EUVD-2026-73251

Allocation of resources without limits or throttling in Active Directory Federation Services AD FS allows an unauthorized attacker to deny service over a network...

ChExp_CVE-2021-30632

Este repositorio no tiene un README...

ChExp-CVE-2022-0337-

Este repositorio no tiene un README...

CVE-2025-60503

CVE-2025-60503 — UltimatePOS UltimateFosters v4.8 中的存储型跨站脚本（XSS）漏洞 发布日期： 2025-10-30 CVE ID： CVE-2025-60503 已预留 研究人员： Vivien Lebas 厂商： UltimateFosters 产品： UltimatePOS 受影响版本： 4.8 漏洞类型： 存储型跨站脚本（XSS） 严重性： 高危 概述 UltimatePOS 管理后台（v4.8）存在一个存储型 XSS 漏洞。 采购 模块中的参考编号 字段接受未经清理的用户输入，之后在报表 → 活动日志 页面渲染时未进行适当转义。...

CVE-2021-26084

CVE-2021-26084 CVE-2021-26084, Atlassian Confluence OGNL Injection Vulnerability Atlassian Confluence is a widely used wiki system in enterprises, and some versions contain an OGNL expression injection vulnerability. Attackers can exploit this vulnerability to execute arbitrary code on the target...

CVE-2026-86729

WWBN AVideo through commit e01e41ecc no patched version available exposes getapipreauthorize in plugin/API/API.php as a second, undocumented login path. Unlike getapisignIn, which enforces a rate limit of 10 attempts per 5 minutes via checkRateLimit, getapipreauthorize performs the same credentia...

CVE-2019-0841

This repository does not have a README...

CVE-2026-73309

creationtimestamp| type| source ---|---|--- 2026-09-08 16:07:16+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3muzfquuajh2g 2026-09-09 01:50:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mv2gcym2a22j...

CVE-2026-86729

WWBN AVideo through commit e01e41ecc (no patched version available) exposes get_api_preauthorize in plugin/API/API.php as an undocumented login path. Unlike get_api_signIn , which enforces a rate limit of 10 attempts per 5 minutes via checkRateLimit(), this endpoint performs the same credential c...

EUVD-2026-72865

WWBN AVideo through commit e01e41ecc no patched version available exposes getapipreauthorize in plugin/API/API.php as a second, undocumented login path. Unlike getapisignIn, which enforces a rate limit of 10 attempts per 5 minutes via checkRateLimit, getapipreauthorize performs the same credentia...

CVE-2026-86724

AVideo (through commit c3edcc274c389816d434acadac07ee78eaf330c1) contains a cross-site request forgery (CSRF) vulnerability in plugin/YPTWallet/view/saveBalance.php . The flaw arises because the endpoint relies solely on session cookies without token validation , allowing an attacker to craft a m...

CVE-2026-86718

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request forgery (CSRF) vulnerability in deleteHistory.json.php and finishAll.json.php . The root cause is the absence of CSRF token validation on GET requests , allowing unauthenticated attackers to craft ma...

EUVD-2026-72854

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request forgery vulnerability in deleteHistory.json.php and finishAll.json.php that allows unauthenticated attackers to mutate live history by making GET requests without CSRF token validation. Attackers can...

CVE-2026-77103

creationtimestamp| type| source ---|---|--- 2026-09-08 15:00:45+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/63375w6i6ovp4...

CVE-2026-12940-Langflow-Unauth-RCE

CVE-2026-12940 — Langflow OSS ≤ 1.10.1 Unauthenticated RCE MCP stdio env-var injection Unauthenticated remote code execution in Langflow OSS through 1.10.1. The environment-variable blocklist that guards MCP stdio server configuration DANGEROUSENVVARS omits SHELLOPTS, BASHOPTS and PS4. Because th...

CVE-2026-78135

creationtimestamp| type| source ---|---|--- 2026-09-08 13:35:07+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3muz5arz6362i 2026-09-11 04:07:56+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/i4cwgybeay5qa...

CVE-2026-78131

creationtimestamp| type| source ---|---|--- 2026-09-08 13:35:07+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3muz5arz6362i...

CVE-2026-40864

CVE-2026-40864 — 通过跨源表单 POST 绕过 JupyterHub XSRF（Sec-Fetch-Mode: no-cors） 严重级别 ：中等 CWE ：CWE-352 — 跨站请求伪造 XSRF 影响版本 ：jupyterhub 4.1.0 ≤ 版本 分配的模式——这恰恰是令牌本该阻止的经典 CSRF 向量。因此，任何接受简单表单体且仅依赖此 XSRF 检查的状态更改端点，都可被跨源伪造。 将其映射到实际端点：/hub/spawn（启动受害者的服务器）和 /hub/accept-share（让受害者接受攻击者服务器的共享）都是通过此检查的表单 POST。 影响...

CVE-2025-55182-analysis

Análisis Técnico de CVE-2025-55182: Mi Viaje de Investigación ⚠️ Aviso de Exención de Responsabilidad Importante Este documento describe mi proceso de investigación personal sobre CVE-2025-55182, incluyendo hallazgos confirmados y experimentos que realicé. Esto representa un relato honesto de mi...

CVE-2026-80219

A flaw in hawtio-operator (OpenShift cluster mode) allows OAuth token theft. The operator creates a cluster-scoped OAuthClient with GrantMethod: auto and no client secret (public client). Because redirect URIs are derived from an operator-created Route whose hostname is tenant-controlled via the ...