EUVD-2026-90973

Capacitor Android and iOS: remote content can be loaded at the app origin via the internal HTTP proxy path...

CVE-2023-43317

CVE-2023-43317 Un usuario normal puede elevar sus privilegios a través del parámetro userPermissionsList en el componente Session Storage para obtener acceso no autorizado a recursos y funcionalidades de nivel administrativo. Esto podría llevar a acceso no autorizado a datos, modificación de dato...

Security Bulletin: The following vulnerabilities that can affect IBM Storage Scale and the HDFS layer are now fixed in 5.2.3.10 or higher and 6.0.1.1 or higher

Summary The following vulnerabilities, which can affect IBM Storage Scale and the HDFS layer and could provide weaker-than-expected security, are now fixed in Storage Scale 5.2.3.10 or higher and 6.0.1.1 or higher Vulnerability Details CVEID:CVE-2026-46340 DESCRIPTION: Netty is a network...

Security Bulletin: The following vulnerabilities that can affect IBM Storage Scale Container Storage Interface (CSI) are now fixed in Storage Scale Container Native 5.2.3.10 / CSI 2.14.9 and Storage Scale Container Native 6.0.1.1 / CSI 3.1.1 or higher

Summary The following vulnerabilities, which can affect IBM Storage Scale Container Storage Interface CSI are now fixed in Storage Scale Container Native 5.2.3.10 / CSI 2.14.9 or higher and Storage Scale Container Native 6.0.1.1 / CSI 3.1.1 or higher. Vulnerability Details CVEID:CVE-2026-14437...

CVE-2026-55726

CVE-2026-55726: Publicly Listable Azure Blob Storage Container device logs Advisory Field| Value ---|--- CVE| CVE-2026-55726 ICSA| ICSA-26-183-03 Gardyn IoT Hub CVSS 3.1| 5.3 Medium Vector 3.1| CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Vector 4.0|...

CVE-2026-66906

CVE-2026-66906 — camel-azure-storage-blob downloadBlobToFile path traversal Reproductores de prueba de concepto ejecutables para la misma vulnerabilidad de Apache Camel, uno por runtime: Runtime| Directorio| Stack ---|---|--- Camel Spring Boot| camel-spring-boot/| Spring Boot 3.5.13 +...

CVE-2026-78860

An issue in Mercusys AC12 V2 allows a local attacker to execute arbitrary code via the storage of information in plaintext...

CVE-2026-105679

Ghost is a Node.js content management system. From 6.22.1 until 6.64.0, Ghost restricted the content type used to serve uploaded files to prevent browsers from executing them. On sites using the default local storage adapter, this restriction was not applied, so files uploaded by any staff user...

CVE-2026-105686 Penpot: Repeated chunk index causes temporary-storage amplification

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the chunked media upload RPC validates that a chunk index is in range but neither rejects an already stored index nor replaces its previous object. An authenticated user can repeatedly upload the same valid index, causing...

CVE-2026-105686 Penpot: Repeated chunk index causes temporary-storage amplification

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the chunked media upload RPC validates that a chunk index is in range but neither rejects an already stored index nor replaces its previous object. An authenticated user can repeatedly upload the same valid index, causing...

CVE-2026-105686

The open-source design and prototyping platform Penpot is vulnerable to temporary-storage amplification in versions prior to 2.18.0 . The issue exists within the chunked media upload RPC , which fails to reject or replace previously stored chunk indexes. An authenticated user can repeatedly uploa...

CVE-2026-105686 Penpot: Repeated chunk index causes temporary-storage amplification

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the chunked media upload RPC validates that a chunk index is in range but neither rejects an already stored index nor replaces its previous object. An authenticated user can repeatedly upload the same valid index, causing...

EUVD-2026-92779

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the chunked media upload RPC validates that a chunk index is in range but neither rejects an already stored index nor replaces its previous object. An authenticated user can repeatedly upload the same valid index, causing...

CVE-2026-105679 Ghost: Stored XSS via File Uploads on Local Storage

Ghost is a Node.js content management system. From 6.22.1 until 6.64.0, Ghost restricted the content type used to serve uploaded files to prevent browsers from executing them. On sites using the default local storage adapter, this restriction was not applied, so files uploaded by any staff user...

CVE-2026-105679 Ghost: Stored XSS via File Uploads on Local Storage

Ghost is a Node.js content management system. From 6.22.1 until 6.64.0, Ghost restricted the content type used to serve uploaded files to prevent browsers from executing them. On sites using the default local storage adapter, this restriction was not applied, so files uploaded by any staff user...

CVE-2026-105679

The Ghost Node.js content management system is vulnerable to Stored XSS in versions 6.22.1 through 6.64.0 . The root cause is that the restriction on content types for uploaded files is not applied when using the default local storage adapter , allowing files to be served with content types deriv...

CVE-2026-105679 Ghost: Stored XSS via File Uploads on Local Storage

Ghost is a Node.js content management system. From 6.22.1 until 6.64.0, Ghost restricted the content type used to serve uploaded files to prevent browsers from executing them. On sites using the default local storage adapter, this restriction was not applied, so files uploaded by any staff user...

CVE-2026-105679

Ghost is a Node.js content management system. From 6.22.1 until 6.64.0, Ghost restricted the content type used to serve uploaded files to prevent browsers from executing them. On sites using the default local storage adapter, this restriction was not applied, so files uploaded by any staff user...

cve-2022-23131

cve-2022-23131 cve-2022-23131 zabbix-saml-bypass-exp 1. reemplaza zbxsignedsession por cookie 2. inicia sesión con Single Sign-On SAML autor: @random-robbie、@jweny y @Mr-xn link: https://blog.sonarsource.com/zabbix-case-study-of-unsafe-session-storage...

CyberQRM

CyberQRM – 网络量化风险管理 一个本地、开源的平台，用于基于 FAIR v3.1（信息风险因子分析）框架进行量化网络安全风险评估 。从浏览器中建模威胁、运行蒙特卡洛模拟、衡量控制措施有效性并管理风险组合——无需云账户。 功能 基于FAIR的风险建模 — 针对每个场景，使用三角分布、对数正态分布或点分布定义威胁事件频率、脆弱性、资产价值和损失事件影响 多基础资产估值 — 将资产价值建模为多个维度的总和（重置成本、收入影响、监管风险、业务中断、声誉价值），每个维度有自己的分布 初级与次级损失 —...