DDOS-RootSec

RootSec Archive Overview of RootSec Archive Welcome to the RootSec Archive , your ultimate resource for DDOS tools, scanners, botnets, exploits, and more. Our archive includes: Mirai Edits: Private and Public Versions QBot Edits: Private and Public Versions Other Botnet Variants: Diverse...

CVE-2026-70481

CVE-2026-70481 Open WebUI, affected 0.5.0 through 0.10.2, patched in 0.11.0. Moderate, CVSS 5.4, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L, CWE-284 and CWE-862. In backend/openwebui/routers/channels.py the message update and delete handlers branch on the channel type, and the two branches ask...

CVE-2026-46499

In Collabora Online versions prior to 24.04.18 and 25.04.11 , an authorization bypass allows read-only users (such as viewer-role WOPI users) to execute document-mutating UNO commands. This occurs because the LibreOfficeKit in the per-document kit process fails to enforce a session's read-only st...

CVE-2026-46499 Collabora Online: Read-only session authorization bypass permits live document edits

Collabora Online is a collaborative online office suite based on LibreOffice technology. Prior to 24.04.18 and 25.04.11, several document operations delegated to LibreOfficeKit in the per-document kit process fail to enforce a session's read-only state. A read-only user, such as a viewer-role WOP...

CVE-2026-112347

The Kirki plugin for WordPress (versions before 6.4.1) is susceptible to a broken object-level access control vulnerability in its page REST API. The flaw resides in the PageController.php file, specifically within the save_page_data, duplicate, and delete handlers for the PUT /wp-json/kirki/v1/p...

DRUPAL-CONTRIB-2026-241

This module enables editors to edit content, including paragraphs, directly on the rendered page. The module doesn't sufficiently check field access permissions when editing, deleting or adding paragraph items to entity reference revisions fields. This vulnerability is mitigated by the fact that ...

PT-2026-114235

Name of the Vulnerable Software and Affected Versions FileRise versions prior to 3.18.0 Description FileRise flattens logical folder paths into metadata filenames by replacing separators and spaces with hyphens. This process allows distinct folders, such as team/docs and team-docs, to share a...

CVE-2026-107397 Indico: Cross-Site-Scripting in minutes editor

Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Prior to 3.3.13, users who can create content, including speakers who can create minutes, can store crafted HTML in event minutes. When concurrent edits are made to the same minutes, t...

CVE-2026-107397 Indico: Cross-Site-Scripting in minutes editor

Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Prior to 3.3.13, users who can create content, including speakers who can create minutes, can store crafted HTML in event minutes. When concurrent edits are made to the same minutes, t...

CVE-2026-87975

A flaw was found in Django. When handling model formsets where primary keys can be modified through form fields, the application does not properly validate submitted key values against the authorized query scope. A remote attacker with permission to submit form data can exploit this issue by...

Certified Mechanistic Edits: Behavioral Guarantees for Skill Removal and Preservation

Mechanistic edits ablations, weight edits, activation steering are the standard tools for unlearning a harmful capability from a neural network while preserving useful ones. Current approaches validate their effects only by testing, which can never cover an entire continuous region of inputs. Pri...

CVE-2026-100259

In JetBrains YouTrack before 2026.2.18991 improper access control on Gantt chart allowed edits by users with view-only access...

CVE-2026-100259

In JetBrains YouTrack before 2026.2.18991 improper access control on Gantt chart allowed edits by users with view-only access...

CVE-2026-100259: Incorrect Authorization

In JetBrains YouTrack before 2026.2.18991 improper access control on Gantt chart allowed edits by users with view-only access...

CVE-2026-92226

Joomla! Core - 20260913 - Core - Improper ACL checks for varous webservice edit tasks in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - An improper access check allows unauthorized users to perform edit actions on otherwise uneditable items...

CVE-2026-92226

The Joomla! Core component is vulnerable to improper ACL checks affecting various webservice edit tasks in versions 4.0.0-5.4.8 and 6.0.0-6.1.3 . This flaw allows unauthorized users to perform edit actions on items that are otherwise uneditable. The CVSS 4.0 score is 7.0 (High) with a network att...

EUVD-2026-89087

Joomla! Core - 20260913 - Core - Improper ACL checks for varous webservice edit tasks in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - An improper access check allows unauthorized users to perform edit actions on otherwise uneditable items...

GO-2026-6484 Mattermost doesn't validate channel ownership of an existing subscription before applying edits in github.com/mattermost/mattermost-server

Mattermost doesn't validate channel ownership of an existing subscription before applying edits in github.com/mattermost/mattermost-server...

SUSE CVE-2026-72810

SiYuan versions before v3.7.4 contain a publish-boundary bypass vulnerability in WebSocket broadcast sessions that allows anonymous readers to receive unfiltered edits. Attackers can establish a WebSocket connection to the publish surface and passively receive real-time content events including...

PT-2026-94106

Name of the Vulnerable Software and Affected Versions Craft CMS versions 5.0.0 through 5.10.12 Description A broken access control flaw exists in the 'actions/nested-elements/reorder' endpoint. When an authenticated control panel user with viewEntries and viewPeerEntries permissions but lacking...