PT-2026-81915

Name of the Vulnerable Software and Affected Versions Kimai versions prior to 2.56.0 Description An issue exists where team-membership checks are not enforced in the voteOnAttribute function of TimesheetVoter. This function maps permissions only to own timesheet or other timesheet. Consequently,...

CVE-2026-38474

GazellePW (GazellePosterWall), a media management application, contains a Broken Access Control vulnerability in its IP lock manager . At commit 86c4bedf, the endpoint tools.php?action=iplock does not properly validate that the authenticated user owns the target account, allowing any remote authe...

CVE-2023-31595

CVE-2023-31595 IC Realtime ICIP-P2012T é vulnerável a Controle de Acesso Incorreto através de uma porta aberta Câmera Dome PTZ IP IC Realtime ICIP-P2012 versão de software: 2.420 Uma porta exposta 9989 responde com uma captura instantânea ao vivo no momento da solicitação; usando um script, ela...

CVE-2023-31594

CVE-2023-31594 IC Realtime ICIP-P2012T ist anfällig für fehlerhafte Zugriffskontrolle Nicht authentifizierter Streaming-Kanal in der IC Realtime IP PTZ Dome Camera ICIP-P2012 Softwareversion: 2.420 Der Live-Feed MJPEG kann über einen exponierten HTTP-Kanal mit dem VLC-Netzwerkstream gestreamt...

403bypasser

403bypasser Türkçe 403bypasser , hedef sayfalardaki erişim kontrolü kısıtlamalarını aşmak için kullanılan teknikleri otomatikleştirir. Bu araç geliştirilmeye devam edecektir, katkılara açıktır. English 403bypasser automates the techniques used to circumvent access control restrictions on target...

CVE-2022-44877-CWP7

CVE-2022-44877-CWP7 Control Web Panel 7 CWP7 Esecuzione Remota di Codice RCE CVE-2022-44877 Non autenticato Il repository verrà aggiornato presto con il POC...

CVE-2026-78266

Subscriber Broken Access Control in AutomatorWP = 5.8.3 versions...

CVE-2026-32561

Subscriber Privilege Escalation in Booking Hub = 1.3.0 versions...

CVE-2026-27364

Subscriber Broken Access Control in Style Kits = 2.6.5 versions...

dsiem

Dsiem Dsiem is a security event correlation engine for ELK stack, allowing the platform to be used as a dedicated and full-featured SIEM system. Dsiem provides OSSIM-style correlation for normalized logs/events, perform lookup/query to threat intelligence and vulnerability information sources, an...

CVE-2026-72585-PoC

CVE-2026-72585 — Grafana: Correzione incompleta di CVE-2026-21724 consente al ruolo Editor di eliminare i contact point protetti Prodotto: Grafana Grafana Labs — fino alla 13.2.0 File: pkg/services/ngalert/provisioning/contactpoints.go CWE: CWE-284 — Controllo degli accessi improprio CVSS 3.1:...

GHSA-VX2M-JPXR-XV7W Cloudreve has Broken Access Control - Revoked Share Access Still Allows Signed File URL Generation via Cached context_hint

Summary Cloudreve's file-listing responses hand the client a contexthint UUID that is meant to speed up follow-up operations. When that hint is replayed on the file/url and file/thumb routes, DBFS caches a shareNavigatorState containing the already-loaded share root and share row. On a later...

silverboxcc

Malware Android sottoposto a reverse engineering chiamato Red Alert V2.0. Al momento dell'analisi, non erano più in esecuzione server C2, quindi non siamo stati in grado di osservare alcun traffico tra il malware e il server C2. Così abbiamo ricostruito il protocollo C2 e scritto questo pannello ...

CVE-2019-25485

🐞 CVE-2019-25485: R 3.4.4 - Buffer Overflow basato su Stack x86 e x64 Buffer overflow basato su stack in R 3.4.4. Sfruttamento completo su x86, ma solo controllo di RIP con analisi dei gadget su x64 a causa dei vincoli del programma. La stessa vulnerabilità su due architetture, che porta a percor...

CVE-2026-78266 WordPress AutomatorWP plugin <= 5.8.3 - Broken Access Control vulnerability

Subscriber Broken Access Control in AutomatorWP = 5.8.3 versions...

CVE-2026-78266

AutomatorWP , a WordPress plugin , is affected by a Broken Access Control vulnerability in versions ≤ 5.8.3 . The flaw allows a Subscriber -level authenticated user to perform actions beyond their expected permissions, resulting in a high integrity impact (CVSS 3.1 base score 6.5 / MEDIUM ). The ...

CVE-2026-32561 WordPress Booking Hub plugin <= 1.3.0 - Privilege Escalation vulnerability

Subscriber Privilege Escalation in Booking Hub = 1.3.0 versions...

CVE-2026-27364

Broken Access Control vulnerability in the WordPress Style Kits plugin (AnalogWP) versions ≤ 2.6.5 . A Subscriber -level authenticated user can exploit insufficient access controls, resulting in a high impact on integrity (CVSS 3.1: 6.5 MEDIUM, vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N). No conf...

CVE-2026-27364 WordPress Style Kits plugin <= 2.6.5 - Broken Access Control vulnerability

Subscriber Broken Access Control in Style Kits = 2.6.5 versions...

CVE-2026-5006

A vulnerability was identified in HashiCorp Vault and Vault Enterprise “Vault” such that an authenticated attacker may manipulate an identity value referenced by a templated policy path to gain unintended access to Vault paths. An attacker who can control the referenced identity value may include...