PongoOS

pongoOS بيئة تشغيل تمهيدية للوحات Apple مبنية على top من checkra1n. البناء على macOS قم بتثبيت Xcode + أدوات سطر الأوامر قم بتشغيل make all البناء على لينكس قم بتثبيت clang إذا كنت في شك، من apt.llvm.org قم بتثبيت ld64 و strip من cctools. على Debian/Ubuntu يمكن تثبيتها من مستودع checkra1n:...

CVE-2025-25279

Security Advisory MMSA-2025-00430 / CVE-2025-25279 Résumé Après avoir téléversé un fichier dans Mattermost Boards, lorsque le paramètre fileId est modifié et que le tableau est copié, le fichier pointe désormais vers le fichier cible spécifié dans le paramètre et le télécharge. Versions concernée...

CVE-2026-78466

The Fluent Boards Pro plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to and including 2.0.11 , caused by missing validation on a user-controlled key. Authenticated attackers with Subscriber-level access or above can perform an unauthorized action. The CV...

EUVD-2026-65298

The Fluent Boards Pro plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.0.11 due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perform an...

CVE-2026-78278

Subscriber Insecure Direct Object References IDOR in Fluent Boards Pro = 2.0.11 versions...

EUVD-2026-64785

Subscriber Insecure Direct Object References IDOR in Fluent Boards Pro = 2.0.11 versions...

CVE-2026-78278

Fluent Boards Pro is a WordPress plugin affected by a Subscriber-level Insecure Direct Object Reference (IDOR) vulnerability in versions ≤ 2.0.11 . The flaw is reachable over the network with no privileges required and low attack complexity , allowing an unauthenticated attacker to access objects...

CVE-2026-78278 WordPress Fluent Boards Pro plugin <= 2.0.11 - Insecure Direct Object References (IDOR) vulnerability

Subscriber Insecure Direct Object References IDOR in Fluent Boards Pro = 2.0.11 versions...

WordPress Fluent Boards Pro plugin <= 2.0.11 - Insecure Direct Object References (IDOR) vulnerability

Insecure Direct Object References IDOR vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Fluent Boards Pro versions = 2.0.11...

chipwhisperer

ChipWhisperer | | Liens importants Documentation | Tutoriels | Forum | Boutique | NewAE ChipWhisperer 6.0 : Changements et nettoyage du dépôt ChipWhisperer 6.0 apporte de nombreux changements au dépôt ChipWhisperer. Le plus important est un nettoyage de l'historique git de ce dépôt et de...

Mattermost Server 10.11.x < 10.11.22 / 11.7.x < 11.7.7 / 11.8.x < 11.8.4 Multiple Vulnerabilities (MMSA-2026-00685, MMSA-2026-00686, MMSA-2026-00687, MMSA-2026-00691)

The version of Mattermost Server installed on the remote host is affected by multiple vulnerabilities as referenced in the MMSA-2026-00685, MMSA-2026-00686, MMSA-2026-00687, MMSA-2026-00691 advisories. - Mattermost versions 11.7.x = 11.7.6, 10.11.x = 10.11.21, 11.8.x = 11.8.3 fail to validate...

CVE-2026-9859 Mattermost Boards plugin didn’t enforce role-based authorization on board channel link allowing board editors to expose boards to arbitrary channels

Mattermost versions 11.7.x = 11.7.6, 10.11.x = 10.11.21, 11.8.x = 11.8.3 fail to enforce PermissionManageBoardRoles on the channelId field of the batch endpoint, which allows an authenticated board editor to relink any board they can edit to an arbitrary channel via a crafted PATCH request...

CVE-2026-9859 Mattermost Boards plugin didn’t enforce role-based authorization on board channel link allowing board editors to expose boards to arbitrary channels

Mattermost versions 11.7.x = 11.7.6, 10.11.x = 10.11.21, 11.8.x = 11.8.3 fail to enforce PermissionManageBoardRoles on the channelId field of the batch endpoint, which allows an authenticated board editor to relink any board they can edit to an arbitrary channel via a crafted PATCH request...

CVE-2026-9859

Mattermost Boards plugin (versions ≤11.7.6, ≤10.11.21, ≤11.8.3) fails to enforce PermissionManageBoardRoles on the batch endpoint's channelId field, allowing authenticated board editors to relink boards to arbitrary channels via crafted PATCH requests. CVSS 3.1 scores 6.5 (MEDIUM) for network-bas...

CVE-2026-10080 Boards plugin panics on WebSocket command with non-string field types

Mattermost versions 11.7.x = 11.7.6, 10.11.x = 10.11.21, 11.8.x = 11.8.3 fails to validate WebSocket command field types which allows an authenticated user to crash the plugin process and deny service to all Boards users via a customfocalboardSUBSCRIBETEAM message with a non-string teamId...

CVE-2026-10080

Mattermost Boards plugin panics on WebSocket custom_focalboard_SUBSCRIBE_TEAM messages with a non-string teamId, crashing the plugin and denying service to all Boards users. Affected: 11.7.x ≤ 11.7.6, 10.11.x ≤ 10.11.21, 11.8.x ≤ 11.8.3 (MMSA-2026-00687). No in-the-wild exploitation reported. Pat...

CVE-2026-10527

Mattermost versions 11.7.x = 11.7.6, 10.11.x = 10.11.21, 11.8.x = 11.8.3 fails to reconcile SchemeAdmin flags with a user's current role which allows a user demoted to System Guest to retain Board Admin privileges and perform admin-only operations via the Boards REST API or UI.. Mattermost Adviso...

CVE-2026-10527 Boards plugin retains Board Admin rights for users demoted to System Guest

Mattermost versions 11.7.x = 11.7.6, 10.11.x = 10.11.21, 11.8.x = 11.8.3 fails to reconcile SchemeAdmin flags with a user's current role which allows a user demoted to System Guest to retain Board Admin privileges and perform admin-only operations via the Boards REST API or UI.. Mattermost Adviso...

CVE-2026-10527

Mattermost versions up to 11.7.6, 10.11.21, and 11.8.3 fail to reconcile SchemeAdmin flags with role changes, allowing a user demoted to System Guest to retain Board Admin privileges and perform admin-only operations via the Boards REST API or UI. CVSS 6.3 MEDIUM, network exploitable with low pri...

PT-2026-76867

Mattermost versions 11.7.x = 11.7.6, 10.11.x = 10.11.21, 11.8.x = 11.8.3 fails to validate WebSocket command field types which allows an authenticated user to crash the plugin process and deny service to all Boards users via a custom focalboard SUBSCRIBE TEAM message with a non-string teamId...