34173 matches found
foxcage
foxcage Ejecuta Firefox en un contenedor Podman sin root para aislamiento de seguridad. Tu navegador se ejecuta con casi ninguna capacidad de Linux, en su propio espacio de nombres de usuario y de red, aislado del host — mientras sigue teniendo aceleración completa por GPU, audio y soporte DRM...
EUVD-2026-94646
Vault and Vault Enterprise did not consistently verify that stored plugin catalog entries reference binaries within the configured plugin directory. When Vault uses Shamir seals and has an external plugin directory configured, a privileged operator able to restore an Integrated Storage Raft...
Strapi Cleartext Storage of Sensitive Information Vulnerability
Strapi contains a cleartext storage of sensitive information vulnerability that could allow attackers with access to the admin panel to discover sensitive user details via the query filter. The impacted products could be end-of-life EoL and/or end-of-service EoS. Users are advised to discontinue...
PT-2026-107813
A session context forgery vulnerability exists in the web management daemon of Brocade Fabric OS versions 9.2.2d and 10.0.0 through 10.0.0a1. When processing local inter-process communication IPC storage callbacks, the service accepts and registers session structures including administrative role...
PT-2026-107800
An arbitrary file and directory deletion vulnerability exists in the REST API management interface handling USB storage operations on Brocade Fabric OS versions before 10.0.1. An authenticated user possessing USB management privileges can manipulate requested target paths to delete arbitrary file...
CVE-2026-105816
Vault and Vault Enterprise did not consistently verify that stored plugin catalog entries reference binaries within the configured plugin directory. When Vault uses Shamir seals and has an external plugin directory configured, a privileged operator able to restore an Integrated Storage Raft...
CVE-2026-38526
CVE-2026-38526 — Krayin CRM ≤ 2.2.x Authenticated RCE ⚠️ Legal disclaimer : this code is provided for educational purposes and for authorized testing only CTF, bug bounty, private lab. The author is not responsible for any illegal use. Description Krayin CRM Webkul ≤ 2.2.x exposes the...
Payload: Incomplete validation during the upload file lifecycle
Impact Under certain conditions, an authenticated user with permission to modify uploads could cause unintended files to be removed during file cleanup. This may result in data loss or service disruption. You are affected if: - You use Payload upload collections with local file storage. - Untrust...
GHSA-P223-2WR2-J562 Payload: Incomplete validation during the upload file lifecycle
Impact Under certain conditions, an authenticated user with permission to modify uploads could cause unintended files to be removed during file cleanup. This may result in data loss or service disruption. You are affected if: - You use Payload upload collections with local file storage. - Untrust...
EUVD-2026-93513
Payload: Client uploads could overwrite S3 objects...
EUVD-2026-92770
Ghost: Stored XSS via File Uploads on Local Storage...
Ghost: Stored XSS via File Uploads on Local Storage
Impact Ghost restricts the content type that uploaded files are served with, to prevent browsers from executing them. On sites using the default local storage adapter, this restriction was not applied, so files uploaded by any staff user were served with a content type derived from their file...
NPM: Ghost: Stored XSS via File Uploads on Local Storage
NPM: Ghost: Stored XSS via File Uploads on Local Storage vulnerability discovered by ? in WordPress Npm ghost versions = 6.22.1, 6.64.0...
GHSA-GFJP-2P8F-94QV Ghost: Stored XSS via File Uploads on Local Storage
Impact Ghost restricts the content type that uploaded files are served with, to prevent browsers from executing them. On sites using the default local storage adapter, this restriction was not applied, so files uploaded by any staff user were served with a content type derived from their file...
EUVD-2026-94008
Backstage: Improper authorization enforcement for TechDocs static content...
GHSA-RG9R-HR7G-5GC2 Backstage: Improper authorization enforcement for TechDocs static content
Impact An authenticated user with access to one TechDocs documentation site could craft a URL able to read documentation belonging to a different entity. This only affects deployments using the external TechDocs builder with an external storage provider S3, GCS, etc. and the permission framework...
EUVD-2026-94009
Backstage: Improper input validation in TechDocs static content requests...
GHSA-7MFX-XG57-53C9 Backstage: Improper input validation in TechDocs static content requests
Impact When using the Azure Blob Storage provider, an authenticated Backstage user may be able to read restricted TechDocs content when entity-level permissions are enabled. Deployments that intentionally disable the default backend authentication policy may have broader exposure. Patches Patched...
Backstage: Improper input validation in TechDocs static content requests
Impact When using the Azure Blob Storage provider, an authenticated Backstage user may be able to read restricted TechDocs content when entity-level permissions are enabled. Deployments that intentionally disable the default backend authentication policy may have broader exposure. Patches Patched...