CLEANSTART-2026-HR55516 nanoid is a secure, URL-friendly, unique string ID generator for JavaScript

Security vulnerability affects the qdrant package. nanoid is a secure, URL-friendly, unique string ID generator for JavaScript...

EUVD-2026-84988

A weakness has been identified in itsourcecode Leave Management System 1.0. Impacted is an unknown function of the file /module/leavetype/index.php. This manipulation of the argument ID causes sql injection. The attack may be initiated remotely. The exploit has been made available to the public a...

CVE-2026-95833

A weakness has been identified in itsourcecode Leave Management System 1.0. Impacted is an unknown function of the file /module/leavetype/index.php. This manipulation of the argument ID causes sql injection. The attack may be initiated remotely. The exploit has been made available to the public a...

CVE-2026-95833 itsourcecode Leave Management System index.php sql injection

A weakness has been identified in itsourcecode Leave Management System 1.0. Impacted is an unknown function of the file /module/leavetype/index.php. This manipulation of the argument ID causes sql injection. The attack may be initiated remotely. The exploit has been made available to the public a...

CVE-2026-19202

The mcp-toolbox-sdk-python SDK contains a caching flaw within its toolbox-core package. The module-level token cache fails to uniquely key Google ID tokens by the requested audience. If an application authenticates to multiple audiences (e.g., Service A and Service B) within the same process, a v...

CVE-2026-19202 Token Cache Reuse in mcp-toolbox-sdk-python

A caching flaw in the toolbox-core package of the mcp-toolbox-sdk-python SDK causes the same Google ID token to be cached and reused across different audiences. If an application uses the SDK to authenticate to two or more different audiences within the same process, the module-level token cache...

EntraTrace

EntraTrace EntraTrace es una herramienta de investigación de seguridad defensiva para documentar e identificar el comportamiento observable de herramientas ofensivas dirigidas a Microsoft Entra ID. El proyecto construye una base de conocimiento automática en torno a herramientas como AzureHound,...

CVE-2026-94450

Improper validation of the Destination Connection ID length in s2n-quic 1.88.0 and earlier may allow an unauthenticated remote user to cause a denial of service by shutting down a server endpoint via a single crafted UDP datagram. Only server endpoints specifically configured to send Retry packet...

CVE-2026-94450 Potential denial of service when configured to send Retry packets in s2n-quic

Improper validation of the Destination Connection ID length in s2n-quic 1.88.0 and earlier may allow an unauthenticated remote user to cause a denial of service by shutting down a server endpoint via a single crafted UDP datagram. Only server endpoints specifically configured to send Retry packet...

CVE-2026-94450

The s2n-quic library, version 1.88.0 and earlier , contains a vulnerability where improper validation of the Destination Connection ID length can be exploited. An unauthenticated remote user can trigger a denial of service by shutting down a server endpoint using a single crafted UDP datagram . T...

CVE-2024-32370

CVE-2024-32370 Vulnerability Description Issue An issue in HSC Cybersecurity HSC Mailinspector version 5.2.17-3 has been identified, allowing a remote attacker to obtain sensitive information via a crafted payload to the id parameter in the mliSystemUsers.php component. Vulnerable Component...

CVE-2026-94462

The open source e-commerce solution Spree is vulnerable to a broken access control (IDOR) issue in versions 5.4.0 through 5.4.4 and 5.5.4 . The vulnerability exists in the Spree::Api::V3::Store::CartsController#associate method, where the PATCH /api/v3/store/carts/:id/associate endpoint uses find...

EUVD-2026-84794

Spree is an open source e-commerce solution built with Ruby on Rails. From 5.4.0 until 5.4.4 and 5.5.4, PATCH /api/v3/store/carts/:id/associate in Spree::Api::V3::Store::CartsControllerassociate uses findcartforassociation to locate a cart by prefixedid but does not require a cart token or...

CVE-2026-94462 Spree: Broken Access Control in `PATCH /api/v3/store/carts/:id/associate` (IDOR)

Spree is an open source e-commerce solution built with Ruby on Rails. From 5.4.0 until 5.4.4 and 5.5.4, PATCH /api/v3/store/carts/:id/associate in Spree::Api::V3::Store::CartsControllerassociate uses findcartforassociation to locate a cart by prefixedid but does not require a cart token or...

CVE-2025-28073

CVE-2025-28073 Suggested description phpList 3.6.3 is vulnerable to Reflected Cross-Site Scripting XSS via the /lists/dl.php endpoint. An attacker can inject arbitrary JavaScript code by manipulating the id parameter, which is improperly sanitized. Vulnerability Type Cross Site Scripting XSS Vend...

CVE-2019-13361

CVE-2019-13361 Cómo Paquete 1: el atacante actualiza la configuración Wi-Fi Paquete 2: el dispositivo responde con su ID y un código de éxito/error Paquete 3: el atacante desarma el dispositivo usando el ID...

EUVD-2026-84526

Aureus ERP before 1.5.0 fails to scope message lookups to the current record in ChatterPanel, allowing authenticated users to access arbitrary messages. Attackers can submit sequential message IDs to read, edit, delete, or pin messages from other departments or companies, and enumerate all notes ...

CVE-2026-95655

Aureus ERP before 1.5.0 contains an IDOR vulnerability in the ChatterPanel Livewire component (Webkul Chatter plugin). Message lookups are not scoped to the current record, allowing any authenticated user to submit sequential message IDs and read, edit, delete, or pin messages belonging to other ...

rails-cve-2017-17917

rails-cve-2017-17917 The project demonstrates the replication of a SQL injection vulnerability in the id parameter, and subsequently provides insights into mitigating and resolving this security issue. https://www.cvedetails.com/cve/CVE-2017-17917/?q=CVE-2017-17917 Stack : root@kitploit: Ruby:...

FOXCMS-CVE-2025-29306-POC

FOXCMS Parameter Injection RCE – CVE-2025-29306 This repository contains a Python-based PoC for a Remote Code Execution RCE vulnerability affecting FOXCMS v1.2, a Chinese open-source content management system. CVE-ID: CVE-2025-29306 Affects: FOXCMS v1.2 Type: Service Parameter Injection → Code...