CVE-2026-100629 Capgo backend before 12.127.5 Privilege Escalation via role_bindings PATCH

Capgo capgo.app backend before 12.127.5 contains an authorization flaw in the PATCH /private/rolebindings/:bindingid endpoint. The handler verifies that the newly assigned role's priority rank does not exceed the caller's own rank, but — unlike the DELETE handler — it never checks the rank of the...

CVE-2026-100629 Capgo backend before 12.127.5 Privilege Escalation via role_bindings PATCH

Capgo capgo.app backend before 12.127.5 contains an authorization flaw in the PATCH /private/rolebindings/:bindingid endpoint. The handler verifies that the newly assigned role's priority rank does not exceed the caller's own rank, but — unlike the DELETE handler — it never checks the rank of the...

EUVD-2026-87723

Capgo capgo.app backend before 12.127.5 contains an authorization flaw in the PATCH /private/rolebindings/:bindingid endpoint. The handler verifies that the newly assigned role's priority rank does not exceed the caller's own rank, but — unlike the DELETE handler — it never checks the rank of the...

CVE-2026-100610 Flowise through 3.1.4 Missing Authorization via upsert-history

Flowise through 3.1.4 exposes GET /api/v1/upsert-history/:id and PATCH /api/v1/upsert-history without route-level permission checks, and the backing service performs no workspace or ownership validation. getAllUpsertHistory returns UpsertHistory rows selected solely by an attacker-supplied...

EUVD-2026-87705

Flowise through 3.1.4 exposes GET /api/v1/upsert-history/:id and PATCH /api/v1/upsert-history without route-level permission checks, and the backing service performs no workspace or ownership validation. getAllUpsertHistory returns UpsertHistory rows selected solely by an attacker-supplied...

CVE-2026-100610

Flowise versions through 3.1.4 are vulnerable to an authorization bypass in the upsert-history functionality. The application fails to perform route-level permission checks, workspace validation, or ownership verification for the GET /api/v1/upsert-history/:id and PATCH /api/v1/upsert-history end...

CVE-2020-16898_Checker

CVE-2020-16898Checker Check all Network Interface for CVE-2020-16898 Vulnerability No Patch nor Workaround, for this check this one https://github.com/CPO-EH/CVE-2020-16898Workaround/blob/main/VCE-2020-16898QuickWin.ps1...

cve-2011-4862

cve-2011-4862 Originalmente intenté usar diff para hacer un parche. Lo parcheé de la forma en que pensé que sería, antes de mirar el parche real. encrypt.patch es el parche original que hice con el diff. Sin embargo, cuando intentamos aplicar este parche a FreeBSD, no lo aceptó. En lugar de eso,...

linux_CVE-2020-24490-beforePatch

Este repositorio no tiene un README...

CVE-2023-36884_patcher

CVE-2023-36884patcher CVE-2023-36884 afecta a las versiones de Office 2016, 2019 y 2021. Este es su parche temporal; tras descargarlo, haga clic derecho y ejecútelo con permisos de administrador...

text4shell-tools

commons-text-tools Quick links Click to find: Find commons-text .jar files and their versions Calls to commons-text vulnerable functions Hot patch on commons-text .jar files to disable the vulnerable behaviors Scan and patch example Overview CVE-2022-42889 may pose a serious threat to a wide rang...

AMSI-ETW-Patch

AMSI-ETW-Patch this repo contains information to patch AMSI and ETW using a single byte patch for both. The idea was to limit detection of the patch itself since it's a single byte. AMSI patch-amsi-x64.c The idea is that AMSI perform a lot of validation check before hitting the critical AMSI...

New-lib3mf.dll-for-MeshMixer

Nueva lib3mf.dll para MeshMixer lib3mf.dll precompilada para MeshMixer que incluye un parche retroportado para CVE-2021-21772 y una actualización de zlib 1.3.1. Reemplaza el archivo original en C:\Program Files\Autodesk\Meshmixer\ Código fuente incluido, si deseas compilarlo tú mismo...

dnsmasq-2.4.1-fix-CVE-2017-14491

dnsmasq-2.4.1-fix-CVE-2017-14491...

Citrix ShareFile StorageZones Controller - Unauthenticated Remote Code Execution

A vulnerability has been discovered in the customer-managed ShareFile storage zones controller which, if exploited, could allow an unauthenticated attacker to remotely compromise the customer-managed ShareFile storage zones controller. id: CVE-2023-24489 info: name: Citrix ShareFile StorageZones...

Drupal - Remote Code Execution

Drupal 8.5.x before 8.5.11 and Drupal 8.6.x before 8.6.10 V contain certain field types that do not properly sanitize data from non-form sources, which can lead to arbitrary PHP code execution in some cases. id: CVE-2019-6340 info: name: Drupal - Remote Code Execution author: madrobot severity:...

Atlassian Confluence Download Attachments - Remote Code Execution

Confluence Server and Data Center had a path traversal vulnerability in the downloadallattachments resource. A remote attacker who has permission to add attachments to pages and / or blogs or to create a new space or a personal space or who has 'Admin' permissions for a space can exploit this pat...

cve-2021-44228-qingteng-patch

QingTeng log4j2-patch https://github.com/qingtengyun/cve-2021-44228-qingteng-patch Corrige el CVE-2021-44228 de log4j2, utilizando la API de Instrumentation proporcionada por la JVM para modificar el bytecode existente cargado en la JVM. Sin reiniciar el proceso de Java, modifica el método lookup...

patch-diffing-in-the-dark

Patch Diffing In The Dark A series of blog posts leveraging CVE analysis and patch diffing to discover new vulnerabilities. As revealed in the blog posts, 4 CVEs came from the in-depth study of CVE-2021-1657. TOC Results from CVE-2021-1657: Part 1 - Patch Diffing In The Dark Part 2 - Down the...

spring-break_cve-2017-8046

spring-breakcve-2017-8046 Este es un programa Java que explota la vulnerabilidad Spring Break CVE-2017-8046. Este software está escrito para tener la menor cantidad de dependencias externas posible. AVISO LEGAL Esta herramienta está destinada a ingenieros de seguridad y profesionales de appsec pa...