CVE-2026-18994

CVE-2026-18994 is a potential improper authorization vulnerability in the Lenovo File Manager Android Application , which is distributed exclusively in the Chinese market. A local authenticated user could read or modify protected files within the application. Lenovo rates this HIGH severity with ...

aem-xss

徽章 许可证 MIT 安装...

CVE-2025-63946-Tencent-PC-Manager-EoP

CVE-2025-63946 Escalada de Privilegios en Tencent PC Manager versión: PCManager versión menor o igual a 17.10.28554.205 Resumen: Descubrí una vulnerabilidad en Tencent PC Manager donde los archivos y directorios bajo C:\Windows\Temp se manejan de forma insegura. Un atacante puede aprovechar ataqu...

CVE-2009-3036

CVE-2009-3036 SpeeDr00t@Black Falcon bid38241 Symantec IM Manager控制台HTML注入漏洞 信息 讨论 漏洞利用 解决方案 参考 Bugtraq ID: | 38241 ---|--- 类别: | 输入验证错误 CVE: | root@kitploit: CVE-2009-3036 远程: | 是 本地: | 否 发布时间: | 2010年2月18日 12:00AM 更新时间: | 2010年2月18日 12:00AM 致谢: | Rafael B. Brinhosa 受影响版本: | root@kitploit:...

CVE-2026-1937

🔴 漏洞概述 CVE-2026-1937 — 缺失授权 → 任意选项更新 → 权限提升 描述： 用于 WordPress 的 YayMail – WooCommerce 邮件定制器 插件在所有版本（包括 4.3.2 及更早版本）中存在 未授权修改数据，进而导致权限提升 的漏洞。yaymailimportstate AJAX 操作在注册时未经过任何服务端能力检查，使得拥有 商店管理员 Shop Manager 级别或以上 权限的已认证攻击者可以随意调用该操作。通过上传特制的 ZIP 导入文件，攻击者可以静默覆盖任意的 WordPress 站点选项——包括将...

CVE-2026-88055 AnythingLLM: Stored XSS Due to Unescaped Server-Side HTML Concatenation in MetaGenerator

AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. In 1.16.1 and earlier, the manager role can store metapagetitle or metapagefavicon through /api/admin/system-preferences, and MetaGenerator inserts those values into...

CVE-2026-88055

AnythingLLM (by Mintplex-Labs), in versions 1.16.1 and earlier , is affected by a stored XSS caused by unescaped server-side HTML concatenation. The manager role can store meta_page_title or meta_page_favicon via /api/admin/system-preferences; these values pass unchanged through server/models/sys...

CVE-2026-68487

Path traversal in Plesk's Backup Manager causes arbitrary file write as root by an authenticated customer...

netty-handler: Netty: Improper trust manager handling leads to hostname verification bypass

A flaw was found in Netty, a network application framework. This vulnerability allows a remote attacker to bypass hostname verification due to improper handling of user-supplied trust managers. When a client is configured with a plain X.509 Trust Manager X509TrustManager, it fails to perform...

CVE-2026-68487

Path traversal in Plesk's Backup Manager causes arbitrary file write as root by an authenticated customer...

CVE-2026-68487

CVE-2026-68487 is a path traversal vulnerability in Plesk's Backup Manager caused by an unsigned backup header , allowing an authenticated customer to perform an arbitrary file write as root . The vulnerability is scored CVSS 9.9 (Critical) with a changed scope, reflecting high impact on confiden...

EUVD-2026-75596

Path traversal in Plesk's Backup Manager causes arbitrary file write as root by an authenticated customer...

Security Bulletin: IBM i is Affected By Multiple Vulnerabilities in Navigator for i and Digital Certificate Manager for i.

Summary IBM Navigator for i and IBM Digital Certificate Manager DCM for i use Angular for frontend Graphical User Interfaces GUI. Angular is vulnerable to cross-site scripting XSS by permitting event-handler attributes in the i18n pipeline, allowing a lower-trust translation file to inject...

CVE-2025-9223

Applications Manager - Execute Program Action Bypass PoC 📖 説明 このリポジトリには、ManageEngine Applications Managerの「Execute Program Action」機能におけるコマンド実行の脆弱性を実証する概念実証（PoC）が含まれています。 🔍 脆弱性の詳細 Applications Managerは危険なコマンドをブロックするためにブラックリスト（BlackListCommands）を使用していますが、検証には重大な欠陥があります。 最初のトークンのみ に基づく文字列検証 パスの正規化...

Vulnerability fixed in Fortinet FortiOS

Fortinet has fixed a vulnerability in FortiOS FortiSASE and FortiSwitchManager specifically. The vulnerability is located in the cwacd daemon in FortiOS and FortiSwitchManager. This daemon is vulnerable to exploitation by remote, unauthenticated attackers. By sending specially crafted packets or...

CVE-2026-88885

Renovate before 44.14.7 contains a command injection vulnerability in the gomod manager when processing unescaped depName parameters in import-path update commands with binarySource=docker mode. Attackers can inject shell metacharacters through malicious dependency names to execute arbitrary...

CVE-2026-88888

Renovate before 44.14.7 contains a command injection vulnerability in the Mix manager when processing private dependencies with unescaped organization parameters. Attackers can inject shell metacharacters through malicious package names to execute arbitrary commands as the Renovate user in...

CVE-2026-88888

A flaw was found in Renovate. Attackers can exploit a command injection vulnerability in the Mix manager by injecting shell metacharacters through malicious package names when processing private dependencies with unescaped organization parameters. This allows for the execution of arbitrary comman...

The Vault by Focused Hunts

The Vault 你的秘密。由你掌控。 大多数密码管理器都要求你把敏感数据托付给你并不了解的公司。它们掌控着服务器和密钥，你只能寄希望于不出差错。The Vault 的做法截然不同。你的加密保险库文件存放在你已在使用且信任的云存储中，例如 Google Drive、OneDrive、Dropbox，不久之后还可以是你自己的服务器。 Focused Hunts 开发了这款应用，但我们永远看不到你的数据，不运行存储数据的服务器，也没有任何机制访问这些数据。我们手中没有你的信息，因此也无从被攻破。 The Vault 对个人使用完全免费，而且将永远如此。你获得强加密、多云同步、YubiKey...

CVE-2026-88888 Renovate before 44.14.7 Command Injection via Mix organization

Renovate before 44.14.7 contains a command injection vulnerability in the Mix manager when processing private dependencies with unescaped organization parameters. Attackers can inject shell metacharacters through malicious package names to execute arbitrary commands as the Renovate user in...