65261 matches found
CVE-2016-7270
creationtimestamp| type| source ---|---|--- 2026-07-26 07:02:14+00:00| seen| https://t.me/KaitNews/1590 2026-07-27 00:01:52+00:00| seen| https://t.me/KaitNews/1590...
CVE-2017-5060
creationtimestamp| type| source ---|---|--- 2026-07-26 07:02:05+00:00| seen| https://t.me/KaitNews/4131 2026-07-27 00:01:46+00:00| seen| https://t.me/KaitNews/4131...
CVE-2017-0752
creationtimestamp| type| source ---|---|--- 2026-07-26 07:02:02+00:00| seen| https://t.me/KaitNews/5271 2026-07-27 00:01:42+00:00| seen| https://t.me/KaitNews/5271...
CVE-2017-13151
creationtimestamp| type| source ---|---|--- 2026-07-26 07:01:53+00:00| seen| https://t.me/KaitNews/6958 2026-07-27 00:01:37+00:00| seen| https://t.me/KaitNews/6958 2026-07-29 05:00:05+00:00| seen| https://t.me/KaitNews/6958 2026-07-30 00:03:15+00:00| seen| https://t.me/KaitNews/6958...
VulnCheck KEV: CVE-2026-59821
LiteLLM is a proxy server AI Gateway to call LLM APIs in OpenAI or native format. Prior to 1.82.0-stable, LiteLLM's Custom Code Guardrails production create and update paths did not apply the same sandboxing and validation used by the test endpoint, allowing a privileged user with access to creat...
SUSE CVE-2026-64269
In the Linux kernel, the following vulnerability has been resolved: RDMA/rtrs-srv: Bound RDMA-Write length to chunk size in rdmawritesg When the server answers an RTRS READ, rdmawritesg builds the source scatter/gather entry for the IBWRRDMAWRITE that returns data to the peer. Its length is taken...
CVE-2026-66012 SiYuan before v3.7.2 Unauthenticated Administrator Takeover via MCP
SiYuan before v3.7.2 contains a missing authorization vulnerability in the POST /mcp kernel endpoint, which is gated only by a general auth check model.CheckAuth with no admin-role or read-only enforcement. This exposes 31 MCP tools, including a file tool with list/read/write/delete/rename/copy...
CVE-2026-66012
SiYuan before v3.7.2 has an unauthenticated access path via POST /mcp due to missing authorization enforcement (no admin/read-only role checks). In Publish anonymous mode, an anonymous RoleReader JWT can reach /mcp, enabling an attacker to read conf/conf.json (exfiltrating accessAuthCode, api.tok...
CVE-2026-66012 SiYuan before v3.7.2 Unauthenticated Administrator Takeover via MCP
SiYuan before v3.7.2 contains a missing authorization vulnerability in the POST /mcp kernel endpoint, which is gated only by a general auth check model.CheckAuth with no admin-role or read-only enforcement. This exposes 31 MCP tools, including a file tool with list/read/write/delete/rename/copy...
Sensitive Information Exposure
Next.js is vulnerable to Sensitive Information Exposure. The vulnerability is due to exposure of Server Action identifiers in publicly served client artifacts, allowing unauthenticated attackers to discover protected Server Action endpoints and bypass authentication through endpoint enumeration...
EUVD-2026-48744
The web management interface in Tycon Systems TPDIN-Monitor-WEB2 stores and displays system credentials in cleartext on a certain configuration page accessible to authenticated users. Any party with access to the administrative dashboard can immediately read these credentials, which may be used t...
Linux Distros Unpatched Vulnerability : CVE-2026-64277
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count rmif3ainitialize takes the GPIO count from the device query register f3a-gpiocount = buf &...
Linux Distros Unpatched Vulnerability : CVE-2026-56623
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Path traversal on Windows in Apache MINA SSHD component sshd-git. Apache MINA SSHD is a Java library for client-side and server-side SSH. A git server implement...
PT-2026-64762
Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.7.2 Description A missing authorization issue exists in the 'POST /mcp' kernel endpoint, which is only protected by a general authentication check model.CheckAuth without enforcing admin roles or read-only...
CVE-2026-66339
A flaw was found in libsoup. After a CONNECT tunnel is established through an HTTP proxy, libsoup incorrectly attaches the Proxy-Authorization header to subsequent HTTPS requests sent through that tunnel to the destination server. This allows the destination server to capture proxy credentials,...
CVE-2026-64212
creationtimestamp| type| source ---|---|--- 2026-07-24 22:35:48+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116977339433684369...
CVE-2026-55985
The web management interface in Tycon Systems TPDIN-Monitor-WEB2 stores and displays system credentials in cleartext on a certain configuration page accessible to authenticated users. Any party with access to the administrative dashboard can immediately read these credentials, which may be used t...
Information Exposure
Overview @budibase/server is a Budibase Web Server Affected versions of this package are vulnerable to Information Exposure in the handling of the tlsCertificateKeyFile and tlsCAFile fields, which are passed directly as filesystem paths to the MongoDB driver without validation or restriction. An...
Information Exposure
Overview @budibase/server is a Budibase Web Server Affected versions of this package are vulnerable to Information Exposure via the metadata endpoints, which fail to sanitize sensitive fields from user profiles. An attacker can obtain OAuth2 access and refresh tokens belonging to other users by...
Cloudreve: Broken Access Control in file event stream: a single-file share recipient is subscribed to the owner's parent folder and receives activity events for unshared siblings
Summary When an authenticated recipient of a single-file share opens the file event stream GET /api/v4/file/events?uri=, Cloudreve validates the URI by listing it and then subscribes the caller to parent.ID. For a single-file share, the share navigator resolves the bare share-root URI to the...