CVE-2025-57819

CVE-2025-57819 Resumen de esta vulnerabilidad citado de @jfinstrom aquí Alrededor del 2025-08-21, múltiples sistemas FreePBX comenzaron a mostrar errores y posteriormente se confirmaron compromisos. El proveedor Sangoma/Equipo de Seguridad de FreePBX publicó un aviso el 2025-08-26 instando a los...

CVE-2026-90561

Strapi versions 4.x through 4.26.2 and 5.x before 5.48.1 contain a stored cross-site scripting vulnerability in the content manager WYSIWYG preview component that fails to strip script tags from rich text. An Author-role user can store malicious script tags in rich text fields that execute in an...

CVE-2026-90561 Strapi 4.x through 4.26.2 and 5.x before 5.48.1 Stored XSS via WYSIWYG

Strapi versions 4.x through 4.26.2 and 5.x before 5.48.1 contain a stored cross-site scripting vulnerability in the content manager WYSIWYG preview component that fails to strip script tags from rich text. An Author-role user can store malicious script tags in rich text fields that execute in an...

CVE-2026-90561 Strapi 4.x through 4.26.2 and 5.x before 5.48.1 Stored XSS via WYSIWYG

Strapi versions 4.x through 4.26.2 and 5.x before 5.48.1 contain a stored cross-site scripting vulnerability in the content manager WYSIWYG preview component that fails to strip script tags from rich text. An Author-role user can store malicious script tags in rich text fields that execute in an...

pmg

Package Manager Guard PMG Block malicious npm and pip packages before they install. Defense in depth for the package managers you already use...

pmg

Package Manager Guard PMG Block malicious npm and pip packages before they install. Defense in depth for the package managers you already use...

TeamPass

Teampass Self-hosted password management your whole team can trust Folder-level access control · authenticated AES-256-GCM encryption · compliance evidence Your secrets never leave your infrastructure. 🌐teampass.net · 📖Documentation · 💬Discussions · 🐳Docker Hub Contents About Who it's for Securit...

CVE-2026-59243

CVE-2026-59243 — Apache Airflow FAB Auth Manager JWT 签名绕过 韩语版： README.ko.md Apache 公告： https://lists.apache.org/thread/x4784l7z00tl3gw4tv2dmvoon77rxgpl（发布于 2026-07-29） CVE 记录： https://vulners.com/cve/CVE-2026-59243 修复版本： apache-airflow-providers-fab==3.7.3 漏洞类别： CWE-347，预认证 JWT 签名验证绕过 → 管理员接管 报告者...

CVE-2025-0316-Exploit

CVE-2025-0316-Exploit CVE-2025-0316 漏洞利用工具包 🚨 WordPress 插件 WP Directorybox Manager 🔥 CVE-2025-0316 自动利用脚本 — 通过有漏洞的 AJAX 动作实现授权绕过。 ⚠️ 法律声明 此工具严格仅用于： 研究 红队模拟 授权的安全评估 未经同意使用此工具针对目标是非法的。 🛠 功能 🔍 通过 ?author= 技巧枚举用户 🚪 利用有漏洞的插件动作获取管理员面板访问权限 🧠 自动保存 Cookie + 登录弹窗 🌐 代理支持 + 随机 User-Agent 💻 多线程且可调节延迟 ✅ 测试环境...

CVE-2026-37071

CVE-2026-37071 Veno File Manager Project 4.4.9 中 Actions::renameFile 函数存在任意文件重命名漏洞，可导致权限提升。经认证且拥有 'reanme' 权限的攻击者可通过向受影响端点发送特制 POST 请求，重命名应用程序配置文件，触发配置重建并将超级管理员凭据重置为默认值，从而接管超级管理员账户。 https://github.com/user-attachments/assets/c729b835-3285-4853-8fe2-a485bc88ab79...

CVE-2026-37069

CVE-2026-37069 Veno File Manager Project 4.4.9 中的 /vfm-admin/assets/zipstream/grandt/relativepath/RelativePath.Example1.php 存在绝对路径泄露（Absolute Path Disclosure）漏洞，允许未认证攻击者通过向该端点发送 GET 请求，获知应用程序代码运行所在的系统目录。...

