CVE-2026-71204-PoC

CVE-2026-71204 — changedetection.io: /settings 保存時のチェックボックス省略により API キー強制が静かに無効化される 製品: dgtlmoon/changedetection.io — v0.55.7 ファイル: changedetectionio/blueprint/settings/init.py, changedetectionio/forms.py CWE: CWE-284 — 不適切なアクセス制御 CVSS 3.1: AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:L — 6.3 中 CNA: Turan...

cve-2021-38647

cve-2021-38647 https://github.com/corelight/CVE-2021-38647 의 군더더기 없는 버전 CVE-2021-38647 일명 "OMIGOD" CVE-2021-38647일명 OMIGOD 익스플로잇 시도를 탐지하는 Zeek 패키지입니다. https://corelight.com/blog/detecting-cve-2021-38647-omigod https://www.wiz.io/blog/omigod-critical-vulnerabilities-in-omi-azure...

Mikrotrick_POC

RouterOS SSH モジュラス混乱検証ツール CVE-2026-67276 MikroTik RouterOS CVE-2026-67276 における SSH公開鍵認証バイパス脆弱性 を検出するために設計された自動化された動作検証ツールです。 このスクリプトは、対象となる公開鍵のモジュラスのみに一致する偽造署名を使用してハンドシェイクを確立することで、SSHサービスの不完全な検証の欠陥が認証を許可するかどうかをテストします。 脆弱性の概要 CVE-2026-67276 は、RouterOS...

Sudo-Security-Bypass-CVE-2019-14287

Sudo-Security-Bypass-CVE-2019-14287 =========================================================================== ██████╗██╗ ██╗███████╗ ██████╗ ██████╗ ██╗ █████╗ ██╗██╗ ██╗██████╗ █████╗ ███████╗ ██╔════╝██║ ██║██╔════╝ ╚════██╗██╔═████╗███║██╔══██╗ ███║██║ ██║╚════██╗██╔══██╗╚════██║ ██║ ██║...

CVE-2026-100640

SiYuan before v3.8.4 contains an authorization omission in the siyuan-get IPC handler that allows remote-kernel renderers to access native clipboard formats by invoking clipboardReadMathML, clipboardReadOffice, and clipboardReadWPS commands with matching plaintext. Attackers controlling remote...

EUVD-2026-87734

SiYuan before v3.8.4 contains an authorization omission in the siyuan-get IPC handler that allows remote-kernel renderers to access native clipboard formats by invoking clipboardReadMathML, clipboardReadOffice, and clipboardReadWPS commands with matching plaintext. Attackers controlling remote...

CVE-2026-100640

SiYuan versions before v3.8.4 are vulnerable to an authorization omission in the siyuan-get IPC handler. This flaw allows remote-kernel renderers to access native clipboard formats by invoking specific commands, including clipboardReadMathML, clipboardReadOffice, and clipboardReadWPS, using match...

CVE-2026-100551

OpenClaw for iOS versions >= 2026.7.1 and

CVE-2026-92774 Wiki.js through 2.5.314 Authorization Bypass via GraphQL Tag Omission

Wiki.js through 2.5.314 omits page tags from authorization checks in multiple GraphQL resolvers, allowing tag-based access restrictions to be bypassed. Attackers can query the list, tree, tags, searchTags, and links resolvers to retrieve restricted page metadata including titles, descriptions,...

CVE-2026-59965 @jhb.software/payload-alt-text-plugin: Alt Text Endpoint Authorization Bypass via Payload Local API `overrideAccess` Omission

Payload Plugins is a collection of plugins designed to enhance Payload CMS. In 0.7.0, @jhb.software/payload-alt-text-plugin exposes POST /api/alt-text-plugin/generate and POST /api/alt-text-plugin/bulk with a default guard that accepts any authenticated user, while...

CVE-2026-55866

SpiceDB is an open source database system for creating and managing security-critical application permissions. From 1.34.0 until 1.54.0, SpiceDB can return PERMISSIONSHIPHASPERMISSION instead of PERMISSIONSHIPCONDITIONALPERMISSION or PERMISSIONSHIPNOPERMISSION because checkRequestToKey and...

EUVD-2026-77689

SpiceDB is an open source database system for creating and managing security-critical application permissions. From 1.34.0 until 1.54.0, SpiceDB can return PERMISSIONSHIPHASPERMISSION instead of PERMISSIONSHIPCONDITIONALPERMISSION or PERMISSIONSHIPNOPERMISSION because checkRequestToKey and...

CVE-2026-54452

safeurl (github.com/doyensec/safeurl), a Go SSRF protection library, has an incomplete IPv6 private network blocklist in ip.go prior to v0.2.4 . Four newly assigned CIDR ranges are omitted: 64:ff9b:1::/48 (NAT64, RFC 8215), 5f00::/16 (Segment Routing SIDs, RFC 9602), 3fff::/20 (documentation, RFC...

Astra Linux – Vulnerability in Tomcat9

An improper authorization vulnerability in Apache Tomcat leads to security constraints that ignore any methods or method omissions configured as part of the constraints. This issue affects Apache Tomcat versions from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.0.M1 through...

Astra Linux – Vulnerability in Linux 5.15

A issue was discovered in ksmbd within the Linux kernel versions 5.15 through 5.19, prior to 5.19.2. The file fs/ksmbd/smb2pdu.c omits a kfree call in certain error conditions during the smb2handlenegotiate process, resulting in a memory leak...

CVE-2026-29810

CyberPanel versions prior to 2.4.4 contain a business-logic flaw where a required return 0 statement is omitted, leading to an incomplete authorization or validation check. The vulnerability is exploitable over the network with low complexity and requires low privileges (an authenticated account)...

Linux Distros Unpatched Vulnerability : CVE-2026-89707

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - nfsd: release path refs on followdown error nfsdcrossmnt initializes a local struct path with mntget and dget before calling followdown. On a negative return t...

CVE-2026-90454 Missing authorization in Malcolm

A deployment mode intended to expose only read access to a bundled packet-analysis component's interface denies a list of write-capable routes by pattern, but the pattern omits routes that modify tags attached to stored session records, and the proxy configuration otherwise permits the request...

@jhb.software/payload-alt-text-plugin: Alt Text Endpoint Authorization Bypass via Payload Local API `overrideAccess` Omission

Alt Text Endpoint Authorization Bypass via Payload Local API overrideAccess Omission Summary @jhb.software/payload-alt-text-plugin v0.7.0 exposes custom Payload CMS endpoints POST /api/alt-text-plugin/generate and /bulk that call the Payload Local API findByID and update without setting...

PT-2026-89685

Alt Text Endpoint Authorization Bypass via Payload Local API overrideAccess Omission Summary @jhb.software/payload-alt-text-plugin v0.7.0 exposes custom Payload CMS endpoints POST /api/alt-text-plugin/generate and /bulk that call the Payload Local API findByID and update without setting...