47178 matches found
vm2 setup-sandbox.js Code Execution
The vulnerability of the setup-sandbox.js file in the vm2 package manager’s library in NPM is related to a data protection mechanism breach. Exploiting this vulnerability allows an attacker, operating remotely, to execute arbitrary code...
PT-2026-59570
Summary Type: Authorization bypass enabling owner lockout. The DELETE /workspaces/workspace id/members/user id endpoint is gated only by require workspace memberworkspace id default min role="member". Any member can remove any other member, including the workspace owner, using a single DELETE...
PT-2026-59698
An issue was discovered in OpenStack Sushy-Tools through 0.21.0 and VirtualBMC through 2.2.2. Changing the boot device configuration with these packages removes password protection from the managed libvirt XML domain. NOTE: this only affects an "unsupported, production-like configuration."...
PT-2026-59681
Summary Serena's built-in web dashboard exposes an unauthenticated Flask API on a fixed, predictable port TCP 24282, hardcoded as 0x5EDA in constants.py. The server has no authentication, no CSRF protection, and no Host header validation. A DNS rebinding attack allows a malicious webpage to reach...
Proof-generation tool XSS
The vulnerability of the proof-generation tool and the software platform based on Git for collaborative code development in GitLab EE is related to insufficient protection of the website structure. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks...
PT-2026-59506
Improper restriction of excessive authentication attempts CWE-307 in pgAdmin 4. pgAdmin enforces MAX LOGIN ATTEMPTS only inside its custom /authenticate/login view. Flask-Security's default /login view, which is registered automatically by security.init app and is reachable on every server, never...
aiohttp HTTP Client Disclosure
The vulnerability of the aiohttp HTTP client is related to insufficient protection of service data. Exploiting this vulnerability can allow an attacker, operating remotely, to disclose the protected information...
wiki markup XSS
The vulnerability of the software platform that renders wiki markup for collaborative code development on Git-based platforms for GitLab EE/CE involves insufficient protection of website structures. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks...
BIT-NEXTCLOUD-2023-28646 App lockout in nextcloud Android app can be bypassed via thirdparty apps
Nextcloud android is an android app for interfacing with the nextcloud home server ecosystem. In versions from 3.7.0 and before 3.24.1 an attacker that has access to the unlocked physical device can bypass the Nextcloud Android Pin/passcode protection via a thirdparty app. This allows to see meta...
Exploit for Protection Mechanism Failure in Jenkins Pipeline\:_Groovy
No d...
EUVD-2026-43091
vulnerability in Drupal Brute force attack protection allows . This issue affects Brute force attack protection versions:...
CVE-2026-11915
vulnerability in Drupal Brute force attack protection allows . This issue affects Brute force attack protection versions:...
CVE-2026-11915
The Drupal Brute force attack protection module is affected by a vulnerability allowing for brute force attacks across all versions (. ). The project has been marked as unsupported by the security team due to a known security issue that remains unfixed by the maintainer. Consequently, there is cu...
CVE-2026-11915 Brute force attack protection - Critical - Unsupported - SA-CONTRIB-2026-047
vulnerability in Drupal Brute force attack protection allows . This issue affects Brute force attack protection versions:...
CVE-2026-11915
vulnerability in Drupal Brute force attack protection allows . This issue affects Brute force attack protection versions:...
CVE-2026-11915 Brute force attack protection - Critical - Unsupported - SA-CONTRIB-2026-047
vulnerability in Drupal Brute force attack protection allows . This issue affects Brute force attack protection versions:...
CVE-2026-55187 Mailpit: Incomplete SSRF protection in Link Check API via IPv6 transition mechanisms (follow-up to CVE-2026-27808)
Mailpit is an email testing tool and API for developers. Prior to 1.30.2, the remediation shipped for CVE-2026-27808 is incomplete because the tools.IsInternalIP deny-list in internal/tools/net.go relies on Go's standard library classification helpers and does not block IPv6 transition mechanisms...
Protection Mechanism Failure
Overview safeinstall-cli is a Local-first CLI that blocks risky npm, pnpm, and bun installs before they run. Open source. Affected versions of this package are vulnerable to Protection Mechanism Failure through improper shell command parsing in the agent guard. An attacker can execute arbitrary...
FTP Fetch, Windows Upload/Execute, Reverse Ordinal TCP Stager (No NX or Win7)
Fetch and execute an x86 payload from an FTP server. Uploads an executable and runs it staged. Connect back to the attacker Module Options This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule includ...