nccfsas

Introduction This repository holds information released publicly by NCC Group's Full Spectrum Attack Simulation FSAS team...

LoLLMS WebUI - Subfolder Prediction via Path Traversal

A Path Traversal vulnerability exists in the parisneo/lollms-webui, specifically within the 'addreferencetolocalmode' function due to the lack of input sanitization. This vulnerability affects versions v9.6 to the latest. id: CVE-2024-4841 info: name: LoLLMS WebUI - Subfolder Prediction via Path...

CVE-2026-70045

Use after free in Windows Work Folders allows an authorized attacker to elevate privileges locally...

CVE-2026-70045

A Use after free vulnerability in Windows Work Folders allows an authorized attacker to achieve local privilege escalation . The vulnerability's impact includes high levels of confidentiality, integrity, and availability. An official fix is available, as indicated by the remediation level. No spe...

Windows Work Folders Elevation of Privilege Vulnerability

Use after free in Windows Work Folders allows an authorized attacker to elevate privileges locally...

EUVD-2026-98081

IBM Planning Analytics 2.0, and 2.1 could allow a remote authenticated attacker to delete folders and applications belonging to other users due to improper functional level access control...

CVE-2026-17475

IBM Planning Analytics 2.0, and 2.1 could allow a remote authenticated attacker to delete folders and applications belonging to other users due to improper functional level access control...

CVE-2026-17475

IBM Planning Analytics versions 2.0 and 2.1 are affected by a security vulnerability where a remote authenticated attacker can delete folders and applications belonging to other users. This is caused by improper functional level access control (CWE-285). The vulnerability has a High base severity...

CVE-2026-17475 IBM Planning Analytics Local is affected by security vulnerabilities

IBM Planning Analytics 2.0, and 2.1 could allow a remote authenticated attacker to delete folders and applications belonging to other users due to improper functional level access control...

CVE-2026-21986-VirtualBox-DoS

CVE-2026-21986 - VirtualBox Shared Folders Kernel Memory Exhaustion DoS Overview This repository contains a proof of concept and technical write-up for CVE-2026-21986, a denial-of-service vulnerability in Oracle VM VirtualBox. The issue exists in the Shared Folders driver interface and allows...

CVE-2026-107573

Incorrect default permissions in the Windows installer of Progressive Robot hMailServer 6.0.0 through 6.3.5 allow a local authenticated user to read the mail server's data. The installer created the data, log, temp, database and event folders and the hMailServer.INI configuration file with the...

The vulnerability of the Work Folders service in Windows operating systems allows attackers to escalate their privileges.

The vulnerability of the Work Folders service in Windows operating systems is related to the operation of data out of the buffer into memory. Exploiting this vulnerability can allow an attacker to increase their privileges...

CVE-2026-97267

Subscriber Broken Access Control in Prevent files / folders access = 2.6.7 versions...

EUVD-2026-89919

Subscriber Broken Access Control in Prevent files / folders access = 2.6.7 versions...

CVE-2026-97267 WordPress Prevent files / folders access plugin <= 2.6.7 - Broken Access Control vulnerability

Subscriber Broken Access Control in Prevent files / folders access = 2.6.7 versions...

CVE-2026-97267

The Prevent files / folders access plugin for WordPress is affected by a Broken Access Control vulnerability in versions

CVE-2026-97267 WordPress Prevent files / folders access plugin <= 2.6.7 - Broken Access Control vulnerability

Subscriber Broken Access Control in Prevent files / folders access = 2.6.7 versions...

WordPress Prevent files / folders access plugin <= 2.6.7 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by gueco in WordPress Plugin Prevent files / folders access versions = 2.6.7...

PT-2026-103251

Subscriber Broken Access Control in Prevent files / folders access = 2.6.7 versions...

WordPress Media Library Folders plugin <= 8.4.1 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Media Library Folders versions = 8.4.1...