PT-2026-106821

Name of the Vulnerable Software and Affected Versions @quasar/icongenie versions prior to 6.1.1 Description The icongenie generate --profile command fails to constrain the resolved destination to the Quasar project directory when processing folder and name values from a user-supplied profile. The...

CVE-2023-43144

CVE-2023-43144 Descrizione Assets Management System 1.0 è vulnerabile a SQL injection tramite il parametro id in delete.php PoC sqlmap -u 'http://localhost/delete.php?id=4' --cookie="PHPSESSID=SESSID" --dbms=MySQL --dbs --batch Revisione del codice delete.php ?php include 'core/init.php'; $id =...

EUVD-2026-92544

Plane is an open-source project management tool. Prior to 1.4.0, WorkspaceFileAssetEndpoint.get and WorkspaceAssetDownloadEndpoint.get resolve FileAsset records within a workspace without checking membership in the asset's project, allowing a workspace member to download assets from private...

CVE-2026-105628 Plane: OAuth Avatar Redirect SSRF Leads to Internal Data Exfiltration via Static Asset Endpoint

Plane is an open-source project management tool. Prior to 1.4.0, Plane's OAuth avatar synchronization flow fetches avatarurl from provider user data through a server-side HTTP request without internal IP validation and follows redirects by default. An attacker can provide an avatar URL that...

CVE-2026-105628 Plane: OAuth Avatar Redirect SSRF Leads to Internal Data Exfiltration via Static Asset Endpoint

Plane is an open-source project management tool. Prior to 1.4.0, Plane's OAuth avatar synchronization flow fetches avatarurl from provider user data through a server-side HTTP request without internal IP validation and follows redirects by default. An attacker can provide an avatar URL that...

CVE-2026-105628

The open-source project management tool Plane is vulnerable to Server-Side Request Forgery (SSRF) in versions prior to 1.4.0 . The flaw exists in the OAuth avatar synchronization flow, where the application fetches an avatar_url from provider user data via a server-side HTTP request. Because the ...

CVE-2026-34910-unifi-poc

UniFi OS CVE Proof of Concept Proof of Concept für autorisierte Tests gegen zwei Pfade, die wie folgt identifiziert wurden: CVE-2026-34910: Auth-Bypass, der zu Command Injection und Remote Code Execution über den Handler für Paketupdates führen kann. CVE-2026-34909: Path Traversal, der zu...

CVE-2026-104960

Plane is an open-source project management tool. Prior to 1.4.0, Plane exposes the workspace-scoped GET /api/assets/v2/workspaces/workspaceslug/download/assetid/ endpoint for project-bound FileAsset objects without enforcing access to the asset's owning project. An authenticated user who belongs ...

CVE-2026-104960 Plane: Authorization bypass in workspace-scoped asset download endpoint exposes secret project file assets to non-project workspace users

Plane is an open-source project management tool. Prior to 1.4.0, Plane exposes the workspace-scoped GET /api/assets/v2/workspaces/workspaceslug/download/assetid/ endpoint for project-bound FileAsset objects without enforcing access to the asset's owning project. An authenticated user who belongs ...

CVE-2026-104960

The project management tool Plane contains an authorization bypass in the workspace-scoped GET /api/assets/v2/workspaces/{workspace_slug}/download/{asset_id}/ endpoint. Prior to version 1.4.0 , the application fails to enforce project-level access controls for project-bound FileAsset objects. Con...

EUVD-2026-92481

Plane is an open-source project management tool. Prior to 1.4.0, Plane exposes the workspace-scoped GET /api/assets/v2/workspaces/workspaceslug/download/assetid/ endpoint for project-bound FileAsset objects without enforcing access to the asset's owning project. An authenticated user who belongs ...

CVE-2026-104960 Plane: Authorization bypass in workspace-scoped asset download endpoint exposes secret project file assets to non-project workspace users

Plane is an open-source project management tool. Prior to 1.4.0, Plane exposes the workspace-scoped GET /api/assets/v2/workspaces/workspaceslug/download/assetid/ endpoint for project-bound FileAsset objects without enforcing access to the asset's owning project. An authenticated user who belongs ...

CVE-2026-104960 Plane: Authorization bypass in workspace-scoped asset download endpoint exposes secret project file assets to non-project workspace users

Plane is an open-source project management tool. Prior to 1.4.0, Plane exposes the workspace-scoped GET /api/assets/v2/workspaces/workspaceslug/download/assetid/ endpoint for project-bound FileAsset objects without enforcing access to the asset's owning project. An authenticated user who belongs ...

Security Bulletin: Platform Navigator and Automation Assets in IBM Cloud Pak for Integration are vulnerable to a vulnerability in js-yaml

Summary Platform Navigator and Automation Assets in IBM Cloud Pak for Integration are vulnerable to a vulnerability in js-yaml. CVE-2026-84375 The vulnerability has been addressed. Vulnerability Details CVEID:CVE-2026-84375 DESCRIPTION: js-yaml is a JavaScript YAML parser and dumper. From 3.0.0...

Security Bulletin: Platform Navigator and Automation Assets in IBM Cloud Pak for Integration are vulnerable to a vulnerability in golang.org/x/crypto

Summary Platform Navigator and Automation Assets in IBM Cloud Pak for Integration are vulnerable to a vulnerability in golang.org/x/crypto. CVE-2026-56854 The vulnerability has been addressed. Vulnerability Details CVEID:CVE-2026-56854 DESCRIPTION: The source-address critical option in the...

CVE-2021-25741

Informazioni fork su Betep0k/CVE-2021-25741/fork le cui immagini sono inutili e test su metarget...

assets-from-spf

assets-from-spf Uno script Python per analizzare netblocks e nomi di dominio dal record DNS SPFSender Policy Framework Per ogni asset analizzato, lo script troverà e stamperà anche i dettagli dell'Autonomous System Number ASN Per ora, l'output viene stampato solo in formato JSON Demo Screenshots...

PT-2026-106028

Plane is an open-source project management tool. Prior to 1.4.0, Plane exposes the workspace-scoped GET /api/assets/v2/workspaces/workspace slug/download/asset id/ endpoint for project-bound FileAsset objects without enforcing access to the asset's owning project. An authenticated user who belong...

PT-2026-106078

Name of the Vulnerable Software and Affected Versions Plane versions prior to 1.4.0 Description Insufficient access control in the project management tool allows unauthorized retrieval of file assets. The endpoints 'WorkspaceFileAssetEndpoint.get' and 'WorkspaceAssetDownloadEndpoint.get' resolve...

CVE-2026-104960: Authorization Bypass Through User-Controlled Key

Plane is an open-source project management tool. Prior to 1.4.0, Plane exposes the workspace-scoped GET /api/assets/v2/workspaces/workspaceslug/download/assetid/ endpoint for project-bound FileAsset objects without enforcing access to the asset's owning project. An authenticated user who belongs ...