pgbackrest

pgBackRest 可靠的 PostgreSQL 备份与恢复 简介 pgBackRest 是一款可靠的 PostgreSQL 备份与恢复解决方案，可无缝扩展至最大的数据库和工作负载。 pgBackRest v2.59.1 是当前稳定版本。发行说明位于 Releases 页面。 如果您喜欢 pgBackRest，请在 GitHub 上给我们点个星标！ 新闻 2026 年 8 月 17 日 - pgBackRest 2.59.1 发布 2026 年 7 月 20 日 - 新的发行版压缩包 2026 年 7 月 20 日 - pgBackRest 2.59.0 发布 功能特性...

CVE-2026-77006

The WebTotem Backups WordPress plugin through 1.0.1 does not validate a user-supplied file path, does not check the capability of the user making the request, and discards the result of its own CSRF check, allowing any authenticated user, such as a subscriber, to delete arbitrary files on the...

CVE-2026-77006 WebTotem Backups <= 1.0.1 - Subscriber+ Arbitrary File Deletion via Path Traversal

The WebTotem Backups WordPress plugin through 1.0.1 does not validate a user-supplied file path, does not check the capability of the user making the request, and discards the result of its own CSRF check, allowing any authenticated user, such as a subscriber, to delete arbitrary files on the...

EUVD-2026-76814

The WebTotem Backups WordPress plugin through 1.0.1 does not validate a user-supplied file path, does not check the capability of the user making the request, and discards the result of its own CSRF check, allowing any authenticated user, such as a subscriber, to delete arbitrary files on the...

CVE-2026-77006

WebTotem Backups WordPress plugin versions through 1.0.1 contain an arbitrary file deletion vulnerability. The plugin fails to validate a user-supplied file path, does not verify the capability of the requesting user, and discards the result of its own CSRF check. Any authenticated user with subs...

iOSRestrictionBruteForce

iOS 限制密码暴力破解 概述 本版本应用程序使用 Python 编写，用于破解 iPhone/iPad 的限制密码，利用未加密备份中的一个漏洞，使哈希值和盐值可被发现。 依赖 已在 Python 2.7 和 Python 3.7 上测试通过 需要 requests 库，使用 pip install requests 安装 使用方法 root@kitploit: usage: ioscrack.py -h -c --mojave -b folder 用于破解 iDevice 限制密码的脚本 可选参数： -h, --help 显示此帮助信息并退出 -c, --cli 提示用户输入 -m,...

Discourse Backup File Disclosure Via Default Nginx Configuration

Discourse is an open source platform for community discussion. This vulnerability only impacts Discourse instances configured to use FileStore--LocalStore which means uploads and backups are stored locally on disk. If an attacker knows the name of the Discourse backup file, the attacker can trick...

WordPress Plugin File Manager (wp-file-manager) Backup Disclosure

mndpsingh287 WP File Manager v6.4 and lower fails to restrict external access to the fmbackups directory with a .htaccess file. This results in the ability for unauthenticated users to browse and download any site backups, which sometimes include full database backups, that the plugin has taken...

lazywarden

Secure, Automated, and Multi-Cloud Bitwarden Backup and Import System Lazywarden is a Python automation tool designed to Backup and Restore data from your vault, including Bitwarden attachments. It allows you to upload backups to multiple cloud storage services and receive notifications across...

GHSA-P853-83GJ-WJJ3 NocoBase backup restore schema name allows command injection

Summary NocoBase @nocobase/plugin-backups 2.0.57 restores PostgreSQL backups by interpolating the backup metadata schema name into shell command strings that are executed with Node.js childprocess.exec. A backup-management user who can restore an uploaded PostgreSQL backup with forced schema...

EUVD-2026-44804

NocoBase backup restore schema name allows command injection...

NocoBase backup restore schema name allows command injection

Summary NocoBase @nocobase/plugin-backups 2.0.57 restores PostgreSQL backups by interpolating the backup metadata schema name into shell command strings that are executed with Node.js childprocess.exec. A backup-management user who can restore an uploaded PostgreSQL backup with forced schema...

CVE-2026-72881

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, database backup and restore command builders in packages/server/src/utils/backups/utils.ts and packages/server/src/utils/restore/utils.ts interpolate database names, usernames, and passwords into nested shell command...

CVE-2026-48120

Kakoune is a code editor. Prior to version 2026.05.21, the bundled, enabled by default, autorestore.kak script can be exploited by malicious backup files leading to arbitrary kakoune and shell commands being executed by simply opening a file. Kakoune 2026.05.21 fixes the issue. As a workaround, a...

CVE-2026-48120

Kakoune is a code editor. Prior to version 2026.05.21, the bundled, enabled by default, autorestore.kak script can be exploited by malicious backup files leading to arbitrary kakoune and shell commands being executed by simply opening a file. Kakoune 2026.05.21 fixes the issue. As a workaround, a...

CVE-2026-47362

Datadog Android app stores operationally sensitive content in plaintext SQLite databases via Room. Two databases analyzed: LocalNotificationDatabase (local_notifications; title, message, recipient, service, tags, on‑call/incident deeplinks) and SearchRecentDatabase (search_recents; stores every i...

Important: Red Hat Security Advisory: Red Hat OpenShift API for Data Protection

A new version of OpenShift API for Data Protection OADP is now available. OpenShift API for Data Protection OADP enables you to back up and restore application resources, persistent volume data, and internal container images to external backup storage. OADP enables both file system-based and...

CVE-2026-7693

The Backup Migration plugin for WordPress is vulnerable to OS Command Injection in all versions up to, and including, 2.1.5.1 due to insufficient sanitization of the file POST parameter on the restoreBackup AJAX handler. The handler applies escattr — an HTML-context sanitizer that does not strip...

CVE-2026-18477

A TOCTOU Time-of-Check Time-of-Use vulnerability in GNU tar's incremental dumpdir 'X' rename handling allows a local attacker with write access to a directory being backed up to influence the restore process if the attacker has access to the system where the restore is being performed. During...

PT-2026-67429

Name of the Vulnerable Software and Affected Versions GNU tar affected versions not specified Description A TOCTOU Time-of-Check Time-of-Use issue exists in the incremental dumpdir X rename handling. This occurs when a local attacker with write access to a directory being backed up can influence...