59075 matches found
CVE-2026-40099
Kirby’s page creation API vulnerability allowed authenticated users with pages.create permission but without pages.changeStatus to create published pages by overriding isDraft via REST API. This bypassed normal editorial workflow (new pages are drafts by default) until patches in Kirby 4.9.0 and ...
EUVD-2026-25369
Kirby is an open-source content management system. Prior to versions 4.9.0 and 5.4.0, Kirby's user permissions control which user role is allowed to perform specific actions to content models in the CMS. These permissions are defined for each role in the user blueprint site/blueprints/users/.... ...
CVE-2026-31953
Xibo is an open source digital signage platform with a web content management system and Windows display player software. A stored Cross-Site Scripting XSS vulnerability in versions prior to 4.4.1 allows an authenticated user with notification creation permissions to inject arbitrary JavaScript...
CVE-2026-31953 Xibo CMS has Stored XSS via Notification Body with Zero-Click Execution on Login
Xibo is an open source digital signage platform with a web content management system and Windows display player software. A stored Cross-Site Scripting XSS vulnerability in versions prior to 4.4.1 allows an authenticated user with notification creation permissions to inject arbitrary JavaScript...
Security update for cacti, cacti-spine (critical)
openSUSE Security Update: Security update for cacti, cacti-spine Announcement ID: openSUSE-SU-2026:0148-1 Rating: critical References: 1231027 1231369 1231370 1231371 1231372 1236482 1236486 1236487 1236488 1236489 1236490 Cross-References: CVE-2024-43362 CVE-2024-43363 CVE-2024-43364...
PT-2026-34841
Name of the Vulnerable Software and Affected Versions Press affected versions not specified Description Press, a Frappe custom app used for managing infrastructure, subscriptions, marketplace, and software-as-a-service SaaS, contains a flaw in the 'press.api.account.create api secret' endpoint...
Kirby 安全漏洞
Kirby is a set of open-source content management systems based on files. Versions of Kirby prior to 4.9.0 and 5.4.0 have security vulnerabilities. These vulnerabilities stem from the fact that the changeStatus permission does not take effect during page creation. This could allow authenticated...
📄 Microsoft MMC (.MSC) File Execution Abuse Leading / Admin Creation
This Metasploit local Windows exploit module abuses the way Microsoft Management Console MMC processes specially crafted .msc files to achieve arbitrary PowerShell execution when a user opens the file. The payload is designed to create a new local administrator account or execute a custom command...
Tenable Nessus Agent < 11.1.3 Arbitrary File Deletion (TNS-2026-12)
According to its self-reported version, the Tenable Nessus Agent running on the remote Windows host is prior to 11.1.3. It is, therefore, affected by an arbitrary file deletion vulnerability as referenced in the TNS-2026-12 advisory. - A vulnerability exists in Nessus Agent on Windows where an...
CVE-2026-41355
creationtimestamp| type| source ---|---|--- 2026-04-23 23:27:29+00:00| seen| Telegram/u2qRHjnv5kQDuTkkxczYUuDfihUUcY0XYmdq7J3tY866RjI...
GHSA-G86V-F9QV-RH6M
creationtimestamp| type| source ---|---|--- 2026-04-23 23:27:29+00:00| seen| Telegram/u2qRHjnv5kQDuTkkxczYUuDfihUUcY0XYmdq7J3tY866RjI...
CVE-2026-41361
creationtimestamp| type| source ---|---|--- 2026-04-23 23:27:29+00:00| seen| Telegram/u2qRHjnv5kQDuTkkxczYUuDfihUUcY0XYmdq7J3tY866RjI...
GHSA-H5HG-H7RR-GPF3
creationtimestamp| type| source ---|---|--- 2026-04-23 23:27:29+00:00| seen| Telegram/u2qRHjnv5kQDuTkkxczYUuDfihUUcY0XYmdq7J3tY866RjI...
GHSA-V3QC-WRWX-J3PW
creationtimestamp| type| source ---|---|--- 2026-04-23 23:27:23+00:00| seen| Telegram/OgOvWOsYKDsUPw2Tk2S9qGbonIgzDZlRsoTRSBtlTZ01pNI...
CVE-2026-24303
creationtimestamp| type| source ---|---|--- 2026-04-23 23:27:09+00:00| published-proof-of-concept| Telegram/kiTcjsXT1hi2Y3u94e7GhzIuEtNJE-kdjO7sui75MorBPg 2026-04-24 02:01:21+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mk7gm4it4l23 2026-04-25 01:11:11+00:00| seen|...
CVE-2026-23327
creationtimestamp| type| source ---|---|--- 2026-04-23 23:26:39+00:00| seen| Telegram/FBfF7HTWtEvNL6KEiWN9WeIckJJ5ZXo9Sxte1kUZosh1zOQ 2026-07-09 01:15:54+00:00| seen| https://www.hkcert.org/security-bulletin/suse-linux-kernel-multiple-vulnerabilities20260702...
CVE-2026-41336
creationtimestamp| type| source ---|---|--- 2026-04-23 22:27:07+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mk72mzgf5v2q 2026-04-23 23:27:16+00:00| seen| Telegram/IhrbuMncMOQ2aXKn55DBnsRKZnrdzyQXI4i7tcZ3JysOVtE...
EUVD-2026-25265
This vulnerability allows an attacker to create a junction, enabling the deletion of arbitrary files with SYSTEM privileges. As a result, this condition potentially facilitates arbitrary code execution, whereby an attacker may exploit the vulnerability to execute malicious code with elevated SYST...