payload-preferences has Cross-Collection IDOR in Access Control (Multi-Auth Environments)

Impact A cross-collection Insecure Direct Object Reference IDOR vulnerability exists in the payload-preferences internal collection. In multi-auth collection environments using Postgres or SQLite with default serial/auto-increment IDs, authenticated users from one auth collection can read and...

GHSA-JQ29-R496-R955 payload-preferences has Cross-Collection IDOR in Access Control (Multi-Auth Environments)

Impact A cross-collection Insecure Direct Object Reference IDOR vulnerability exists in the payload-preferences internal collection. In multi-auth collection environments using Postgres or SQLite with default serial/auto-increment IDs, authenticated users from one auth collection can read and...

PT-2026-6651

Name of the Vulnerable Software and Affected Versions Payload versions prior to 3.74.0 Description Payload is a headless content management system. A cross-collection Insecure Direct Object Reference IDOR exists in the payload-preferences internal collection. In multi-auth collection environments...

EUVD-2025-206425

Discourse is an open source discussion platform. Versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0 have an application level denial of service vulnerabilityin the username change functionality at try.discourse.org. The vulnerability allows attackers to cause noticeable server delays and...

PT-2026-5183

Name of the Vulnerable Software and Affected Versions Discourse versions prior to 3.5.4 Discourse versions prior to 2025.11.2 Discourse versions prior to 2025.12.1 Discourse versions prior to 2026.1.0 Description Discourse, an open source discussion platform, is subject to an application-level...

CVE-2025-68659: Allocation of Resources Without Limits or Throttling

Discourse is an open source discussion platform. Versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0 have an application level denial of service vulnerabilityin the username change functionality at try.discourse.org. The vulnerability allows attackers to cause noticeable server delays and...

thunderbird security update

140.7.0-1.0.1 - Fix prefs for new nss Orabug: 37079813 - Add Oracle prefs 140.7.0 - Add OpenELA debranding 140.7.0-1 - Update to 140.7.0 ESR...

CVE-2025-31186

A permissions issue was addressed with additional restrictions. This issue is fixed in Xcode 16.3. An app may be able to bypass Privacy preferences...

Oracle Linux 9 : firefox (ELSA-2026-0694)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-0694 advisory. 140.7.0-1.0.1 - Fix firefox-oracle-default-prefs.js for new nss Orabug: 37079773 - Add firefox-oracle-default-prefs.js and remove the corresponding Red...

Oracle Linux 8 : firefox (ELSA-2026-0667)

The remote Oracle Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2026-0667 advisory. 140.7.0-1.0.1 - Fix firefox-oracle-default-prefs.js for new nss Orabug: 37079789 140.7.0 - Add debranding patches Mustafa Gezen - Add OpenELA default...

CVE-2021-47824 iDailyDiary 4.30 - Denial of Service (PoC)

iDailyDiary 4.30 contains a denial of service vulnerability that allows attackers to crash the application by overflowing the preferences tab name field. Attackers can paste a 2,000,000 character buffer into the default diary tab name to trigger an application crash...

CVE-2021-47824

iDailyDiary 4.30 contains a denial of service vulnerability that allows attackers to crash the application by overflowing the preferences tab name field. Attackers can paste a 2,000,000 character buffer into the default diary tab name to trigger an application crash...

CVE-2021-47824 iDailyDiary 4.30 - Denial of Service (PoC)

iDailyDiary 4.30 contains a denial of service vulnerability that allows attackers to crash the application by overflowing the preferences tab name field. Attackers can paste a 2,000,000 character buffer into the default diary tab name to trigger an application crash...

CVE-2025-31186

A permissions issue was addressed with additional restrictions. This issue is fixed in Xcode 16.3. An app may be able to bypass Privacy preferences...

CVE-2025-31186

A permissions issue was addressed with additional restrictions. This issue is fixed in Xcode 16.3. An app may be able to bypass Privacy preferences...

CVE-2025-31186

A permissions issue was addressed with additional restrictions. This issue is fixed in Xcode 16.3. An app may be able to bypass Privacy preferences...

CVE-2025-31186

Versions of Apple Xcode prior to 16.3 are vulnerable to a permissions issue caused by insufficient restrictions. This flaw could allow a malicious application to bypass Privacy preferences within the Playgrounds component. The issue has been addressed with additional restrictions in Xcode 16.3. U...

CVE-2025-31186

A permissions issue was addressed with additional restrictions. This issue is fixed in Xcode 16.3. An app may be able to bypass Privacy preferences...

CVE-2025-31186

A permissions issue was addressed with additional restrictions. This issue is fixed in Xcode 16.3. An app may be able to bypass Privacy preferences...

Splinterware iDailyDiary security vulnerability

Splinterware iDailyDiary is a log management software developed by Splinterware Corporation. Version 4.30 of Splinterware iDailyDiary contains a security vulnerability. This vulnerability stems from a buffer overflow in the name field of the preferences tab, which could lead to a denial-of-servic...