CVE-2026-101158

A missing input validation vulnerability in the Fileserver upload API allows an authenticated attacker with file upload privileges to execute stored cross-site scripting XSS. Successful exploitation could enable the attacker to hijack another CloudVision user's web session, potentially granting...

drupalgeddon2-cli

drupalgeddon2-cli 一个命令行版本的 Drupalgeddon2 CVE-2018-7600 概念验证工具，作为学习练习在完成 Hack The Box Academy Attacking Common Applications 模块时编写。 !WARNING 仅限授权的安全测试和教育用途。 在非您拥有的或未经明确书面许可的系统上运行此工具，在大多数司法管辖区属于违法行为。请参阅 法律与负责任使用。 !NOTE 实现借助 AI 辅助编写。 请参阅 关于作者身份的说明。 背景——我为何构建此工具 Drupal 是 HTB Academy 的 Attacking Common...

tracehound

面向高速API的确定性运行时安全缓冲区 外部系统发出威胁信号。Tracehound保留证据。 网站 · 文档索引 · API参考 · 配置 · RFC · 安全 · 更新日志 Tracehound是一个无需决策的取证运行时，位于上游检测和下游响应之间。它不分类流量、不应用启发式规则、也不替代WAF。它接收明确的威胁信号，隔离证据，并保留防篡改的操作记录，而不会成为主机应用程序的新拒绝服务向量。...

CVE-2026-102158 Security Advisory 0190

Improper validation of selected CloudVision CUE application programming interface API request parameters may allow an authenticated network user to perform SQL injection against the backend impacting its availability...

CVE-2026-102158 Security Advisory 0190

Improper validation of selected CloudVision CUE application programming interface API request parameters may allow an authenticated network user to perform SQL injection against the backend impacting its availability...

EUVD-2026-93955

Improper validation of selected CloudVision CUE application programming interface API request parameters may allow an authenticated network user to perform SQL injection against the backend impacting its availability...

CVE-2026-102158

Improper validation of selected CloudVision CUE application programming interface (API) request parameters allows an authenticated network user to perform SQL injection against the backend. This vulnerability impacts the availability of the system. No specific details regarding affected versions ...

CVE-2026-101158 Security Advisory 0185

A missing input validation vulnerability in the Fileserver upload API allows an authenticated attacker with file upload privileges to execute stored cross-site scripting XSS. Successful exploitation could enable the attacker to hijack another CloudVision user's web session, potentially granting...

CVE-2026-101158 Security Advisory 0185

A missing input validation vulnerability in the Fileserver upload API allows an authenticated attacker with file upload privileges to execute stored cross-site scripting XSS. Successful exploitation could enable the attacker to hijack another CloudVision user's web session, potentially granting...

CVE-2026-101158

A missing input validation vulnerability in the Fileserver upload API allows an authenticated attacker with file upload privileges to execute stored cross-site scripting (XSS) . Successful exploitation could enable an attacker to hijack another CloudVision user's web session , potentially resulti...

EUVD-2026-93944

A missing input validation vulnerability in the Fileserver upload API allows an authenticated attacker with file upload privileges to execute stored cross-site scripting XSS. Successful exploitation could enable the attacker to hijack another CloudVision user's web session, potentially granting...

CVE-2026-103006 Uncontrolled Recursion in Elasticsearch Leading to Denial of Service

Uncontrolled Recursion CWE-674 in Elasticsearch can lead to Denial of Service via a specially crafted, deeply nested request submitted to the aggregation feature of the search API. Elasticsearch contains an uncontrolled recursion weakness in its search aggregation processing. An authenticated use...

EUVD-2026-93936

Uncontrolled Recursion CWE-674 in Elasticsearch can lead to Denial of Service via a specially crafted, deeply nested request submitted to the aggregation feature of the search API. Elasticsearch contains an uncontrolled recursion weakness in its search aggregation processing. An authenticated use...

CVE-2026-103006

Uncontrolled Recursion CWE-674 in Elasticsearch can lead to Denial of Service via a specially crafted, deeply nested request submitted to the aggregation feature of the search API. Elasticsearch contains an uncontrolled recursion weakness in its search aggregation processing. An authenticated use...

CVE-2026-103006

Elasticsearch is vulnerable to Uncontrolled Recursion (CWE-674) in its search aggregation processing . An authenticated user with read access to a single index can submit a specially crafted request containing deeply nested aggregation definitions. This triggers unbounded recursive execution, exh...

CVE-2026-102410 Missing Authorization in Kibana Leading to Information Disclosure

Missing Authorization CWE-862 in Kibana can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. An internal API surface within the Metrics Experience feature did not enforce a Kibana-level authorization check that an equivalent, related API in the...

CVE-2026-102407 Incorrect Authorization in Elasticsearch Leading to Unauthorized Data Stream Modification

Incorrect Authorization CWE-863 in Elasticsearch can lead to unauthorized data stream modification via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. An authenticated user with sufficient privileges over a single resource could use the Modify Data Streams API to modify a data...

CVE-2026-102407

A vulnerability in Elasticsearch (CWE-863) allows an authenticated user with sufficient privileges over a single resource to modify a data stream to which they are not authorized. By using the Modify Data Streams API , an attacker can potentially inject data or affect searchability, though they c...

CVE-2026-102407 Incorrect Authorization in Elasticsearch Leading to Unauthorized Data Stream Modification

Incorrect Authorization CWE-863 in Elasticsearch can lead to unauthorized data stream modification via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. An authenticated user with sufficient privileges over a single resource could use the Modify Data Streams API to modify a data...

EUVD-2026-93928

Incorrect Authorization CWE-863 in Elasticsearch can lead to unauthorized data stream modification via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. An authenticated user with sufficient privileges over a single resource could use the Modify Data Streams API to modify a data...