501 matches found
CVE-2026-107828
Jivejdon through 5.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to access Weibo-created accounts by deriving predictable credentials from public Weibo user IDs. OAuthAccountServiceImp.transferSina sets the password to the first four digits of the Weibo I...
CVE-2025-63420
CVE-2025-63420 O CrushFTP11 anterior à versão 11.3.757 é vulnerável à injeção de HTML armazenada no Painel Administrativo do CrushFTP Reports / "Who Created Folder", permitindo a execução persistente de HTML em sessões de administrador. CWE CWE-79 — Neutralização incorreta de entrada durante a...
PT-2026-107539
Name of the Vulnerable Software and Affected Versions praisonai-platform versions prior to 0.1.9 Description Issue dependency deletion can be authorized against the wrong side of a dependency edge. A workspace member can delete a dependency from an owner-created issue by accessing it through a...
Astra Linux – Vulnerability in Golang-glog
When logs are written to a widely-writable directory the default, an unprivileged attacker may predict the log file path of a privileged process and pre-create a symbolic link to a sensitive file in its place. When that privileged process runs, it will follow the created symbolic link and overwri...
GHSA-2H9G-J24R-H63G
creationtimestamp| type| source ---|---|--- 2026-09-03 19:32:48+00:00| seen| https://gist.github.com/alon710/ca4d0cdb0c789284d2fa209ad1644bb6...
EUVD-2026-43001
Snipe-IT's import createdby can be overwritten...
CVE-2026-65554
creationtimestamp| type| source ---|---|--- 2026-08-10 06:16:09+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3msph75q7g62f 2026-08-11 02:16:08+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3msrkavjki52l...
Malicious code in dolyame-ui-inputfio (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 42ac05c63a867647d4ec2bf3288918537aeadac4707342a70bfffd42cda60e9c On require of the package, adapter.js and lib/telemetry.js reconstruct destination hostnames from array-joined string fragments...
CVE-2026-54218
Use of hard-coded cryptographic key vulnerability in Tobit Laboratories AG TeamDavid's Webbox. For users created locally in David, passwords are stored in various files using only obfuscation. Any user with access to the server’s file system, or who can otherwise extract files from the server see...
MAL-2026-12693 Malicious code in devplatform-api-v1-endpoint (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f2ed0defa1fbae571985664baae47d89d796f943b249115eb73a38edce04fb6c On require, adapter.js selects a platform-specific asset path and fetches an executable from string-split-obfuscated hosts under...
MAL-2026-12405 Malicious code in opencode-engos-ai (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 42180a034d43d3c6d16e223fe6fcd93f6e403f0c73c763e9b21b6aded0545274 On npm install, postinstall.mjs enumerates platform-specific sibling package names of the form opencode-engos---baseline-musl, resolves each to the...
CVE-2026-68582
Vikunja versions = 0.24.0 and = 2.3.0 contain a broken object level authorization BOLA vulnerability in the task-collection endpoint GET /api/v1/projects/project/views/view/tasks. The endpoint loads the requested project view from the URL path without verifying the caller is authorized for it. Fo...
CVE-2026-68582 Vikunja 0.24.0 Broken Object Level Authorization via Link-Share Token
Vikunja versions = 0.24.0 and = 2.3.0 contain a broken object level authorization BOLA vulnerability in the task-collection endpoint GET /api/v1/projects/project/views/view/tasks. The endpoint loads the requested project view from the URL path without verifying the caller is authorized for it. Fo...
CVE-2026-68582
Vikunja versions = 0.24.0 and = 2.3.0 contain a broken object level authorization BOLA vulnerability in the task-collection endpoint GET /api/v1/projects/project/views/view/tasks. The endpoint loads the requested project view from the URL path without verifying the caller is authorized for it. Fo...
SUSE CVE-2026-35607
File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.1, the fix in commit b6a4fb1 "self-registered users don't get execute perms" stripped Execute permission and Commands from users created via the...
SUSE CVE-2026-44473
Ella Core is a 5G core designed for private networks. Prior to 1.10.0, a radio with a valid NG Setup can send a forged PDUSessionResourceSetupResponse carrying any UE's AMF-UE-NGAP-ID. Ella Core does not verify the message arrived on the SCTP association bound to that UE's logical NG-connection,...
CVE-2018-7878
creationtimestamp| type| source ---|---|--- 2026-07-26 07:01:52+00:00| seen| https://t.me/KaitNews/7569 2026-07-27 00:01:35+00:00| seen| https://t.me/KaitNews/7569 2026-07-29 03:00:03+00:00| seen| https://t.me/KaitNews/7569 2026-07-30 00:03:17+00:00| seen| https://t.me/KaitNews/7569...
CVE-2026-16270 ReDoS in Open Mercato
Open Mercato does not validate regex rules. An attacker with privileges to create the regex rule can add an unsafe regex to a field. When someone provide the proper string it can result in a DoS attack. This issue was fixed in version 0.6.4...
CVE-2026-64617 Data::PubSub::Shared versions before 0.07 for Perl create a world-readable mmap backing file and open it without O_EXCL or O_NOFOLLOW
Data::PubSub::Shared versions before 0.07 for Perl create a world-readable mmap backing file and open it without OEXCL or ONOFOLLOW. The segment is created in pubsub.h with openpath, ORDWR|OCREAT, 0666. The mode is 0666, so under the default umask 022 the file is created mode 0644 world-readable...
SUSE CVE-2026-64185
In the Linux kernel, the following vulnerability has been resolved: sysfs: don't remove existing directory on update failure When sysfsupdategroup is called for a named group and createfiles fails e.g. -ENOMEM, internalcreategroup calls kernfsremovekn on the group directory. In the update path, k...