CVE-2026-5173

🦊 CVE-2026-5173: Prova de Conceito de Execução Não Autorizada de Método via WebSocket do GitLab 🛠️ Visão Geral CVE-2026-5173 permite que um atacante autenticado com privilégios baixos chame métodos restritos do backend por meio do endpoint WebSocket /-/cable do GitLab, especificamente via...

CVE-2021-31762

..| CVE-2021-31762 |.. Descrizione : Sfruttamento di un attacco Cross-site request forgery CSRF per creare un utente privilegiato tramite la funzione di aggiunta utenti di Webmin e successivamente ottenere una reverse shell tramite la funzione dei processi in esecuzione di Webmin Versione Testata...

CVE-2026-78071

Joomla Extension - digital-peak.com - Authenticated, privileged stored XSS in DP Calendar 7.0.0 - 10.11.2 - Location title is rendered in data attribute without escaping leads to XSS, needs create permission in DPCalendar...

CVE-2026-82236 File Browser 2.63.6 through 2.63.23 Share Link Exposure via File Deletion

File Browser versions from 2.63.6 through 2.63.23 fail to clean up public share links when a privileged user deletes another user's shared file. Attackers can access the surviving share link to retrieve new unrelated content uploaded to the same path without authentication...

PaperCut NG/MF Critical Zero-Day Exploited in the Wild

Overview On August 27, 2026, PaperCut Software published an urgent security advisory stating that it is investigating active exploitation of a vulnerability affecting PaperCut NG and PaperCut MF. PaperCut has confirmed customer incidents and is treating the issue as a security emergency. At the...

CVE-2026-78071

DP Calendar is a Joomla extension by digital-peak.com. Versions 7.0.0 through 10.11.2 are affected by an authenticated, privileged stored XSS . The root cause is that the location title is rendered in a data attribute without proper escaping. Exploitation requires an authenticated user with the c...

CVE-2026-78071 Joomla Extension - digital-peak.com - Authenticated, privileged stored XSS in DP Calendar 7.0.0 - 10.11.2

Joomla Extension - digital-peak.com - Authenticated, privileged stored XSS in DP Calendar 7.0.0 - 10.11.2 - Location title is rendered in data attribute without escaping leads to XSS, needs create permission in DPCalendar...

EUVD-2026-67653

Joomla Extension - digital-peak.com - Authenticated, privileged stored XSS in DP Calendar 7.0.0 - 10.11.2 - Location title is rendered in data attribute without escaping leads to XSS, needs create permission in DPCalendar...

CVE-2026-78070

CVE-2026-78070 affects the DP Calendar Joomla extension (by digital-peak.com), versions 5.5.0 through 10.11.2 . The vulnerability is an authenticated blind SQL injection in the extension's content plugin , triggered when saving an article . Exploitation requires the attacker to hold update permis...

EUVD-2026-67650

Joomla Extension - digital-peak.com - Authenticated, privileged blind SQL injection in DP Calendar 5.5.0 - 10.11.2 - Saving an article can trigger a blind SQL injection with content plugin, needs update permission for articles...

Gorsair

Gorsair Gorsair è uno strumento di penetration testing per scoprire e accedere da remoto alle API Docker da container Docker vulnerabili. Una volta ottenuto l'accesso al demone Docker, puoi usare Gorsair per eseguire direttamente comandi su container remoti. Esporre l'API Docker su internet è un...

authcov

AuthCov Web app authorisation coverage scanning. Introduction AuthCov crawls your web application using a Chrome headless browser while logged in as a pre-defined user. It intercepts and logs API requests as well as pages loaded during the crawling phase. In the next phase it logs in under a...

CVE-2026-78495

A server-side request forgery SSRF vulnerability WatchGuard Dimension Remote Backup Connection Test configuration allows an authenticated privileged attacker to enumerate exposed network services on adjacent network systems...

CVE-2026-78499

A server-side request forgery SSRF vulnerability WatchGuard Dimension FTP Server Test configuration allows an authenticated privileged attacker to enumerate exposed network services on adjacent network systems...

CVE-2026-78498

A server-side request forgery SSRF vulnerability WatchGuard Dimension Email Server Test configuration allows an authenticated privileged attacker to enumerate exposed network services on adjacent network systems...

CVE-2026-78495 Dimension Server-Side Request Forgery via Remote Backup Connection Test

A server-side request forgery SSRF vulnerability WatchGuard Dimension Remote Backup Connection Test configuration allows an authenticated privileged attacker to enumerate exposed network services on adjacent network systems...

CVE-2026-78498

CVE-2026-78498 is a server-side request forgery (SSRF) vulnerability in the WatchGuard Dimension Email Server Test configuration . An authenticated privileged attacker can use this flaw to enumerate exposed network services on adjacent network systems . The CVSS 4.0 score is 5.1 (Medium) , reflec...

CVE-2026-78498 Dimension Server-Side Request Forgery via Email Server Test Settings

A server-side request forgery SSRF vulnerability WatchGuard Dimension Email Server Test configuration allows an authenticated privileged attacker to enumerate exposed network services on adjacent network systems...

CVE-2026-78495

A server-side request forgery (SSRF) vulnerability in the WatchGuard Dimension product, specifically in the Remote Backup Connection Test configuration, allows an authenticated privileged attacker to enumerate exposed network services on adjacent network systems. The CVSS 4.0 score is 5.3 (MEDIUM...

CVE-2026-78500

WatchGuard Dimension contains a blind server-side request forgery (SSRF) vulnerability in the Database Server Test configuration. An authenticated privileged attacker can use this to enumerate exposed network services on adjacent network systems . The CVSS 4.0 base score is 5.1 (MEDIUM) , with an...