CVE-2026-86698

Insufficient Session Expiration vulnerability in OAuth token issuance in hexpm hexpm allows a user whose organization membership or session has ended to keep reading the organization's private packages and their documentation tarballs via a retained refresh token. generaterefreshtoken/4 in...

EUVD-2026-84539

Insufficient Session Expiration vulnerability in OAuth token issuance in hexpm hexpm allows a user whose organization membership or session has ended to keep reading the organization's private packages and their documentation tarballs via a retained refresh token. generaterefreshtoken/4 in...

cynative

나만의 보안 에이전트 구축하기 인프라에 대한 실시간 읽기 전용 접근 권한을 갖춘 보안 에이전트용 오픈소스 프레임워크입니다. 빠른 시작 · 내장 에이전트 · 첫 번째 에이전트 · 문서 인프라에 무엇이든 물어보세요. Cynative는 프런티어 모델을 여러분의 코드, 클라우드, 런타임 전반에서 실행하여 GitHub, GitLab, AWS, GCP, Azure, Kubernetes를 하나의 시스템으로 추론하고, 검증된 답변을 제공합니다.bash cynative "what in my cloud is publicly exposed tha...

poro

poro Description Scan for publicly accessible assets on your AWS environment Services covered by this tool: AWS ELB API Gateway S3 Buckets RDS Databases EC2 instances Redshift Databases Poro also check if a tag you specify is applied to identified public resources using --tag-key and --tag-value...

libfsntfs

libfsntfs는 NTFSNew Technology File System 형식에 접근하기 위한 라이브러리입니다. 프로젝트 정보: 상태: 실험적 라이선스: LGPL-3.0-or-later 읽기 전용 지원 NTFS 형식: NTFS 버전 3.0 NTFS 버전 3.1 지원되는 NTFS 형식 기능: LZNT1 압축 WOFWindows Overlay Filter 압축 데이터LZX 및 LZXPRESS-Huffman 대소문자 구분 디렉터리 지원되지 않는 NTFS 형식 기능: NTFS 버전 1.0 NTFS 버전 1.1 NTFS 버전 1.2...

libqcow

libqcow는 QEMU Copy-On-WriteQCOW 이미지 파일 형식에 접근하기 위한 라이브러리입니다. 프로젝트 정보: 상태: 알파 라이선스: LGPL-3.0-or-later 읽기 전용으로 지원되는 QCOW 형식: 버전 1 버전 2 버전 3 지원되는 QCOW 형식 기능: zlibDEFLATE 압축 AES-CBC 128비트 암호화 backing file차등 이미지 지원되지 않는 QCOW 형식 기능: LUKS 암호화 데이터 파일 이미지 내 스냅샷 작업 진행 중: 파일 API 함수의 스레드 안전성 자세한 내용은 다음을...

CVE-2021-28663

CVE-2021-28663 CVE-2021-28663에 대한 기본 PoC 익스플로잇 Android 커널 백도어 취약점 내부 이것은 CVE-2021-28663에 대한 기본 PoC입니다. Mali GPU Android 커널 드라이버의 설계 결함입니다. 1. GPUVA를 생성하고 동시에 mmap하여 물리 페이지에 대한 가상 주소를 얻습니다. 2. 물리 페이지에 대한 별칭을 생성하지만 mmap은 수행하지 않아 gpumapping은 1로 유지됩니다. 3. GPUVA의 플래그를 BASEMEMDONTNEED로 변경합니다. Mali는 이를 ...

CVE-2026-54076 ArcadeDB: Read-only users can mutate database schema (incomplete fix of CVE-2026-44221)

ArcadeDB is a Multi-Model DBMS. Prior to 26.6.1, the fix for CVE-2026-44221 added an UPDATESCHEMA authorization check only to LocalDocumentType.createProperty, while the remaining public schema mutators in engine/src/main/java/com/arcadedb/schema/LocalDocumentType.java and...

CVE-2026-43785

A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27. An app may be able to modify a file it only had permission to read...

EUVD-2026-77521

Description When ZooKeeper authentication is configured, Storm deliberately retains storm.zookeeper.topology.auth.payload in the topology configuration, because workers need it. Nimbus then served that configuration verbatim to any caller holding read-only topology permissions, so a user whose on...

CVE-2026-82434

Apache Storm Nimbus and the submission client disclose the storm.zookeeper.topology.auth.payload credential to callers holding only read-only topology permissions, and also write it to logs at INFO (client) and DEBUG (SASL handlers). The credential is not read-only : it carries write-capable ACLs...

CVE-2026-82434 Apache Storm Nimbus, Apache Storm Client: Disclosure of the Topology ZooKeeper Credential to Read-Only Users and to Logs

Description When ZooKeeper authentication is configured, Storm deliberately retains storm.zookeeper.topology.auth.payload in the topology configuration, because workers need it. Nimbus then served that configuration verbatim to any caller holding read-only topology permissions, so a user whose on...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: vfio/pci: Properly hiding the first-in-list PCIe extended capabilities There are cases where a PCIe extended capability should be hidden from the user. For example, an unknown capability i.e., a capability with an ID greater than...

PT-2026-91499

A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27. An app may be able to modify a file it only had permission to read...

PT-2026-91237

Description getTopologyPageInfo merged the Nimbus daemon configuration with the topology's own configuration and returned the result without redaction in the topology conf field of TopologyPageInfo. The Storm UI copied that value verbatim into the configuration field of GET /api/v1/topology/id an...

EUVD-2026-75441

OpenPanel fails to enforce read-only project access level on 26 of 29 mutating procedures, allowing read-level members to modify, delete, and publish project data. Attackers with explicit read-only access can delete reports and dashboards, schedule entire projects for deletion, publish private...

EUVD-2026-72946

An internal aggregation expression in MongoDB Server was incorrectly registered as accessible to any authenticated user rather than being restricted to internal cluster operations. By crafting a malformed index specification within this expression, an authenticated user with read-only privileges...

CVE-2026-82059 Improper Access Restriction of Internal Aggregation Expression in MongoDB Server Leads to Assertion Failure and Denial of Service

An internal aggregation expression in MongoDB Server was incorrectly registered as accessible to any authenticated user rather than being restricted to internal cluster operations. By crafting a malformed index specification within this expression, an authenticated user with read-only privileges...

CVE-2026-86493

In JetBrains YouTrack before 2026.2.18634 improper permission checks allowed read-only users to create and modify whiteboard cards...

PT-2026-86738

Incorrect Authorization CWE-863 in Kibana Entity Analytics can lead to a loss of security monitoring via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. An authenticated user holding only read-level Security feature access, and no Elasticsearch privileges, could stop the recurri...