CVE-2026-62706

CVE-2026-62706 is an out-of-bounds read in Microsoft Windows Media Foundation that allows an unauthorized attacker to execute code over a network. The CVSS 3.1 score is 8.8 (HIGH) with a vector of AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H , meaning exploitation requires user interaction but no prior au...

CVE-2024-34693

CVE-2024-34693: Lectura Arbitraria de Archivos del Servidor en Apache Superset Vulnerabilidad de validación de entrada incorrecta en Apache Superset, que permite a un atacante autenticado crear una conexión MariaDB con localinfile habilitado. Al habilitar localinfile en el cliente MySQL/MariaDB d...

CVE-2022-20818

CVE-2022-20818: Escalada de privilegios local mediante lectura parcial de archivos en Cisco SD-WAN La función “config - load” del shell SSH de Viptela utiliza “wget” para obtener archivos “command” remotos a través de FTP. Al alojar un servidor FTP malicioso y reemplazar los archivos locales...

CVE-2021-43798-Grafana-File-Read

Grafana-File-Read Lectura de archivos no autorizada en Grafana Versiones afectadas: 8.0.0-lastest reference: - https://github.com/tangxiaofeng7/Grafana-File-Read Explota la vulnerabilidad de validación poco estricta del enrutamiento de URL en la interfaz /public/plugins de Grafana para leer...

GrafTraverse-CVE-2021-43798

GrafTraverse - CVE-2021-43798 MiNi Framework de Explotación Herramienta de automatización de línea de comandos para pruebas de seguridad autorizadas de Directory Traversal de Grafana CVE-2021-43798. Resumen CVE-2021-43798 es una vulnerabilidad de directory traversal no autenticada en Grafana 8.x...

CVE-2026-78216 AshLua eval read operations can read field-policy-protected fields via aggregates

AshLua exposes Ash read actions to Lua scripts run through an eval action. A read call accepts an operation list, min, max, first, sum, avg that builds an ad-hoc Ash.Query.Aggregate over a named field and returns its raw value. Ash field policies redact forbidden fields on returned records...

EUVD-2026-72924

AshAi exposes Ash read actions to language-model tool calls. The read tool accepts an aggregate result type min, max, sum, avg that builds an ad-hoc Ash.Query.Aggregate over a named field and returns its raw value. Ash field policies redact forbidden fields on returned records replacing them with...

EUVD-2026-64339

NLTK: Symlink-based arbitrary file read in IPIPANCorpusReader, bypasses nltk.pathsec entirely...

EUVD-2026-64338

NLTK: Symlink-based sandbox bypass in FramenetCorpusReader bypasses the fix for CVE-2026-54292...

EUVD-2026-64337

NLTK: Stable FrameNet and NKJP readers parse outside-root XML...

CVE-2024-20767

Script de prueba de concepto para CVE-2024-20767 Visión general get-the-files.py es un script de Python que explota una vulnerabilidad en servidores Adobe ColdFusion CVE-2024-20767 para leer archivos del servidor. El script se basa en un método descrito en https://jeva.cc/2973.html. Descargo de...

CVE-2026-79572

An XXE XML External Entity vulnerability in the level-rule module of Distribution Management v1.0.0 allows attackers to read sensitive files, scan internal networks, or launch server attacks via supplying a crafted XML payload...

CVE-2026-82074 Incorrect Authorization in MongoDB Server Aggregation Framework Allows Unauthorized Read Access to Collection Data

MongoDB Server contains an incorrect authorization vulnerability in the aggregation framework. An authenticated user with minimal privileges can craft a specially formatted aggregation request that causes the server's authorization subsystem to evaluate a different operation than what is actually...

CVE-2026-82074

CVE-2026-82074 is an incorrect authorization vulnerability in the MongoDB Server aggregation framework . An authenticated user with minimal privileges can craft a specially formatted aggregation request that causes the server's authorization subsystem to evaluate a different operation than what i...

EUVD-2026-72917

MongoDB Server contains an incorrect authorization vulnerability in the aggregation framework. An authenticated user with minimal privileges can craft a specially formatted aggregation request that causes the server's authorization subsystem to evaluate a different operation than what is actually...

Incorrect Authorization in MongoDB Server Aggregation Framework Allows Unauthorized Read Access to Collection Data

MongoDB Server contains an incorrect authorization vulnerability in the aggregation framework. An authenticated user with minimal privileges can craft a specially formatted aggregation request that causes the server's authorization subsystem to evaluate a different operation than what is actually...

EUVD-2026-72916

A security issue in the MongoDB Server aggregation framework allows an authenticated user with limited read privileges to bypass view-level authorization checks and access data from unauthorized collections when Atlas Search features are in use. The issue stems from insufficient validation of an...

CVE-2026-82066

A heap out-of-bounds read vulnerability exists in the query planning component of MongoDB Server . An authenticated user with database read and write privileges can trigger the issue through crafted query operations, causing the server to read memory beyond allocated buffer boundaries. The leaked...

EUVD-2026-72953

A heap out-of-bounds read security issue exists in the query planning component of MongoDB Server. An authenticated user with database read and write privileges can trigger the security issue through crafted query operations, causing the server to read memory beyond allocated buffer boundaries. T...

CVE-2026-82066 Heap Out-of-Bounds Read in MongoDB Server Query Planning Component

A heap out-of-bounds read security issue exists in the query planning component of MongoDB Server. An authenticated user with database read and write privileges can trigger the security issue through crafted query operations, causing the server to read memory beyond allocated buffer boundaries. T...