ntfy 代码注入漏洞

NTFY is a notification service system developed by Philipp Heckel, designed to enable cross-device message delivery through the publish-subscribe mechanism. Versions of NTFY prior to version 2.21 contained a code injection vulnerability. This vulnerability stemmed from issues with the parseAction...

Huawei HarmonyOS Notification Service Competitive Conditions Vulnerability

Huawei HarmonyOS is an operating system from Huawei China. It provides a full-scenario distributed operating system based on a microkernel. A competitive condition vulnerability exists in the Huawei HarmonyOS notification service, which can be exploited by attackers to cause availability to be...

EUVD-2026-21792

Race condition vulnerability in the notification service. Impact: Successful exploitation of this vulnerability may affect availability...

CVE-2026-34850

Race condition vulnerability in the notification service. Impact: Successful exploitation of this vulnerability may affect availability...

CVE-2026-34850

Race condition vulnerability in the notification service. Impact: Successful exploitation of this vulnerability may affect availability...

CVE-2026-34850

Race condition vulnerability in the notification service. Impact: Successful exploitation of this vulnerability may affect availability...

CVE-2026-34850

Race condition vulnerability in the notification service. Impact: Successful exploitation of this vulnerability may affect availability...

CVE-2026-34850

Technical details for CVE-2026-34850 are not publicly available in the provided documents. Monitor for updates from sources such as NVD and the vendor advisories.

Huawei HarmonyOS 安全漏洞

Huawei HarmonyOS is an operating system from Huawei China. It provides a full-scenario distributed operating system based on a microkernel. A competitive condition vulnerability exists in the Huawei HarmonyOS notification service, which can be exploited by attackers to cause availability to be...

CVE-2026-34850: Concurrent Execution using Shared Resource with Improper Synchronization

Race condition vulnerability in the notification service. Impact: Successful exploitation of this vulnerability may affect availability...

PT-2026-32231

Race condition vulnerability in the notification service. Impact: Successful exploitation of this vulnerability may affect availability...

Exploit for Server-Side Request Forgery in Useplunk Plunk

CVE-2026-32096 SSRF via unvalidated AWS SNS SubscriptionCon...

CVE-2026-32096 Plunk has SSRF via unvalidated AWS SNS SubscriptionConfirmation in POST /webhooks/sns

Plunk is an open-source email platform built on top of AWS SES. Prior to 0.7.0, a Server-Side Request Forgery SSRF vulnerability existed in the SNS webhook handler. An unauthenticated attacker could send a crafted request that caused the server to make an arbitrary outbound HTTP GET request to an...

CVE-2024-26477

The open-source monitoring software Statping-ng v.0.91.0 is vulnerable to the exposure of sensitive information due to improper handling of crafted requests. Specifically, an attacker can target the api parameter within the oauth , amazon_sns , and export endpoints. Additionally, the /api/users e...

GHSA-2VGV-HGV4-22MH Gitea improperly exposes issue and pull request titles

Gitea's notification API does not re-validate repository access permissions when returning notification details. After a user's access to a private repository is revoked, they may still view issue and pull request titles through previously received notifications...

Gitea improperly exposes issue and pull request titles

Gitea's notification API does not re-validate repository access permissions when returning notification details. After a user's access to a private repository is revoked, they may still view issue and pull request titles through previously received notifications...

CVE-2026-20800

Gitea's notification API does not re-validate repository access permissions when returning notification details. After a user's access to a private repository is revoked, they may still view issue and pull request titles through previously received notifications...

CVE-2026-20800 Notification API Leaks Private Repository Issue Titles After Collaborator Permission Revocation

Gitea's notification API does not re-validate repository access permissions when returning notification details. After a user's access to a private repository is revoked, they may still view issue and pull request titles through previously received notifications...

PT-2025-50802

Name of the Vulnerable Software and Affected Versions ADM versions 4.1.0 through 4.3.3.RKD2 ADM versions 5.0.0 through 5.1.0.RN42 Description An improperly validated TLS/SSL certificate when sending emails to an SMTP server via msmtp allows an attacker intercepting network traffic to execute a...

CVE-2025-48584

In multiple functions of NotificationManagerService.java, there is a possible way to bypass the per-package channel limits causing resource exhaustion. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation...