CVE-2026-104893: Allocation of Resources Without Limits or Throttling

Plane is an open-source project management tool. Prior to 1.4.0, GET /api/users/api-tokens/ allows an authenticated user to retrieve API-token records, while PATCH /api/users/api-tokens/tokenid/ allows the user to modify the token's allowedratelimit field without server-side validation or a maxim...

PT-2026-106080

Plane is an open-source project management tool. Prior to 1.4.0, the V2 issue-attachment PATCH endpoint accepts issue id in the URL but omits it from the database query. A project member can use an issue id they control in the URL while targeting another user's attachment by its pk UUID. Because...

PT-2026-106019

Name of the Vulnerable Software and Affected Versions Plane versions prior to 1.4.0 Description An authenticated user can retrieve API-token records via the 'GET /api/users/api-tokens/' endpoint. Additionally, the 'PATCH /api/users/api-tokens/token id/' endpoint allows a user to modify the allowe...

CVE-2020-8554

Creare un cluster Kubernetes kind create cluster --config ./kind.yaml Il cluster deve avere certmanager: https://cert-manager.io/docs/installation/kubernetes/ Testare la vulnerabilità kubectl apply -f - 'EOF' apiVersion: v1 kind: Namespace metadata: name: kubeproxy-mitm --- apiVersion: apps/v1...

Mirth-Connect-CVE-2023-43208

CVE-2023-43208: Esecuzione Remota di Codice RCE Non Autenticata in NextGen Mirth Connect Questo exploit sfrutta una critica vulnerabilità di deserializzazione nel motore XStream di Mirth Connect. Deriva da una patch incompleta per CVE-2023-37679, consentendo l'esecuzione arbitraria di codice non...

Rogue-Framework

Rogue Framework "Make it rain. " Rogue Amendiares The best intel-broker in night city Rogue Framework is a desktop workbench for AFL++, cross-architecture QEMU fuzzing, harness development, lightweight Ghidra headless analysis, custom mutators, and patch comparison. It is intentionally an auditab...

grandstream-cve-2026-2329-analysis

Analisi di patch e variante di CVE-2026-2329 nel firmware Grandstream GXP1600 Progetto di analisi statica difensiva che confronta il firmware Grandstream GXP1600 1.0.7.79 vulnerabile e 1.0.7.81 corretto per comprendere come il fornitore ha rimediato al difetto di parsing delle richieste associato...

advisories

Avvisi di sicurezza Avvisi di sicurezza di Kelly Kaoudis @kaoudis e amici. In generale, pubblico qui dopo che il fornitore ha rilasciato la patch, oppure dopo 90 giorni dalla scoperta della vulnerabilità. Buona lettura! Gli advisory sono numerati in ordine di scoperta e per anno; la numerazione...

ovswrap

OVSwrap — Website zur Verfolgung von Open-vSwitch-Datapath-Overflows im Linux-Kernel Quelle für den OVSwrap -Patch-Status-Tracker: eine einseitige Website, die festhält, welche Distributionen einen Fix für den Open-vSwitch-Datapath-Overflow im Linux-Kernel ausgeliefert haben. Wo die Fakten zu...

ROOT-APP-PYPI-CVE-2025-53366 CVE-2025-53366 in mcp - Patched by Root

Root has patched CVE-2025-53366 in the mcp package for Root:PyPI. Multiple fixed versions available...

framework_base_CVE-2023-21285_NoPatch

Dieses Repository hat keine README-Datei...

CVE-2021-36934

CVE-2021-36934 Correzione per la CVE-2021-36934 Lo script verrà eseguito e controllerà se il tuo sistema è interessato, quindi applicherà la correzione...

CVE-2025-50154

Toolkit di Hardening e Caccia alle Minacce NTLM/SMB Autore: w01f Versione: 1.0 Scopo: Eseguire audit, hardening e caccia per l'uso insicuro di NTLM/SMB al fine di mitigare rischi come CVE-2025-50154. Panoramica di CVE-2025-50154 Gravità: Alta Tipo: Perdita di credenziali NTLM + Bypass della patch...

ROOT-APP-GOBINARY-CVE-2025-15558 CVE-2025-15558 in github.com/docker/cli - Patched by Root

Root has patched CVE-2025-15558 in the github.com/docker/cli package for Root:Go. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2023-2976 CVE-2023-2976 in com.google.guava:guava - Patched by Root

Root has patched CVE-2023-2976 in the com.google.guava:guava package for Root:Maven. Multiple fixed versions available...

VMWare Workspace ONE UEM - Server-Side Request Forgery

VMware Workspace ONE UEM console 20.0.8 prior to 20.0.8.37, 20.11.0 prior to 20.11.0.40, 21.2.0 prior to 21.2.0.27, and 21.5.0 prior to 21.5.0.37 contain a server-side request forgery vulnerability. This issue may allow a malicious actor with network access to UEM to send their requests without...

Apache Superset - Authentication Bypass

Session Validation attacks in Apache Superset versions up to and including 2.0.1. Installations that have not altered the default configured SECRETKEY according to installation instructions allow for an attacker to authenticate and access unauthorized resources. This does not affect Superset...

Sophos UTM Preauth - Remote Code Execution

Sophos SG UTMA WebAdmin is susceptible to a remote code execution vulnerability in versions before v9.705 MR5, v9.607 MR7, and v9.511 MR11. id: CVE-2020-25223 info: name: Sophos UTM Preauth - Remote Code Execution author: gy741 severity: critical description: Sophos SG UTMA WebAdmin is susceptibl...

Zimbra Collaboration Suite - Memcached Command Injection

Zimbra Collaboration Suite versions 8.8.15 and 9.0 contain a memcached command injection vulnerability that allows an unauthenticated attacker to inject arbitrary memcache commands into a targeted instance, leading to cache poisoning and potential credential theft. id: CVE-2022-27924 info: name:...

SAP Solution Manager 7.2 - Remote Command Execution

SAP Solution Manager SolMan running version 7.2 has a remote command execution vulnerability within the SAP EEM servlet tcsmdagentapplicationeem. The vulnerability occurs due to missing authentication checks when submitting SOAP requests to the /EemAdminService/EemAdmin page to get information...