CVE-2026-53552 Goploy: Cross-namespace IDOR and RCE via body-supplied row id in project and project_file handlers

Goploy is an open-source automation deployment system. In versions 1.17.5 and prior, Project.AddFile, Project.EditFile, Project.RemoveFile, and Project.Edit in cmd/server/api/project/handler.go accept a project or project-file row id from the JSON body and act on it without checking that the...

CVE-2026-76982

Improper neutralization of input during web page generation in Apache Wicket. org.apache.wicket.markup.html.form.Button clears the escape-model-strings flag in its constructor, so that the value attribute it writes is not encoded twice — ComponentTag already encodes attribute values when it write...

CVE-2026-76982 Apache Wicket: XSS in Button via its model object

Improper neutralization of input during web page generation in Apache Wicket. org.apache.wicket.markup.html.form.Button clears the escape-model-strings flag in its constructor, so that the value attribute it writes is not encoded twice — ComponentTag already encodes attribute values when it write...

EUVD-2026-68489

Improper neutralization of input during web page generation in Apache Wicket. org.apache.wicket.markup.html.form.Button clears the escape-model-strings flag in its constructor, so that the value attribute it writes is not encoded twice — ComponentTag already encodes attribute values when it write...

CVE-2025-0994

CVE-2025-0994 이 탐지 방법은 어떻게 작동하나요? 이 Nuclei 템플릿은 HTML 본문에 저장된 버전을 추출하며, 버전을 기반으로 인스턴스가 CVE-2025-0994에 취약한지 여부를 판단할 수 있습니다. 패치된 버전: 15.8.9 이 스크립트를 어떻게 실행하나요? 1. 여기에서 Nuclei를 다운로드합니다. 2. 템플릿을 로컬 시스템에 복사합니다. 3. 다음 명령을 실행합니다: nuclei -u https://yourHost.com -t template.yaml 참고 자료...

POC-CVE-2022-26671

여기까지 오셨다면, 이 저장소가 왜 만들어져야 했는지 아실 것입니다. CVE-2022-26671 GET /AT/ATDefault.aspx Line 430에는 평문 자격 증명이 포함되어 있습니다. secom | supervisor 책임 있는 공개에 관해서라면, 로그인 페이지에서 하드코딩된 평문 HTTP 본문 응답을 공개하지 않는 것은 어리석은 일입니다./ https://nvd.nist.gov/vuln/detail/CVE-2022-26671...

CVE-2025-28009

CVE-2025-28009 - Iniezione SQL in Dietiqa App v1.0.20 Scoperto da: Saharuddin Azman Fornitore: Appventure Sdn Bhd Prodotto: Dietiqa App Versione interessata: v1.0.20 CVE ID: CVE-2025-28009 Tipo di vulnerabilità: Iniezione SQL 📝 Descrizione Esiste una vulnerabilità di iniezione SQL nel parametro u...

CVE-2023-31584

CVE-2023-31584 - Vulnerabilità di Cross Site Scripting in cu/silicon Link Github: https://github.com/cu/silicon Versione interessata: 1 Gravità e CVSS: Verrà aggiornato al termine della revisione da parte di NIST. Tipo: Cross Site Scripting Causa principale: Mancanza di una corretta validazione e...

CVE-2026-34040-PoC

CVE-2026-34040 — Bypass do Plugin AuthZ do Docker/Moby Lab PoC KO: Projeto de reprodução prática de uma vulnerabilidade que contorna o plugin de autorização AuthZ do Docker Moby usando um corpo de requisição superior a 1MB. PT: Uma reprodução laboratorial de uma vulnerabilidade que contorna os...

Linux Distros Unpatched Vulnerability : CVE-2026-33604

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An attacker that can get Dovecot to relay a message, for example through Sieve redirect or submission relay, can use a crafted line ending in the message body t...

ffufPostprocessing

Ffuf: Post-elaborazione Purtroppo - nonostante il flag "-ac", ffuf tende a produrre molte voci irrilevanti. È per questo che ho creato uno strumento di post-elaborazione per filtrare quelle voci. Inoltre, ho visto molte voci pertinenti rimosse quando veniva usato "-ac" - specialmente quando ffuf...

GHSA-5PG6-M483-7VRG Vikunja has cross-tenant IDOR in kanban move-task endpoint via unauthorized body task_id

Summary The kanban endpoint POST /api/v1/projects/project/views/view/buckets/bucket/tasks moves a task into a bucket. The task is identified by taskid in the request body. The endpoint's authorization check TaskBucket.CanUpdate only verifies that the caller may update the project/view/bucket name...

ALPINE-CVE-2026-33604

An attacker that can get Dovecot to relay a message, for example through Sieve redirect or submission relay, can use a crafted line ending in the message body to bypass the outbound protection that prevents message content from being interpreted as SMTP commands. A downstream mail server that...

AZL-98280 CVE-2026-33604 affecting package dovecot 2.3.20-1

An attacker that can get Dovecot to relay a message, for example through Sieve redirect or submission relay, can use a crafted line ending in the message body to bypass the outbound protection that prevents message content from being interpreted as SMTP commands. A downstream mail server that...

CVE-2026-33604

An attacker that can get Dovecot to relay a message, for example through Sieve redirect or submission relay, can use a crafted line ending in the message body to bypass the outbound protection that prevents message content from being interpreted as SMTP commands. A downstream mail server that...

CVE-2026-40203

When IMAP compression is enabled, the same compression state is reused across responses in a session, so response sizes depend on both attacker-supplied mail and other mail in the same mailbox. An attacker that can send mail to a user and can also observe the sizes of that user's IMAP traffic can...

EUVD-2026-67669

When IMAP compression is enabled, the same compression state is reused across responses in a session, so response sizes depend on both attacker-supplied mail and other mail in the same mailbox. An attacker that can send mail to a user and can also observe the sizes of that user's IMAP traffic can...

CVE-2026-40203

CVE-2026-40203 affects Open-Xchange Dovecot when IMAP compression is enabled. The root cause is that the same compression state is reused across responses in a session, causing response sizes to depend on both attacker-supplied mail and other mail in the same mailbox. An attacker who can send mai...

CVE-2026-40203

When IMAP compression is enabled, the same compression state is reused across responses in a session, so response sizes depend on both attacker-supplied mail and other mail in the same mailbox. An attacker that can send mail to a user and can also observe the sizes of that user's IMAP traffic can...

CVE-2026-33604

Dovecot (Open-Xchange) contains an SMTP smuggling vulnerability in its outbound relay protection. An attacker who can get Dovecot to relay a message—e.g., via Sieve redirect or submission relay —can craft a line ending in the message body to bypass the protection that normally prevents message co...