EUVD-2026-92705

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the delete-team-member RPC allows a team administrator to remove any member other than themselves but does not protect the team owner. A non-owner administrator can delete the owner's team-profile-rel membership and lock t...

CVE-2026-105687

The open-source design and prototyping platform Penpot is vulnerable to a privilege management issue in versions prior to 2.18.0 . A team administrator who is not the owner can exploit the delete-team-member RPC to remove the team owner . Specifically, the system fails to protect the owner's team...

CVE-2020-15906

CVE-2020-15906 شرح لـ CVE-2020-15906. شكر خاص لـ Frederic Mohr Lastbreach على دعمك الخلفي. Tiki Wiki Cms Groupware 16.x - 21.1 تجاوز المصادقة بواسطة Maximilian Barz لقد وجدت ثغرة جديدة في TikiWiki Cms Groupware 16.x - 21.1. تسمح للمهاجمين غير المصادقين عن بُعد بتجاوز صفحة تسجيل الدخول مما يؤدي إل...

Astra Linux – Vulnerability in Tomcat9

Improper handling of the case sensitivity vulnerability in LockOutRealm in Apache Tomcat. This issue affects Apache Tomcat: versions from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 8.5.0 through 8.5.100, and from 7.0.0 through 7.0.109. Older,...

iDict

Avertissement : Faites ce que vous voulez avec ce code tant que vous me créditez @Pr0x13 Vérifiez et assurez-vous que son utilisation est légale dans votre pays avant de le faire. Je ne suis pas responsable des dommages causés de quelque manière que ce soit au compte iCloud ou à l'iDevice de...

CVE-2021-3754

CVE-2021-3754 يوثق هذا المستودع تفاصيل الثغرة الأمنية واستغلالها لـ CVE-2021-3754 التي اكتشفتها وأبلغت عنها بنفسي في 21 أغسطس 2021 المقاييس CWE-20: التحقق غير الصحيح من المدخلات CVSS: 5.3 متوسط الوصف تم العثور على خلل في Apache Keycloak و Redhat SSO حيث يمكن للمهاجم تسجيل نفسه باسم مستخدم مطابق...

CVE-2025-15474

BLE Smart Lock Denial-of-Service DoS Vulnerability Une inondation de connexions Bluetooth Low Energy BLE non authentifiées peut empêcher de manière fiable les utilisateurs légitimes de déverrouiller l'appareil en interrompant la saisie au clavier et en forçant des états de verrouillage répétés. 📌...

POC-CVE-2022-30600

إثبات المفهوم لـ CVE-2022-30600 نظرة عامة يحتوي هذا المستودع على تطبيقين لإثبات المفهوم الذي يستغل CVE-2022-30600. CVE-2022-30600 هي ثغرة أمنية تسمح للمهاجم بتجاوز حد قفل الحساب داخل تطبيق moodle web. كما هو موضح في الإدخال التالي في قاعدة بيانات NVD https://nvd.nist.gov/vuln/detail/CVE-2022-3060...

CVE-2024-10511

CVE-2024-10511 CWE-287: مصادقة غير سليمة الملخص منتج PowerChute Serial Shutdown من Schneider Electric هو برنامج لإدارة UPS يتيح إيقاف تشغيل النظام بشكل سليم وقدرات إدارة الطاقة لأجهزة الكمبيوتر المكتبية والخوادم ومحطات العمل. يحتوي PowerChute Serial Shutdown v1.2.0.301 والإصدارات السابقة له على...

CVE-2026-1199

A flaw was found in Zabbix. The API and Frontend login lockout mechanism does not properly count several unsuccessful login requests if they are sent simultaneously. This oversight allows a remote attacker to bypass the intended lockout counter, potentially enabling more password guesses than...

CVE-2026-104443

YesWiki before 4.6.7 contains an empty-filter scope bypass in the triples delete API that allows any authenticated user to delete or forge arbitrary semantic triples regardless of ownership. Attackers can send an empty filter to the triples delete endpoint to remove the admins-group membership...

CVE-2026-104443 YesWiki before 4.6.7 Scope Bypass via Triples Delete API

YesWiki before 4.6.7 contains an empty-filter scope bypass in the triples delete API that allows any authenticated user to delete or forge arbitrary semantic triples regardless of ownership. Attackers can send an empty filter to the triples delete endpoint to remove the admins-group membership...

EUVD-2026-91454

YesWiki before 4.6.7 contains an empty-filter scope bypass in the triples delete API that allows any authenticated user to delete or forge arbitrary semantic triples regardless of ownership. Attackers can send an empty filter to the triples delete endpoint to remove the admins-group membership...

CVE-2026-104443

YesWiki versions prior to 4.6.7 are vulnerable to an empty-filter scope bypass within the triples delete API . This flaw allows any authenticated user to delete or forge arbitrary semantic triples, bypassing ownership restrictions. By sending an empty filter to the triples delete endpoint, an att...

CVE-2026-104443 YesWiki before 4.6.7 Scope Bypass via Triples Delete API

YesWiki before 4.6.7 contains an empty-filter scope bypass in the triples delete API that allows any authenticated user to delete or forge arbitrary semantic triples regardless of ownership. Attackers can send an empty filter to the triples delete endpoint to remove the admins-group membership...

CVE-2026-104443 YesWiki before 4.6.7 Scope Bypass via Triples Delete API

YesWiki before 4.6.7 contains an empty-filter scope bypass in the triples delete API that allows any authenticated user to delete or forge arbitrary semantic triples regardless of ownership. Attackers can send an empty filter to the triples delete endpoint to remove the admins-group membership...

CVE-2026-104443: Incorrect Authorization

YesWiki before 4.6.7 contains an empty-filter scope bypass in the triples delete API that allows any authenticated user to delete or forge arbitrary semantic triples regardless of ownership. Attackers can send an empty filter to the triples delete endpoint to remove the admins-group membership...

PT-2026-104253

YesWiki before 4.6.7 contains an empty-filter scope bypass in the triples delete API that allows any authenticated user to delete or forge arbitrary semantic triples regardless of ownership. Attackers can send an empty filter to the triples delete endpoint to remove the admins-group membership...

CVE-2026-104181

The Filament full-stack components for Laravel are vulnerable in versions 4.0.0 through 4.13.3 and 5.8.3 . The root cause is that app-based multi-factor authentication (MFA) management actions do not consistently require the current password for confirmation. An attacker with access to an authent...

CVE-2026-104181: Missing Authentication for Critical Function

Filament is a collection of full-stack components for accelerated Laravel development. From 4.0.0 until 4.13.3 and 5.8.3, app-based multi-factor authentication management actions do not consistently require confirmation of the current password. An attacker with access to an authenticated user...