CVE-2026-108157 Pingvin Share X 0.19.0 before 1.22.0 Account Takeover via OAuth Email Linking

Pingvin Share X from 0.19.0 before 1.22.0 contains an improper authentication vulnerability that allows remote unauthenticated attackers to take over accounts by abusing automatic OAuth email linking in OAuthService.signUp. Attackers can register a victim's unverified email on an enabled OAuth/OI...

CVE-2026-108157 Pingvin Share X 0.19.0 before 1.22.0 Account Takeover via OAuth Email Linking

Pingvin Share X from 0.19.0 before 1.22.0 contains an improper authentication vulnerability that allows remote unauthenticated attackers to take over accounts by abusing automatic OAuth email linking in OAuthService.signUp. Attackers can register a victim's unverified email on an enabled OAuth/OI...

EUVD-2026-95905

Pingvin Share X from 0.19.0 before 1.22.0 contains an improper authentication vulnerability that allows remote unauthenticated attackers to take over accounts by abusing automatic OAuth email linking in OAuthService.signUp. Attackers can register a victim's unverified email on an enabled OAuth/OI...

CVE-2026-108157

Pingvin Share X versions 0.19.0 before 1.22.0 are vulnerable to an improper authentication flaw in the OAuthService.signUp() function. The root cause is a missing email_verified check in the GenericOidcProvider, which allows unauthenticated remote attackers to perform an account takeover . By reg...

CVE-2016-20098

The Moderator Toolbox (reddit-moderator-toolbox) before version 4.0.14 is vulnerable to a stored cross-site scripting (XSS) flaw in the removalreasons module. The root cause is the failure to encode subreddit toolbox wiki fields before inserting them into popup HTML. An attacker with permissions ...

CVE-2016-20098 Moderator Toolbox before 4.0.14 Stored XSS via Removal Reasons Configuration

Moderator Toolbox reddit-moderator-toolbox before 4.0.14 contains a stored cross-site scripting vulnerability in the removalreasons module, which inserts subreddit toolbox wiki fields into popup HTML without encoding. Attackers who can edit the toolbox wiki page can plant JavaScript in fields lik...

CVE-2026-108156 LobsterAI 2026.5.27 through 2026.9.23 Arbitrary Directory Deletion via Skill _meta.json

LobsterAI 2026.5.27 through 2026.9.23 contains an external control of file path vulnerability in the skills:delete IPC handler that trusts the openclawSourceDir value from a skill's meta.json during uninstall. Attackers who convince a user to install a crafted skill can make uninstallation...

CVE-2026-108156 LobsterAI 2026.5.27 through 2026.9.23 Arbitrary Directory Deletion via Skill _meta.json

LobsterAI 2026.5.27 through 2026.9.23 contains an external control of file path vulnerability in the skills:delete IPC handler that trusts the openclawSourceDir value from a skill's meta.json during uninstall. Attackers who convince a user to install a crafted skill can make uninstallation...

EUVD-2016-10914

Moderator Toolbox reddit-moderator-toolbox before 4.0.14 contains a stored cross-site scripting vulnerability in the removalreasons module, which inserts subreddit toolbox wiki fields into popup HTML without encoding. Attackers who can edit the toolbox wiki page can plant JavaScript in fields lik...

EUVD-2026-95904

LobsterAI 2026.5.27 through 2026.9.23 contains an external control of file path vulnerability in the skills:delete IPC handler that trusts the openclawSourceDir value from a skill's meta.json during uninstall. Attackers who convince a user to install a crafted skill can make uninstallation...

CVE-2026-108156

LobsterAI versions 2026.5.27 through 2026.9.23 are vulnerable to an external control of file path vulnerability (CWE-73) within the skills:delete IPC handler. The application fails to validate the openclawSourceDir value provided in a skill's _meta.json file during the uninstallation process. An ...

ATTACKdatamap

ATTACKdatamap 이벤트 수준의 데이터 소스 평가를 통해 "MITRE ATT&CK" 프레임워크의 잠재적 적용 범위를 보여주는 도구입니다. 이 도구는 제가 개발했으며 "MITRE" 또는 그 훌륭한 "ATT&CK" 팀과는 아무런 관련이 없습니다. 데이터 소스 매핑을 용이하게 하여 잠재적인 적용 범위를 평가할 수 있도록 개발되었습니다. 블로그 게시물에서 자세한 내용을 확인하세요 여기 시작 이 도구는 ImportExcel 모듈이 필요합니다. 다음과 같이 설치하세요: PS C:\ Install-Module ImportExcel...

CVE-2026-107814 MariaDB: Insecure $HOME in MariaDB rpm packages

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB RPM packages created the dedicated mysql service account with the database data directory as its home directory. A database user with the FILE privilege...

EUVD-2026-95899

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB RPM packages created the dedicated mysql service account with the database data directory as its home directory. A database user with the FILE privilege...

CVE-2026-107814 MariaDB: Insecure $HOME in MariaDB rpm packages

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB RPM packages created the dedicated mysql service account with the database data directory as its home directory. A database user with the FILE privilege...

CVE-2026-107814 MariaDB: Insecure $HOME in MariaDB rpm packages

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB RPM packages created the dedicated mysql service account with the database data directory as its home directory. A database user with the FILE privilege...

CVE-2026-107814

MariaDB server RPM packages (versions 10.6.1 to 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2) are vulnerable due to the mysql service account being created with the database data directory as its home directory. A database user possessing the FILE privilege can write startup dot-files, ...

AbxOverflow

여기에 설명된 문제에 대한 수정 사항은 CVE-2024-34740 / A-307288067로 나타났습니다: 공지 공지에 연결된 패치 추가 패치 두 개: 1 2 Android Binary XML Android systemserver 내부에서 많은 서비스들이 재부팅 후에도 상태를 유지하기 위해 XML 파일에 저장합니다. $ adb shell su 0 find /data/system -name '.xml' | sort /data/system/appopsaccesses.xml /data/system/cachequota.xml...

CGA-R9J2-66W5-X2XH

Bulletin has no description...

trevorc2

trevorc2 TrevorC2 - Command and Control via Legitimate Behavior over HTTP Written by: Dave Kennedy @HackingDave Website: https://www.trustedsec.com Note that this is a very early release - heavy randomization and encryption to be added soon. TrevorC2 is a client/server model for masking command a...