CVE

CVE Writeups for CVE-2025-67586, CVE-2025-67985, CVE-2025-67986 -------------- CVE-2025-67586 Exploit PoC -------------- Exploit Title: WordPress Plugin 5.2.0 - Broken Access Control Software Link: https://wordpress.org/plugins/highlight-and-share/ Version: Description A broken access control...

CVE-2005-0603-phpBB-2.0.12-Full-path-disclosure

CVE: https://vulners.com/cve/CVE-2005-0603 Neo Security Team NST® - Advisory 06 - 25/02/05 Program: phpBB 2.0.12 Homepage: http://www.phpbb.com Vulnerable Versions: phpBB 2.0.12 & Lower versions Risk: Low Risk!! Impact: Full path disclosure -==phpBB 2.0.12 Full path disclosure==- Description phpB...

CLSA-2026-1792516123 TuxCare security update for @babel/highlight (2 CVEs)

TuxCare rebuilt @babel/highlight to address 2 CVEs. Fixed in 7.16.7-tuxcare.2...

CLSA-2026-1792516122 TuxCare security update for @babel/highlight (2 CVEs)

TuxCare rebuilt @babel/highlight to address 2 CVEs. Fixed in 7.24.5-tuxcare.1...

CLSA-2026-1792516124 TuxCare security update for @babel/highlight (1 CVE)

TuxCare rebuilt @babel/highlight to address 1 CVE. Fixed in 7.16.7-tuxcare.3...

CLSA-2026-1792516120 TuxCare security update for @babel/highlight (1 CVE)

TuxCare rebuilt @babel/highlight to address 1 CVE. Fixed in 7.18.9-tuxcare.3...

CLSA-2026-1792516121 TuxCare security update for @babel/highlight (1 CVE)

TuxCare rebuilt @babel/highlight to address 1 CVE. Fixed in 7.25.7-tuxcare.4...

CLSA-2026-1792516117 TuxCare security update for @babel/highlight (1 CVE)

TuxCare rebuilt @babel/highlight to address 1 CVE. Fixed in 7.24.5-tuxcare.2...

CLSA-2026-1792516112 TuxCare security update for @babel/highlight (1 CVE)

TuxCare rebuilt @babel/highlight to address 1 CVE. Fixed in 7.18.9-tuxcare.2...

CLSA-2026-1792516114 TuxCare security update for @babel/highlight (1 CVE)

TuxCare rebuilt @babel/highlight to address 1 CVE. Fixed in 7.21.5-tuxcare.1...

CLSA-2026-1792516115 TuxCare security update for @babel/highlight (1 CVE)

TuxCare rebuilt @babel/highlight to address 1 CVE. Fixed in 7.21.0-tuxcare.4...

CLSA-2026-1792516116 TuxCare security update for @babel/highlight (2 CVEs)

TuxCare rebuilt @babel/highlight to address 2 CVEs. Fixed in 7.21.5-tuxcare.2...

CLSA-2026-1792516113 TuxCare security update for @babel/highlight (1 CVE)

TuxCare rebuilt @babel/highlight to address 1 CVE. Fixed in 7.12.18-tuxcare.2...

CLSA-2026-1792386963 TuxCare security update for @storybook/addon-highlight (1 CVE)

TuxCare rebuilt @storybook/addon-highlight to address 1 CVE. Fixed in 7.0.7-tuxcare.1...

CVE-2026-61610

Lychee is a free, open-source photo-management tool. Prior to 7.6.1, when photosstarvisibility is set to anonymous, POST /api/v2/Photo::highlight can fetch and modify a photo without confirming that the caller can see it. BaseApiRequest::validateResolved invokes...

CVE-2026-61610 Lychee: unauthenticated photo starring reveals existence of private photos when photos_star_visibility=anonymous

Lychee is a free, open-source photo-management tool. Prior to 7.6.1, when photosstarvisibility is set to anonymous, POST /api/v2/Photo::highlight can fetch and modify a photo without confirming that the caller can see it. BaseApiRequest::validateResolved invokes...

CVE-2026-61610

The photo-management tool Lychee is vulnerable to an improper access control issue in versions prior to 7.6.1 . When photos_star_visibility is set to anonymous, the POST /api/v2/Photo::highlight endpoint fails to verify if a caller has permission to see a photo before processing the request. Spec...

EUVD-2026-102190

Lychee is a free, open-source photo-management tool. Prior to 7.6.1, when photosstarvisibility is set to anonymous, POST /api/v2/Photo::highlight can fetch and modify a photo without confirming that the caller can see it. BaseApiRequest::validateResolved invokes...

CVE-2026-61610 Lychee: unauthenticated photo starring reveals existence of private photos when photos_star_visibility=anonymous

Lychee is a free, open-source photo-management tool. Prior to 7.6.1, when photosstarvisibility is set to anonymous, POST /api/v2/Photo::highlight can fetch and modify a photo without confirming that the caller can see it. BaseApiRequest::validateResolved invokes...

CVE-2026-61610 Lychee: unauthenticated photo starring reveals existence of private photos when photos_star_visibility=anonymous

Lychee is a free, open-source photo-management tool. Prior to 7.6.1, when photosstarvisibility is set to anonymous, POST /api/v2/Photo::highlight can fetch and modify a photo without confirming that the caller can see it. BaseApiRequest::validateResolved invokes...