nccfsas

Introduction This repository holds information released publicly by NCC Group's Full Spectrum Attack Simulation FSAS team...

LoLLMS WebUI - Subfolder Prediction via Path Traversal

A Path Traversal vulnerability exists in the parisneo/lollms-webui, specifically within the 'addreferencetolocalmode' function due to the lack of input sanitization. This vulnerability affects versions v9.6 to the latest. id: CVE-2024-4841 info: name: LoLLMS WebUI - Subfolder Prediction via Path...

CVE-2026-21986-VirtualBox-DoS

CVE-2026-21986 - VirtualBox 공유 폴더 커널 메모리 고갈 DoS 개요 이 저장소는 Oracle VM VirtualBox의 서비스 거부DoS 취약점인 CVE-2026-21986에 대한 개념 증명PoC 및 기술 문서를 포함합니다. 이 문제는 공유 폴더 드라이버 인터페이스에 존재하며, 장치 IOCTL 인터페이스를 통해 커널 메모리 할당을 반복적으로 트리거할 수 있습니다. 이로 인해 비페이징 커널 메모리가 고갈되어 가상 머신이 정지freeze될 수 있습니다. 이 취약점은 CVE-2026-21986로 지정되었으며...

CVE-2026-97267

Subscriber Broken Access Control in Prevent files / folders access = 2.6.7 versions...

CVE-2026-97267

The Prevent files / folders access plugin for WordPress is affected by a Broken Access Control vulnerability in versions

CVE-2026-97267 WordPress Prevent files / folders access plugin <= 2.6.7 - Broken Access Control vulnerability

Subscriber Broken Access Control in Prevent files / folders access = 2.6.7 versions...

CVE-2026-97267 WordPress Prevent files / folders access plugin <= 2.6.7 - Broken Access Control vulnerability

Subscriber Broken Access Control in Prevent files / folders access = 2.6.7 versions...

EUVD-2026-89919

Subscriber Broken Access Control in Prevent files / folders access = 2.6.7 versions...

WordPress Prevent files / folders access plugin <= 2.6.7 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by gueco in WordPress Plugin Prevent files / folders access versions = 2.6.7...

WordPress Media Library Folders plugin <= 8.4.1 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Media Library Folders versions = 8.4.1...

CVE-2026-59815 Joplin: Pending share recipients can write items into shared folders before accepting invitations

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.7, Joplin Server's ItemModel.checkIfAllowed authorizes writes to items with a share ID when any shareusers row exists for the caller, without requiring ShareUserStatus.Accepted. ...

CVE-2026-59815

Joplin Server (an open-source note-taking and to-do application) had an authorization flaw in ItemModel.checkIfAllowed() prior to version 3.7.7 . The method granted write access to items with a share ID whenever any share_users row existed for the caller, without requiring ShareUserStatus.Accepte...

CVE-2026-15004 FileBird – WordPress Media Library Folders & File Manager <= 6.5.6 - Authenticated (Author+) Stored Cross-Site Scripting

The FileBird – WordPress Media Library Folders & File Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via image alt text in all versions up to, and including, 6.5.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

CVE-2026-77169

A vulnerability in the team folders formerly group folders app when used in combination with the workspace app allowed API/REST-only delegated administrators to bypass folder-level authorization controls. The workspace app enables organizations to delegate limited administrative privileges for te...

CVE-2026-77169

A vulnerability in the team folders formerly group folders app when used in combination with the workspace app allowed API/REST-only delegated administrators to bypass folder-level authorization controls. The workspace app enables organizations to delegate limited administrative privileges for te...

CVE-2026-77169

A vulnerability in the team folders formerly group folders app when used in combination with the workspace app allowed API/REST-only delegated administrators to bypass folder-level authorization controls. The workspace app enables organizations to delegate limited administrative privileges for te...

CVE-2026-77169

A vulnerability in the team folders (formerly group folders) app, when used in combination with the workspace app , allowed API/REST-only delegated administrators to bypass folder-level authorization controls. The workspace app enables organizations to delegate limited administrative privileges f...

EUVD-2026-82618

A vulnerability in the team folders formerly group folders app when used in combination with the workspace app allowed API/REST-only delegated administrators to bypass folder-level authorization controls. The workspace app enables organizations to delegate limited administrative privileges for te...

CVE-2026-77169: Improper Access Control

A vulnerability in the team folders formerly group folders app when used in combination with the workspace app allowed API/REST-only delegated administrators to bypass folder-level authorization controls. The workspace app enables organizations to delegate limited administrative privileges for te...

CVE-2026-15004: Improper Neutralization of Input During Web Page Generation

The FileBird – WordPress Media Library Folders & File Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via image alt text in all versions up to, and including, 6.5.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...