CVE-2026-90493

A vulnerability was detected in Tonec Internet Download Manager up to 6.42 Build 63 on Windows. The impacted element is an unknown function of the file idmwfp.sys of the component Kernel Driver. The manipulation results in improper access controls. Attacking locally is a requirement. Internet...

EUVD-2026-76938

A vulnerability was detected in Tonec Internet Download Manager up to 6.42 Build 63 on Windows. The impacted element is an unknown function of the file idmwfp.sys of the component Kernel Driver. The manipulation results in improper access controls. Attacking locally is a requirement. The exploit ...

CVE-2026-90493 Tonec Internet Download Manager Kernel Driver idmwfp.sys access control

A vulnerability was detected in Tonec Internet Download Manager up to 6.42 Build 63 on Windows. The impacted element is an unknown function of the file idmwfp.sys of the component Kernel Driver. The manipulation results in improper access controls. Attacking locally is a requirement. Internet...

CVE-2026-90493

Tonec Internet Download Manager (up to 6.42 Build 63, Windows) contains an improper access control vulnerability in its kernel driver (idmwfp.sys). A local attacker with low privileges can exploit this to gain system-level access , as indicated by the changed scope and high impact across confiden...

CVE-2026-20262-Cisco-Catalyst-SD-WAN-Manager-Arbitrary-File-Write-

CVE-2026-20262 - Cisco Catalyst SD-WAN Manager 任意文件写入（路径遍历） -orange 📋 描述 CVE-2026-20262 是 Cisco Catalyst SD-WAN Manager （原 SD-WAN vManage）Web 界面中的一个路径遍历（CWE-22）漏洞。它允许拥有写入权限的认证攻击者通过向 AnyConnect 配置文件上传端点发送精心构造的 HTTP 请求，在底层操作系统中创建或覆盖任意文件。 ⚠️ 危急状态 ：该漏洞正在被积极利用 （Cisco PSIRT 于 2026 年 6 月确认为 0-day）。CISA...

PT-2026-90783

A high-severity vulnerability in the Tonec Internet Download Manager kernel driver enables local privilege escalation on Windows systems, with a public exploit already available and no vendor patch released. Key Points: CVE-2026-90493 is a high-severity improper access control flaw in the...

CVE-2026-37066

CVE-2026-37066 路径遍历导致任意文件读取，影响 Veno File Manager Project 4.4.9 中的 /vfm-admin/index.php 和 /vfm-admin/ajax/streamvid.php。具有超级管理员角色的已认证攻击者可通过向受影响端点发送两个特制的 HTTP 请求（POST 和 GET）来泄露敏感信息。 https://github.com/user-attachments/assets/79517c2c-049d-4ea8-b359-43244a9cbc5c...

westone-CVE-2021-45232-scanner

westone-CVE-2021-45232-scanner Apache APISIX Dashboard 早期版本（2.10.1）存在未授权访问的安全漏洞。 Manager API 使用了两个框架，在 gin 框架的基础上引入了 droplet 框架，所有 API 和身份验证中间件均基于 droplet 框架开发，但部分 API 直接使用了 gin 框架的接口，从而绕过了身份验证。 安装与使用 git clone https://github.com/Osyanina/westone-CVE-2021-45232-scanner.git cd...

CVE-2025-27558_Patching

CVE-2025-27558Patching 修补影响我 Linux 镜像的 CVE-2025-27558 漏洞。 Atlas 事件：意外的出站连接 197.155.77.1 该文件夹记录了在 Atlas 机器（一个由 Wazuh 监控的 Ubuntu 系统）上检测到的真实网络异常。 在修补 CVE-2025-27558 的例行系统更新期间，Atlas 意外尝试从一个配置错误的 HTTP 镜像 197.155.77.1:80 获取软件包。该服务器公开暴露了目录列表 CPAN/，并返回 404 错误——触发了全面的事件调查。 包含内容...