263959 matches found
MCPDebugger
Fatmike's MCP Debugger Server Introduction This project is a self-made, lightweight MCP Debugger Server developed for learning and experimentation. The MCP Debugger Server exposes debugger functionality as MCP tools, enabling external MCP clients to control execution, inspect memory, and analyze...
CVE-2017-14980
CVE-2017-14980 Sync Breeze Enterprise 10.0.28 - Buffer Overflow Research Objective Study of a classic stack-based buffer overflow vulnerability in a controlled lab environment for educational purposes. The objective of this project was to better understand: Application fuzzing Crash analysis EIP...
CVE-2025-25614
CVE-2025-25614 Incorrect Access Control in Unifiedtransform v2.0 leads to Privilege Escalation, allowing teachers to update the personal data of fellow teachers. Vendor: Unifiedtransform PoC Step 1: Log in to the application as a Teacher. Step 2: Browse to the following endpoint: /teachers/edit/3...
CVE-2026-77364 obsidian-tc fail-open default ACL exposes Obsidian control-directory secrets
obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1.3.1, undefined readPaths and writePaths settings allow all paths, strictReadDefault does not protect direct requests, and the .obsidian, .git, and .trash control directories are excluded only duri...
CVE-2026-77364 obsidian-tc fail-open default ACL exposes Obsidian control-directory secrets
obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1.3.1, undefined readPaths and writePaths settings allow all paths, strictReadDefault does not protect direct requests, and the .obsidian, .git, and .trash control directories are excluded only duri...
CVE-2026-77364
The obsidian-tc Model Context Protocol server (prior to version 1.3.1 ) contains a vulnerability where undefined readPaths and writePaths settings allow access to all paths. Additionally, strictReadDefault fails to protect direct requests, and control directories like .obsidian, .git, and .trash ...
CVE-2026-61994
The RocketGeek WP-Members plugin (versions up to and including 3.5.7 ) is susceptible to a Missing Authorization vulnerability. This flaw allows for the exploitation of incorrectly configured access control security levels , potentially enabling unauthorized access to restricted areas or function...
EUVD-2026-97735
Missing Authorization vulnerability in RocketGeek WP-Members wp-members allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP-Members: from n/a through 3.5.7...
CVE-2026-61994 WordPress WP-Members plugin <= 3.5.7 - Broken Access Control vulnerability
Missing Authorization vulnerability in RocketGeek WP-Members wp-members allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP-Members: from n/a through 3.5.7...
WordPress WP-Members plugin <= 3.5.7 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Intrudify in WordPress Plugin WP-Members versions = 3.5.7...
CVE-2016-3861
CVE-2016-3861 An extended version of Mark Brand's libutils exploit, from the Google Project Zero blog post: https://googleprojectzero.blogspot.com/2016/09/return-to-libstagefright-exploiting.html Main differences: all of the mp4 files used for exploitation are generated in the browser dynamically...
CVE-2026-103080
The VillaTheme Salevo WordPress plugin (versions
EUVD-2026-97728
External Control of Assumed-Immutable Web Parameter vulnerability in VillaTheme Salevo woo-boost-sales allows Input Data Manipulation.This issue affects Salevo: from n/a through 1.3.0...
CVE-2026-103080 WordPress Salevo plugin <= 1.3.0 - Broken Access Control vulnerability
External Control of Assumed-Immutable Web Parameter vulnerability in VillaTheme Salevo woo-boost-sales allows Input Data Manipulation.This issue affects Salevo: from n/a through 1.3.0...
WordPress Salevo plugin <= 1.3.0 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by dcs in WordPress Plugin Salevo versions = 1.3.0...
CVE-2026-78122-POC
CVE-2026-78122 — Proof of Concept Tecnativadocker-socket-proxy ≤ 0.5.0 — Insufficient Access-Control Granularity CWE-1220 CVSS 4.0: 8.3 High — CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N Attack Vector is Adjacent AV:A: the attacker needs local/adjacent network reach to the pro...
enforcement-coverage
Enforcement Coverage Finds API routes that carry a weaker authorization control than their siblings. It found CVE-2026-45316 in Open WebUI from source alone, with no advisory knowledge: MISMATCH POST /notes/id/pin notes.py:pinnotebyid 3/3 comparable write operations on note require hasaccesswrite...
CVE-2026-109329
Admidio 4.3.2 through 4.3.17 and 5.0.0 before 5.0.15 contains a broken access control vulnerability that allows role administrators to assign users to roles in other organizations. Attackers can submit crafted assign requests to membersassignment.php with a foreign role UUID to gain privileged...
CVE-2026-109285
Open WebUI from 0.6.0 before 0.11.4 contains an improper access control vulnerability in hasaccesstofile that lets former knowledge base collaborators keep file access via stale cached knowledge base references. Attackers with read or write grants can download removed files through the file conte...