Directus < 11.9.0 - Version Disclosure

Directus versions from 9.0.0 before 11.9.0 expose the exact running version through the OpenAPI specification returned by the unauthenticated /server/specs/oas endpoint. The version is placed in the OpenAPI info.version field, letting an unauthenticated attacker fingerprint the precise Directus...

Dify <=1.14.1 - Unauthenticated Plugin Daemon Path Traversal

Dify version 1.14.1 and prior are affected by an unauthenticated path traversal in the Plugin Daemon icon proxy endpoint. The /console/api/workspaces/current/plugin/icon endpoint requires no authentication and passes the filename query parameter unsanitized into the internal Plugin Daemon REST AP...

CVE-2025-47812

CVE-2025-47812 How does this detection method work? This Nuclei template detects Wing FTP Server instances vulnerable to CVE-2025-47812 by identifying versions older than 7.4.4 exposed in the web client’s HTML response. How do I run this script? 1. Download Nuclei from here 2. Copy the template t...

CVE-2020-9483

CVE-2020-9483 PoC уязвимости SQL-инъекции CVE-2020-9483, Apache SkyWalking Использование:python3 CVE-2020-9483.py -ip 127.0.0.1 С помощью этого скрипта можно получить версию базы данных через SQL-инъекцию. Нажмите звездочку, если вам понравился этот скрипт. Если вы считаете, что этот PoC помог ва...

CTF_CVE-2020-7471

DOBBYISFREE! CTF proposé: 2020 Christmas CTF Domaine: WEB Mot-clé: DOBBYISFREE! Difficulté: ★★★☆☆ Contexte Comme je vois que les hackers web étudient généralement les SQL Injections sur mysql, j'ai créé ce problème en utilisant postgresql pour l'injection, dans l'espoir qu'ils puissent expériment...

CVE-2023-35078

CVE-2023-35078 This script ethically checks for the presence of cve-2023-35078 via requesting the /ping endpoint from the Ivanti EPMM API. /ping simply responds with the VSP version, rather than attemping to pull device or admin data. Usage: ./CVE-2023-35078 This script assumes https connections...

PT-2026-88503

Impact The endpoint /rest/active-workflows returned every active workflow ID on the instance to any member, regardless of sharing, and workflow activation, deactivation and publication push events were broadcast to every connected client, carrying workflow IDs, version IDs and activation-error...

CVE-2026-79777 rclone before v1.75.0 Information Disclosure via RC API

rclone before v1.75.0 includes full Go stack traces in RC API error responses when panics occur. Attackers can trigger panics to leak internal file paths, module versions, goroutine states, and memory addresses...

CVE-2026-27463

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, the HTML title attribute of the logo in the login page contains the complete iTop version. This issue has been fixed in version 3.2.3...

CVE-2026-27463

Combodo iTop , a web-based IT service management tool, prior to version 3.2.3 , exposes the full application version in the HTML title attribute of the logo on the login page. This allows unauthenticated remote attackers to fingerprint the exact version, facilitating targeted exploitation of know...

EUVD-2026-64124

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, the HTML title attribute of the logo in the login page contains the complete iTop version. This issue has been fixed in version 3.2.3...

CVE-2026-27463 Combodo iTop: Version disclosure via login page logo

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, the HTML title attribute of the logo in the login page contains the complete iTop version. This issue has been fixed in version 3.2.3...

CVE-2026-27463 Combodo iTop: Version disclosure via login page logo

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, the HTML title attribute of the logo in the login page contains the complete iTop version. This issue has been fixed in version 3.2.3...

CVE-2026-73290

RustFS prior to 1.0.0-beta.12 contains an anonymous ListObjectVersions bypass where a ListBucket check is used if no bucket-policy grant exists, skipping the policy_allowed path (deny_anonymous_table_data_plane_if_needed and RestrictPublicBuckets). This allows buckets that permit anonymous listin...

CVE-2026-19325

A security vulnerability has been detected in IncomeStreamSurfer roo-code-memory-bank-mcp-server up to 9dcb2fb5e6b65a35ac1983885a6d4e5621a0081e. This affects the function readMemoryBankFile/appendMemoryBankEntry of the file src/index.ts of the component readmemorybankfile/appendmemorybankentry...

CVE-2026-56578

HCL MyCloud was affected by Server Version Disclosure. It may help attackers identify and exploit known vulnerabilities affecting the disclosed software versions...

EUVD-2026-46341

HCL MyCloud was affected by Server Version Disclosure. It may help attackers identify and exploit known vulnerabilities affecting the disclosed software versions...

CVE-2026-56578

HCL MyCloud was affected by Server Version Disclosure. It may help attackers identify and exploit known vulnerabilities affecting the disclosed software versions...

CVE-2026-56578 HCL MyCloud was affected by Server Version Disclosure

HCL MyCloud was affected by Server Version Disclosure. It may help attackers identify and exploit known vulnerabilities affecting the disclosed software versions...

CVE-2026-56578

Technical details about CVE-2026-56578 are not provided in the supplied documents; monitor for updates as information on affected versions, impact, and fixes is not publicly available here.