CVE-2026-104915

The Academy LMS plugin for WordPress (versions

CVE-2026-107851

Contao is an Open Source CMS. From version 5.7.0 until 5.7.12, TableAccessVoter::hasAccessToModule in core-bundle/src/Security/Voter/DataContainer/TableAccessVoter.php caches authorization decisions using only $tokenHash, a hash of the user's security token, and omits the table returned by...

Vikunja: Write-level project members can delete admin-tier link shares through an unloaded permission check

Summary A project member with Write permission can delete an admin-tier link share on that project. The deletion authorization check reads the permission from an object populated only with URL IDs, rather than from the stored share. Its zero value is Read, so the check falls through to project...

EUVD-2026-78654

Vikunja: API token scopes bypassed via task expand parameter comments, reactions, time entry counts...

CVE-2026-107851

The Contao Open Source CMS (versions 5.7.0 through 5.7.12) contains an improper access control vulnerability in the TableAccessVoter::hasAccessToModule() function located in core-bundle/src/Security/Voter/DataContainer/TableAccessVoter.php. The root cause is that the voter caches authorization de...

CVE-2026-108110

MOVO through 0.2.3 contains an authorization bypass vulnerability in the chat-api document endpoints that allows authenticated users to access other users' stored objects by supplying arbitrary object paths. Attackers who know a target's object path can send it to /api/documents/fetch or...

Security update for rsyslog

This update for rsyslog fixes the following issues: imdtls permitted-peer authorization bypass bsc1281628. Changes for rsyslog: Upgrade to version 8.2608.0 bsc1257604 Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper...

CVE-2026-104116

A missing authorization check in the illumos zones statistics daemon zonestatd allows a local user in any zone to disrupt zonestat in other zones and to determine which zones are running. The zonestatd door server procedure, zsdserver in usr/src/cmd/zonestat/zonestatd/zonestatd.c, handles the...

CVE-2026-108110

The MOVO application (versions through 0.2.3 ) contains an authorization bypass vulnerability within the chat-api document endpoints. The root cause allows authenticated users to access other users' stored objects by supplying arbitrary object paths . Specifically, an attacker who knows a target'...

EUVD-2026-95883

MOVO through 0.2.3 contains an authorization bypass vulnerability in the chat-api document endpoints that allows authenticated users to access other users' stored objects by supplying arbitrary object paths. Attackers who know a target's object path can send it to /api/documents/fetch or...

EUVD-2026-95798

A missing authorization check in the illumos IP management daemon ipmgmtd allows a local user to change the persistent IP multipathing IPMP configuration. The ipmgmtd door dispatch table in usr/src/cmd/cmd-inet/lib/ipmgmtd/ipmgmtdoor.c does not require the solaris.network.interface.config...

GHSA-PFVF-FWFP-25MP Strawberry GraphQL: Synchronous permission checks can treat an awaitable authorization result as truthy

Summary PermissionExtension.resolve evaluates the return value of haspermission for truthiness on the synchronous path. supportssync only classifies a permission as asynchronous when haspermission is declared with async def via inspect.iscoroutinefunction, so a plain def that returns an awaitable...

auth_analyzer

Auth Analyzer विषय सूची यह क्या है? मुझे Auth Analyzer का उपयोग क्यों करना चाहिए? GUI अवलोकन पैरामीटर निष्कर्षण स्वचालित निष्कर्षण From To String स्थिर मान इनपुट के लिए संकेत पैरामीटर प्रतिस्थापन प्रतिस्थापन स्थान पैरामीटर हटाना नमूना उपयोग स्वचालित रूप से सत्र कुकी निकालें सत्र हेडर और CSRF टोकन...

exploit-CVE-2025-29927

CVE-2025-29927 Next.js के लिए शोषण - प्राधिकरण बायपास इस रेपो को पसंद है? हमें एक ⭐ दें! केवल शैक्षिक और अधिकृत सुरक्षा अनुसंधान उद्देश्यों के लिए। शोषण लेखक @UNICORDev द्वारा @NicPWNs और @Dev-Yeoj भेद्यता विवरण Next.js एक React फ्रेमवर्क है जो फुल-स्टैक वेब एप्लिकेशन बनाने के लिए उपयोग किया जाता...

CVE-2025-29927

CVE-2025-29927 परिचय यह दस्तावेज़ Next.js फ्रेमवर्क में Middleware तंत्र को प्रभावित करने वाली भेद्यता CVE-2025-29927 के अध्ययन को प्रस्तुत करता है। Next.js, Vercel द्वारा React-आधारित एप्लिकेशन विकसित करने के लिए एक लोकप्रिय ओपन-सोर्स फ्रेमवर्क है। यह सर्वर-साइड रेंडरिंग, स्टैटिक जनरेशन और रूटिं...

EUVD-2026-95707

The Shipping for Nova Poshta WordPress plugin through 1.19.8 does not perform any authorisation, nonce or ownership checks on one of its AJAX actions available to unauthenticated users, allowing anyone to delete the shipment records of arbitrary orders and to make the store issue the carrier's...

vulnerable-nextjs-14-CVE-2025-29927

استنساخ تجاوز التصريح CVE-2025-29927 يحتوي هذا المستودع على استنساخ لثغرة CVE-2025-29927 في الحزمة next كيفية الاستنساخ 1. اتبع الخطوات أدناه لاستنساخ وتشغيل تطبيق Next.js 2. اختبر أن التصريح يمنع الوصول إلى نقطة النهاية /api/hello $ curl http://localhost:3000/api/hello "error":"Unauthorized"% 3...

CVE-2024-50395

CVE-2024-50395 معلومات CVE تم الإبلاغ عن ثغرة تجاوز تفويض عبر مفتاح يتحكم فيه المستخدم، تؤثر على إضافة Media Streaming. وإذا تم استغلالها، فقد تسمح الثغرة للمهاجمين على الشبكة المحلية بكسب الامتيازات. لقد قمنا بالفعل بإصلاح الثغرة في الإصدار التالي: Media Streaming add-on 500.1.1.6 2024/08/02 وما...

CVE-2026-78023

Dell Secure Connect Gateway SCG Policy Manager, versions prior to 5.34.00.16, contains an Authorization Bypass Through User-Controlled Key vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges...

CVE-2026-78026

Dell Secure Connect Gateway SCG Policy Manager, versions prior to 5.34.00.16, contains an Authorization Bypass Through User-Controlled Key vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges...