected versions not specified Description An attacker may perform unauthenticated read and write operations on sensitive filesystem areas via the AppEngine Fileaccess over HTTP due to improper access restrictions. A critical...

NULL Pointer Dereference

Overview Affected versions of this package are vulnerable to NULL Pointer Dereference in the readelf process when parsing a specially crafted ELF binary with malformed header fields. An attacker can cause the application to crash by convincing a user to process a malicious file. This is only...

Parse Server 安全漏洞

Parse Server is an open-source backend developed by the Parse Platform. It can be deployed on any infrastructure that runs Node.js. There were security vulnerabilities in versions of Parse Server prior to 8.6.5 and 9.5.0-alpha.3. These vulnerabilities stemmed from the use of readOnlyMasterKey,...

PT-2026-23752

Name of the Vulnerable Software and Affected Versions Parse Server versions prior to 8.6.5 Parse Server versions prior to 9.5.0-alpha.3 Description The readOnlyMasterKey can be misused to create and delete files through the Files API. Specifically, the API endpoints /files/:filename POST and DELE...

Easyndexer 路径遍历漏洞

Easyndexer is a database interface software developed by rul10’s individual developer. Version 1.0 of Easyndexer has a path traversal vulnerability. This vulnerability stems from the file parameter in the showtif.php file, which allows arbitrary file downloads, potentially leading to the download...

PT-2026-23755

Name of the Vulnerable Software and Affected Versions Flare versions prior to 1.7.2 Description Flare, a Next.js-based file sharing platform, had a flaw where the thumbnail endpoint did not properly verify passwords for password-protected files. The system checked for ownership or administrator...

GNU Binutils readelf 资源管理错误漏洞

GNU Binutils readelf is a command-line tool from the American GNU community. Versions of GNU Binutils readelf 2.46 and earlier contained a resource management vulnerability. This vulnerability stemmed from improper GOT relocation handling when processing specially crafted ELF binary files, which...

Reachable Assertion

Overview Affected versions of this package are vulnerable to Reachable Assertion in the readelf process when parsing a specially crafted ELF binary containing malformed DWARF abbrev or debug information. An attacker can cause the application to abort and crash by convincing a user to process a...

Phpmassmail EverSync 安全漏洞

Phpmassmail EverSync is a synchronization tool developed by the Phpmassmail company. Version 0.5 of Phpmassmail EverSync contains a security vulnerability. This vulnerability stems from the existence of arbitrary files in the files directory, which may lead to the download of database files...

PT-2026-23654

Natro Macro is an open-source Bee Swarm Simulator macro written in AutoHotkey. Prior to version 1.1.0, any ahk code contained inside of a pattern or path file is executed by the macro. Since users commonly share path/pattern files, an attacker could share a file containing malicious code, which i...

PT-2026-23787

Name of the Vulnerable Software and Affected Versions Flowise versions prior to 3.0.13 Description Flowise has a flaw where the /api/v1/attachments/:chatflowId/:chatId endpoint allows unauthenticated access to the file upload API because it is included in the WHITELIST URLS. The server trusts the...