PT-2026-111547

Name of the Vulnerable Software and Affected Versions FreeRDP versions 3.0.0 through 3.31.0 Description The client fails to verify server-selected PROTOCOL RDSTLS or PROTOCOL HYBRID EX against the enabled protocol set within the nego process negotiation response function. This flaw allows a...

CVE-2026-109306

Craft CMS from 5.0.0 before 5.10.14 contains a missing authorization vulnerability in AppController::actionSwitchToLicensedEdition that lets any authenticated user change the installed edition. Low-privileged front-end users can call the action route when the licensed edition mismatches to...

EUVD-2026-97608

Craft CMS from 5.0.0 before 5.10.14 contains a missing authorization vulnerability in AppController::actionSwitchToLicensedEdition that lets any authenticated user change the installed edition. Low-privileged front-end users can call the action route when the licensed edition mismatches to...

CVE-2026-109306 Craft CMS 5.0.0 before 5.10.14 Missing Authorization via app/switch-to-licensed-edition

Craft CMS from 5.0.0 before 5.10.14 contains a missing authorization vulnerability in AppController::actionSwitchToLicensedEdition that lets any authenticated user change the installed edition. Low-privileged front-end users can call the action route when the licensed edition mismatches to...

CVE-2026-109306

Craft CMS versions 5.0.0 before 5.10.14 are vulnerable to a missing authorization flaw in the AppController::actionSwitchToLicensedEdition() function. This flaw allows any authenticated user to modify the installed edition of the software. Specifically, low-privileged front-end users can trigger ...

CVE-2026-109306 Craft CMS 5.0.0 before 5.10.14 Missing Authorization via app/switch-to-licensed-edition

Craft CMS from 5.0.0 before 5.10.14 contains a missing authorization vulnerability in AppController::actionSwitchToLicensedEdition that lets any authenticated user change the installed edition. Low-privileged front-end users can call the action route when the licensed edition mismatches to...

Medium: soci-snapshotter

Issue Overview: On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of the a path is a symbolic link and the path ends in /. For example, 'root.Open"symlink/"' will open "symlink" even when "symlink" is a symboli...

Medium: soci-snapshotter

Issue Overview: On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of the a path is a symbolic link and the path ends in /. For example, 'root.Open"symlink/"' will open "symlink" even when "symlink" is a symboli...

Amazon Linux 2023 : soci-snapshotter (ALAS2023-2026-3153)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3153 advisory. On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of the a path is a symbolic link and the path ends in /...

Amazon Linux 2 : soci-snapshotter (ALASDOCKER-2026-143)

The version of soci-snapshotter installed on the remote host is prior to 0.16.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2DOCKER-2026-143 advisory. On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root...

Amazon Linux 2023 : tomcat-native (ALAS2023-2026-3167)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3167 advisory. Buffer over-read vulnerability in Apache Tomcat Native during the TLS handshake permits a malicious user to trigger a DoS via a JVM crash. This issue affects Apache Tomcat Native: from 2.0.0...

CVE-2026-109306: Missing Authorization

Craft CMS from 5.0.0 before 5.10.14 contains a missing authorization vulnerability in AppController::actionSwitchToLicensedEdition that lets any authenticated user change the installed edition. Low-privileged front-end users can call the action route when the licensed edition mismatches to...

PT-2026-110723

Name of the Vulnerable Software and Affected Versions Craft CMS versions 5.0.0 through 5.10.13 Description An authorization flaw exists in the actionSwitchToLicensedEdition function within the AppController. This issue allows any authenticated user to change the installed software edition...

unicorn

unicorn Escrito por: Dave Kennedy @HackingDave Sitio web: https://www.trustedsec.com Magic Unicorn es una herramienta sencilla para utilizar un ataque de downgrade de PowerShell e inyectar shellcode directamente en memoria. Basado en los ataques de PowerShell de Matthew Graeber y la técnica de...

cve-2026-43499-firetv-sheldonp-writeup

CVE-2026-43499 on Amazon Fire TV Stick 3rd Gen sheldonp Chaining a Linux kernel privilege escalation into a preloader downgrade and bootloader unlock. Overview This repository documents my authorized reproduction of the CVE-2026-43499 exploitation chain on an Amazon Fire TV Stick 3rd Gen sheldonp...

Updated tomcat-native package fixes security vulnerabilities

DoS via TLS handshake. CVE-2026-86243 Insecure OpenSSL options enabled. CVE-2026-86246 Client certificate requirements can be down-graded. CVE-2026-86247...

Authentication Downgrade

AsyncHttpClient is vulnerable to Authentication Downgrade. The vulnerability is due to improper handling of Digest authentication challenges with missing or empty nonces, which allows a malicious origin or proxy to downgrade authentication to Basic and obtain the user's username and password in a...

CVE-2026-107121 Keycloak-services: keycloak-services: smtp starttls plaintext credential and message downgrade

A flaw was found in the SMTP email configuration handling of the keycloak-services component. When the STARTTLS option is enabled, Keycloak fails to strictly enforce an encrypted connection, allowing it to fall back to unencrypted communication if the encryption request is tampered with. An...

CVE-2026-107121

A flaw exists in the SMTP email configuration handling of the keycloak-services component. When the STARTTLS option is enabled, the system fails to strictly enforce encrypted connections, allowing a downgrade to unencrypted communication if the encryption request is tampered with. An attacker cap...

CVE-2026-107121 Keycloak-services: keycloak-services: smtp starttls plaintext credential and message downgrade

A flaw was found in the SMTP email configuration handling of the keycloak-services component. When the STARTTLS option is enabled, Keycloak fails to strictly enforce an encrypted connection, allowing it to fall back to unencrypted communication if the encryption request is tampered with. An...