CVE-2026-53595_exploit

CVE-2026-53595 + CVE-2026-53593 — FreeScout Anonyme Kontoübernahme → RCE Nicht authentifizierte Remote-Codeausführung in FreeScout ≤ 1.8.223 ein Laravel-Helpdesk durch Verkettung zweier Schwachstellen, die beide in 1.8.224 behoben wurden: CVE-2026-53595 — anonyme Kontoübernahme. POST...

CVE-2025-6758

Real Spaces - WordPress-Theme für Immobilienverzeichnisse ≤ 3.6 Nicht authentifizierte Privilegieneskalation zum Administrator über imicagentregister 📝 Beschreibung CVE-2025-6758 CVSS-Score: 9.8 Kritisch Das Real Spaces - WordPress-Theme für Immobilienverzeichnisse für WordPress ist in allen...

spaces-finder

Spaces finder Spaces finder ist ein Tool, um DigitalOcean Spaces schnell zu durchsuchen und nach Beute zu suchen. Es ähnelt einem Subdomain-Bruteforcer, ist aber speziell für DigitalOcean Spaces entwickelt und bietet zusätzliche Funktionen, mit denen du nach interessanten Dateien grep-en und...

CVE-2024-1874

CVE-2024-1874 Proof-of-Concept für CVE-2024-1874 Befehlseinschleusung über den array-ähnlichen $command-Parameter von procopen Umgehung des CVE-2024-1874-Fixes Die CVE: In PHP-Versionen 8.1. vor 8.1.29, 8.2. vor 8.2.20, 8.3. vor 8.3.8 funktioniert der Fix für CVE-2024-1874 nicht, wenn der...

CVE-2026-104975 Plane: Cross-tenant asset authorization bypass in Plane Spaces public-board endpoints

Plane is an open-source project management tool. Prior to 1.4.0, Plane's dashboard asset endpoints in plane/app/views/asset/v2.py were remediated for two cross-tenant asset IDORs, CVE-2026-27705 and CVE-2026-46558. Those fixes added a membership check and projectid and workspaceslug scoping to th...

EUVD-2026-92530

Plane is an open-source project management tool. Prior to 1.4.0, Plane's dashboard asset endpoints in plane/app/views/asset/v2.py were remediated for two cross-tenant asset IDORs, CVE-2026-27705 and CVE-2026-46558. Those fixes added a membership check and projectid and workspaceslug scoping to th...

CVE-2026-104975 Plane: Cross-tenant asset authorization bypass in Plane Spaces public-board endpoints

Plane is an open-source project management tool. Prior to 1.4.0, Plane's dashboard asset endpoints in plane/app/views/asset/v2.py were remediated for two cross-tenant asset IDORs, CVE-2026-27705 and CVE-2026-46558. Those fixes added a membership check and projectid and workspaceslug scoping to th...

CVE-2026-104975 Plane: Cross-tenant asset authorization bypass in Plane Spaces public-board endpoints

Plane is an open-source project management tool. Prior to 1.4.0, Plane's dashboard asset endpoints in plane/app/views/asset/v2.py were remediated for two cross-tenant asset IDORs, CVE-2026-27705 and CVE-2026-46558. Those fixes added a membership check and projectid and workspaceslug scoping to th...

cve-2022-21877

POC CVE-2022-21877 Questo repository contiene un POC per la CVE-2022-21877, scoperto da Quang Linh, che lavora presso STAR Labs. Si tratta di una fuga di informazioni trovata all'interno del driver spaceport.sys. Un post di blog di accompagnamento può essere trovato a questo indirizzo. Utilizzo P...

PT-2026-106054

Plane is an open-source project management tool. Prior to 1.4.0, Plane's dashboard asset endpoints in plane/app/views/asset/v2.py were remediated for two cross-tenant asset IDORs, CVE-2026-27705 and CVE-2026-46558. Those fixes added a membership check and project id and workspace slug scoping to...

CVE-2026-104975: Authorization Bypass Through User-Controlled Key

Plane is an open-source project management tool. Prior to 1.4.0, Plane's dashboard asset endpoints in plane/app/views/asset/v2.py were remediated for two cross-tenant asset IDORs, CVE-2026-27705 and CVE-2026-46558. Those fixes added a membership check and projectid and workspaceslug scoping to th...

Verifiable Quantum Advantage Based on Polynomials with Planted Structures

A central question in the theory of quantum advantage is whether there are quantum advantage protocols with similar resource requirements as random circuit sampling that are also verifiable just from the classical outputs of the quantum computation. Here, we develop the idea of simulation secrets...

Important: Red Hat Security Advisory: Red Hat OpenShift Dev Spaces 3.30.1 Release.

Red Hat OpenShift Dev Spaces 3.30.1 has been released. The 3.30.1 release fixes the regression CRW-13015 Get Started / sample cards on the dashboard are empty after upgrade to 3.30. This release provides additional CVE fixes and container dependency updates to Dev Spaces 3.30. Red Hat OpenShift D...

Kibana 8.19.22, 9.4.7, 9.5.3 Security Update (ESA-2026-139)

Missing Authorization in Kibana Leading to Unauthorized Deletion of Data Missing Authorization CWE-862 in Kibana can lead to unauthorized deletion of data via Exploiting Incorrectly Configured Access Control Security Levels CAPEC-180. An authenticated user holding Synthetics privileges scoped to ...

CVE-2026-52850 Docmost: Broken access control in transclusion lookup API leaks sync-block content across private spaces

Docmost is open-source collaborative wiki and documentation software. Prior to 0.90.1, an authenticated workspace member who does not belong to a private space can call the transclusion / sync-block lookup API with a known sourcePageId and transclusionId pair because the lookup does not enforce...

PT-2026-96927

Name of the Vulnerable Software and Affected Versions MCP Atlassian versions prior to 0.22.0 Description Caller-supplied projects filter and spaces filter arguments can override administrator-configured allowlists. Additionally, caller-provided project or space clauses can suppress configured...

Important: Red Hat Security Advisory: Red Hat OpenShift Dev Spaces 3.30.1 Release.

Red Hat OpenShift Dev Spaces 3.30.1 has been released. The 3.30.1 release fixes the regression CRW-13015 Get Started / sample cards on the dashboard are empty after upgrade to 3.30. This release provides additional CVE fixes and container dependency updates to Dev Spaces 3.30. Red Hat OpenShift D...

CVE-2026-54677

Scoold is a Q&A and a knowledge sharing platform for teams. Prior to 1.69.0, authenticated users who are not members of a private space can create content in questions belonging to that space because src/main/java/com/erudika/scoold/controllers/QuestionController.java in QuestionController.reply...

CVE-2026-54676: Missing Authorization

Scoold is a Q&A and a knowledge sharing platform for teams. Prior to 1.69.0, users with personal API tokens can retrieve replies from questions in private spaces they cannot access because src/main/java/com/erudika/scoold/api/ApiController.java in ApiController.getPostReplies does not apply...

rsync: rsync: Authorization bypass via `auth users` directive parsing

An authorization bypass flaw was found in the rsync daemon. The auth users directive parser incorrectly handles group names containing spaces due to comma-only tokenization. This flaw causes deny rules to be silently discarded, allowing an authenticated user to bypass restrictions and gain...