27 matches found
CVE-2026-102923
Prior to version 1.6.0 , the SparkyFitness health and fitness tracker is vulnerable to Server-Side Request Forgery (SSRF) . The flaw exists because the components SparkyFitnessServer/services/chatService.ts and SparkyFitnessServer/services/labelScanService.ts fail to validate destinations provide...
CVE-2026-102923 SparkyFitness: SSRF via unvalidated custom_url in AI service settings
SparkyFitness is a self-hosted, AI-powered health and fitness tracker for families. Prior to 1.6.0, SparkyFitnessServer/services/chatService.ts and SparkyFitnessServer/services/labelScanService.ts do not validate destinations supplied in custom AI service settings. An authenticated user saves a...
Missing Authorization
Overview kibana is an open source Apache Licensed, browser-based analytics and search dashboard for Elasticsearch. Affected versions of this package are vulnerable to Missing Authorization via direct requests to insufficiently protected product endpoints. An attacker can access and modify...
CVE-2026-63141 Missing Authorization in Kibana Leading to Unauthorized Access to Cloud Connect Management Functions
Missing Authorization CWE-862 in Kibana allows an authenticated user to access and modify Cloud Connect configuration and service settings without the required feature privileges, via direct requests to insufficiently protected product endpoints...
CVE-2026-63141
Missing Authorization CWE-862 in Kibana allows an authenticated user to access and modify Cloud Connect configuration and service settings without the required feature privileges, via direct requests to insufficiently protected product endpoints...
PT-2026-62410
Name of the Vulnerable Software and Affected Versions Kibana affected versions not specified Description An authenticated user can access and modify Cloud Connect configuration and service settings without the necessary feature privileges. This occurs due to missing authorization in product...
Improper Authentication
Overview n8n is a n8n Workflow Automation Tool Affected versions of this package are vulnerable to Improper Authentication via the Self-Service Settings API. An attacker can circumvent centralized identity management and multi-factor authentication by disabling SSO enforcement for their own accou...
n8n has an SSO Enforcement Bypass in its Self-Service Settings API
Impact An authenticated user signed in through Single Sign-On SSO could disable SSO enforcement for their own account through the n8n API. This allowed the user to create a local password and authenticate directly with email and password, completely bypassing the organization's SSO policy,...
Improper Authentication
Overview @n8n/rest-api-client is a This package contains the REST API calls for n8n. Affected versions of this package are vulnerable to Improper Authentication via the Self-Service Settings API. An attacker can circumvent centralized identity management and multi-factor authentication by disabli...
GHSA-VJF3-2GPJ-233V n8n has an SSO Enforcement Bypass in its Self-Service Settings API
Impact An authenticated user signed in through Single Sign-On SSO could disable SSO enforcement for their own account through the n8n API. This allowed the user to create a local password and authenticate directly with email and password, completely bypassing the organization's SSO policy,...
Improper Authentication
Overview @n8n/api-types is a fair-code workflow automation platform with native AI capabilities Affected versions of this package are vulnerable to Improper Authentication via the Self-Service Settings API. An attacker can circumvent centralized identity management and multi-factor authentication...
EUVD-2020-29002
Malware in sbrugna...
uptux
uptux Specialized privilege escalation checks for Linux systems. Implemented so far: - Writable systemd paths, services, timers, and socket units - Disassembles systemd unit files looking for: - References to executables that are writable - References to broken symlinks pointing to writeable...
CVE-2024-57677
The D-Link DIR-816A2 router (specifically firmware FWv1.10CNB05_R1B011D88210 ) is vulnerable to an access control issue within the form2Wan.cgi component. This flaw allows an unauthenticated attacker to set the device's WAN service by sending a specially crafted HTTP POST request . While some sou...
Progress Software WhatsUp Gold 访问控制错误漏洞
Progress Software WhatsUp Gold is a network monitoring software from Progress Software, Inc. It is used to monitor the entire network infrastructure as well as applications, configurations and network traffic. An Access Control Error vulnerability exists in Progress Software WhatsUp Gold versions...
CVE-2024-8903
Local active protection service settings manipulation due to unnecessary privileges assignment. The following products are affected: Acronis Cyber Protect Cloud Agent Windows, macOS before build 38565...
D-Link DIR-846W 安全漏洞
D-Link DIR-846W is a dual-band Gigabit wireless router with second-generation 11AC technology and MU-MIMO technology, supporting dual-band concurrent transmission rates up to 1200Mbps for 200M and above broadband users. The D-Link DIR-846W suffers from a command execution vulnerability that...
PT-2023-2596 · Gitlab · Gitlab Ce/Ee +1
Name of the Vulnerable Software and Affected Versions: GitLab Enterprise Edition versions 11.1.7 and earlier, 11.2.x before 11.2.4, 11.3.x before 11.3.1 Description: An issue was discovered related to the "merge request approvals" feature, where attackers could obtain sensitive information about...
