CVE-2021-36750

CVE-2021-36749 关于 - 在Druid的摄入系统中，InputSource用于从特定数据源读取数据。然而，HTTP InputSource允许经过身份验证的用户以Druid服务器进程的权限从非预期的其他源（如本地文件系统）读取数据。当用户直接访问Druid时，这并非权限提升，因为Druid也提供了Local InputSource，允许相同级别的访问。但是，当用户通过一个允许指定HTTP InputSource但不允许Local InputSource的应用程序间接与Druid交互时，就会出现问题。在这种情况下，用户可以通过向HTTP...

rosenbridge

project:rosenbridge : x86 CPUのハードウェアバックドア github.com/xoreaxeaxeax/rosenbridge // domas // @xoreaxeaxeax 概要 project:rosenbridgeは、一部のデスクトップ、ラップトップ、組み込みx86プロセッサにおけるハードウェアバックドアを明らかにします。 このバックドアにより、リング3（ユーザーランド）のコードがプロセッサの保護を回避し、リング0（カーネル）のデータを自由に読み書きできるようになります。バックドアは通常は無効（有効化にはリング0の実行が必要）ですが、一部のシステムで...

CVE-2026-81941

IBM Langflow OSS 1.0.0 through 1.11.5 allows an authenticated non-administrative user could execute arbitrary operating system commands on the server at the privilege level of the application process by constructing a flow with an MCP Tools component configured to use a local stdio subprocess...

CVE-2026-81941

IBM Langflow OSS versions 1.0.0 through 1.11.5 are vulnerable to arbitrary operating system command execution when an authenticated non-administrative user constructs a flow with an MCP Tools component configured to use a local stdio subprocess transport. This bypasses both the LANGFLOW_CUSTOM_CO...

CVE-2025-20029

CVE-2025-20029: F5 BIG-IP 中 TMSH CLI 的命令注入 F5 “tmsh” 受限 CLI 中存在一个命令注入漏洞，该漏洞允许已认证的攻击者利用低权限用户可访问的命令来绕过限制、注入任意命令，并以目标系统上的 “root” 用户身份获得远程代码执行。 厂商披露: 该漏洞的厂商披露与修复方案可在此处找到。 前提条件: 此漏洞需要： 有效的用户凭据 向 iControl REST 组件发送请求的能力和/或执行 tmsh 命令的能力 概念验证: 更多细节及利用过程可在此 PDF 中查看。...

CVE-2026-33391

An access control vulnerability was discovered in the Smart Polling configuration functionality due to insufficient validation of user privileges. An authenticated user with limited privileges can remotely bypass the intended access control of the web management interface and modify the Smart...

EUVD-2026-72788

An access control vulnerability was discovered in the Smart Polling configuration functionality due to insufficient validation of user privileges. An authenticated user with limited privileges can remotely bypass the intended access control of the web management interface and modify the Smart...

cve-2020-13933

cve-2020-13933 cve-2020-13933 apache shiroの権限バイパス脆弱性 この再現は非常に簡単です。まずIDEA+shiroで環境を構築します 参考：https://www.cnblogs.com/ph4nt0mer/p/13535999.html その後、実行し、アクセスし、パケットキャプチャを行います...

CVE-2026-86417

Affected versions of MISP inconsistently enforced email-address visibility in DashboardsController::listTemplates. The query always fetched User.email, while redaction happened only inside the non-REST rendering branch. As a result, the same authenticated user who saw redacted data in the normal...

YellowKey-Bitlocker-CVE-2026-45585

🛡️ YellowKey-Bitlocker-CVE-2026-45585 - 安全恢复您的 BitLocker 密钥 📋 本软件的功能 YellowKey 是一款适用于 Windows 10 和 Windows 11 的免费开源工具。它可以帮助您提取、备份和查看 BitLocker 恢复密钥。当您无法访问加密驱动器或需要验证安全设置时，此工具非常有用。 BitLocker 是 Windows 内置的加密工具。当出现问题时——硬件变更、BIOS 更新或忘记密码——Windows 会要求您输入 48 位恢复密钥。如果您没有此密钥，数据将永远被锁定。 YellowKey...

CVE-2026-84989

ntopng is a web-based network traffic monitoring application. In versions 6.7.0 through 6.7.260717, two REST v2 endpoints that manage ntopng's tag/badge feature — POST /lua/rest/v2/delete/tag/tag.lua and POST /lua/rest/v2/edit/tag/tag.lua — perform no authorization check at all. Any authenticated...

CVE-2026-77124 Nexus Repository 3 - Script Execution Disable Setting Not Enforced

In affected versions of Nexus Repository 3, the script execution endpoint POST /service/rest/v1/script/name/run did not verify whether script execution had been administratively disabled. An account holding script-execution permission could continue to run previously-created scripts even after an...

nodejs: Node.js: Unauthorized filesystem access due to Permission Model enforcement flaw

A flaw in the Node.js Permission Model allows attackers to bypass --permission restrictions, enabling unauthorized read or write access to files and directories...

EEF-CVE-2026-82732 Declared argument constraints not enforced on AshTypescript typed controller routes

Summary Improper Input Validation vulnerability in ash-project ashtypescript allows a remote attacker to submit argument values outside a declared allowlist or bound on typed-controller routes. AshTypescript.TypedController.RequestHandler in lib/ashtypescript/typedcontroller/requesthandler.ex cal...

CVE-2026-82732 Declared argument constraints not enforced on AshTypescript typed controller routes

Improper Input Validation vulnerability in ash-project ashtypescript allows a remote attacker to submit argument values outside a declared allowlist or bound on typed-controller routes. AshTypescript.TypedController.RequestHandler in lib/ashtypescript/typedcontroller/requesthandler.ex calls...

CVE-2026-55545

Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs WebSocket subscription handlers fail to enforce the privileges required by equivalent REST endpoints. PacketsApi.subscribePackets exposes the packets WebSocket topic without ObjectPrivilegeType.ReadPacket,...

Yamcs Core API has Multiple Missing Function Level Access Control vulnerabilities

Summary Multiple Missing Function Level Access Control vulnerabilities exist in the Yamcs Core API. These vulnerabilities allow any authenticated user, regardless of their assigned roles or privileges e.g., an unprivileged "Guest", to bypass intended access controls. An attacker can exploit these...

CVE-2026-78892

Incorrect authorization in Chromoting in Google Chrome on on Windows prior to 152.0.7977.65 allowed a local attacker to bypass system access restrictions via a local program. Chromium security severity: Medium...

CVE-2026-55095

OpenProject is open-source, web-based project management software. In version 17.5.1 and earlier, an authenticated non-admin project member can request the inplace-edit dialog for a raw customfield project attribute. The dialog path resolves the project custom field by its raw identifier without...

CVE-2026-64965

ATutor is vulnerable to Missing Authorization Check on Test and Question Import endpoints. A low-privileged authenticated user e.g. a student enrolled in a course can bypass authorization checks by sending requests directly to the backend import endpoints, allowing the unauthorized import of test...