CVE-2025-30368

Zulip CVE-2025-30368 affects the Delete Organization Export API where permission checks could allow an administrator to delete an export belonging to another organization. Root cause: insufficient verification that the field being acted upon belongs to the caller’s organization. Impact: potential...

CVE-2025-30368 Zulip allows the deletion of organization by administrators of a different organization

Zulip is an open-source team collaboration tool. The API for deleting an organization export is supposed to be restricted to organization administrators, but its handler failed to check that the field belongs to the same organization as the user. Therefore, an administrator of any organization wa...

CVE-2025-30368 Zulip allows the deletion of organization by administrators of a different organization

Zulip is an open-source team collaboration tool. The API for deleting an organization export is supposed to be restricted to organization administrators, but its handler failed to check that the field belongs to the same organization as the user. Therefore, an administrator of any organization wa...

CVE-2025-27149

Zulip server before 10.0 has a data-export vulnerability (CVE-2025-27149) where export types for organization admins incorrectly included metadata such as user-agent identifiers for integrations and HTTP libraries, and in public data/with-consent exports exposed titles of topics in private channe...

CVE-2025-27149 Zulip exports can leak private data

Zulip server provides an open-source team chat that helps teams stay productive and focused. Prior to 10.0, the data export to organization administrators feature in Zulip leaks private data. The collection of user-agent types identifying specific integrations or HTTP libraries E.g.,...

CVE-2025-27149 Zulip exports can leak private data

Zulip server provides an open-source team chat that helps teams stay productive and focused. Prior to 10.0, the data export to organization administrators feature in Zulip leaks private data. The collection of user-agent types identifying specific integrations or HTTP libraries E.g.,...

CVE-2019-16149

Fortinet CVE-2019-16149 affects FortiClient EMS 6.2.0, where improper neutralization of input during web page generation enables a remote attacker to execute unauthorized code by injecting a malicious payload into a FortiClient‑managed user profile. This is tied to FortiClient EMS web app data ha...

Moving from WhatsApp to Signal: A good idea?

This week we learned that the US Government uses Signal for communication, after a journalist was accidentally added to a Signal chat. Accidental additions of people aside, the news has got regular folks asking if they should, too, be using Signal for private communications. Probably the largest...

CVE-2022-1804

Summary: CVE-2022-1804 affects AccountsService. Local attackers could exploit a flaw where AccountsService incorrectly drops privileges when handling .pam_environment, potentially causing the service to crash or become unresponsive (denial of service). Affected components: AccountsService (Linux/...

CVE-2023-25610

Fortinet CVE-2023-25610 is a buffer underwrite in the FortiOS/FortiProxy administrative interface that allows remote, unauthenticated execution of code via crafted requests. Affected firmware ranges include FortiOS 7.2.0–7.2.3, 7.0.0–7.0.6, 6.4.0–6.4.11, 6.2.12 and below, FortiProxy 7.2.0–7.2.2, ...

CVE-2021-26091

CVE-2021-26091 concerns FortiMail Identity Based Encryption (IBE) authentication. The connected documents confirm a cryptographically weak PRNG used in the FortiMail authenticator, affecting FortiMail versions 6.4.0–6.4.4 and 6.2.0–6.2.7. The weakness may allow an unauthenticated attacker to infe...

CVE-2019-16151

Fortinet FortiOS 6.4.1 and below and FortiOS 6.2.9 and below are affected by an improper neutralization of input during web page generation (CWE-79). A remote unauthenticated attacker can exploit a crafted Host header to redirect users to malicious sites or to execute JavaScript in the victim’s b...

CVE-2021-25635

CVE-2021-25635 is a certificate-validation vulnerability in LibreOffice described as a Content Manipulation with Certificate Validation Attack. An attacker could enable self-signed ODF documents, then modify the signature algorithm to an invalid/unknown one; LibreOffice could display the signatur...

CVE-2021-25635

An Improper Certificate Validation vulnerability in LibreOffice allowed an attacker to self sign an ODF document, with a signature untrusted by the target, then modify it to change the signature algorithm to an invalid or unknown to LibreOffice algorithm and LibreOffice would incorrectly present...

CVE-2024-4990

CVE-2024-4990 (Yii2

SuperAGI 安全漏洞

SuperAGI is an open source infrastructure application from SuperAGI Open Source. for building components, tools, frameworks and models to implement open source AGI. A security vulnerability exists in SuperAGI that stems from the /get/organization/ endpoint not validating the user's organization,...

CVE-2020-9295

CVE-2020-9295 affects Fortinet products where FortiOS 6.2 (AV engine <= 6.00142), FortiOS 6.4 (AV engine <= 6.00144), and FortiClient 6.2 (AV engine

CVE-2021-22126

CVE-2021-22126 relates to Fortinet FortiWLC and is a hard-coded password vulnerability. A local, authenticated attacker could connect to the managed APs (Meru AP and FortiAP-U) as root using the default hard-coded username and password. Affected FortiWLC versions are 8.5.2 and below, 8.4.8 and be...

CVE-2021-26087

The CVE-2021-26087 entry documents a stored Cross-Site Scripting (XSS) vulnerability in Fortinet FortiWLC web interfaces. Affected FortiWLC releases include 8.6.0, 8.5.3 and earlier, 8.4.8 and earlier, and 8.3.3. Root cause is improper neutralization of input during web page generation, enabling ...

CVE-2023-33300

FortiNAC suffers an improper neutralization of special elements in a command injection vulnerability affecting the tcp/5555 XML interface, enabling an unauthenticated attacker to copy local files from the device. Affected releases include FortiNAC 7.2.0–7.2.1 and 9.4.0–9.4.3; remediation is in Fo...