925 matches found
ACTS: A Multi-Tier Benchmark Evaluating LLM Cipher Identification under Controlled Blind Conditions
We introduce ACTS Artifacts in Cipher Testing Suite, a reproducible benchmark that isolates cryptanalytic ability through tiered metadata deprivation Tier-1: full metadata; Tier-2: filename only; Tier-3: completely blind and tests forced reasoning Tier-5: chain-of-thought, code-as-reasoning,...
CVE-2026-48974 HomeBox: Forced Group Membership Without Consent in Homebox AddMember Handler
HomeBox is a home inventory and organization system. Prior to 0.26.0, POST /v1/groups/members invokes HandleGroupMemberAdd and GroupService.AddMember using a caller-supplied userID without requiring an owner role, an invitation token, target-user consent, or target-user notification. Any...
CVE-2026-48974 HomeBox: Forced Group Membership Without Consent in Homebox AddMember Handler
HomeBox is a home inventory and organization system. Prior to 0.26.0, POST /v1/groups/members invokes HandleGroupMemberAdd and GroupService.AddMember using a caller-supplied userID without requiring an owner role, an invitation token, target-user consent, or target-user notification. Any...
CVE-2026-48974 HomeBox: Forced Group Membership Without Consent in Homebox AddMember Handler
HomeBox is a home inventory and organization system. Prior to 0.26.0, POST /v1/groups/members invokes HandleGroupMemberAdd and GroupService.AddMember using a caller-supplied userID without requiring an owner role, an invitation token, target-user consent, or target-user notification. Any...
CVE-2026-7527
The WP Ghost (Hide My WP Ghost) – Security & Firewall plugin for WordPress is affected by an Open Redirect vulnerability in all versions up to and including 7.0.02 . The root cause is insufficient validation of user input, specifically through the redirect_to parameter. An unauthenticated attacke...
EUVD-2026-83054
btrbk is a tool for creating snapshots and remote backups of Btrfs subvolumes. From 0.29.0 until 0.32.7, btrbk's sshfilterbtrbk.sh constructs allowstreammatch with a start anchor but without an end-of-string anchor for the complete command. A user restricted through an authorizedkeys forced comma...
CVE-2026-40532
A direct request 'forced browsing' vulnerability in Wallpaper Path in Synology DiskStation Manager DSM before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote authenticated users to obtain sensitive information...
CVE-2026-40532
A direct request 'forced browsing' vulnerability in Wallpaper Path in Synology DiskStation Manager DSM before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote authenticated users to obtain sensitive information...
EUVD-2026-82788
A direct request 'forced browsing' vulnerability in Wallpaper Path in Synology DiskStation Manager DSM before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote authenticated users to obtain sensitive information...
CVE-2026-40532
A direct request 'forced browsing' vulnerability in Wallpaper Path in Synology DiskStation Manager DSM before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote authenticated users to obtain sensitive information...
Linux Distros Unpatched Vulnerability : CVE-2026-90231
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - apparmor: fix unconfined user namespace restriction forced stack If a task is already confined by a stack the unprivileged transition restriction on unconfined ...
PT-2026-95320
Name of the Vulnerable Software and Affected Versions Synology DiskStation Manager versions prior to 7.2.1-69057-10 Synology DiskStation Manager versions prior to 7.2.2-72806-7 Synology DiskStation Manager versions prior to 7.3.2-86009-2 Description A forced browsing issue exists in the Wallpaper...
CVE-2026-90231
In the Linux kernel, the following vulnerability has been resolved: apparmor: fix unconfined user namespace restriction forced stack If a task is already confined by a stack the unprivileged transition restriction on unconfined is not correctly, applied. This results in an escape if two transitio...
EUVD-2026-81824
In the Linux kernel, the following vulnerability has been resolved: apparmor: fix unconfined user namespace restriction forced stack If a task is already confined by a stack the unprivileged transition restriction on unconfined is not correctly, applied. This results in an escape if two transitio...
CVE-2026-90231
CVE-2026-90231 is a flaw in the Linux kernel's AppArmor subsystem. When a task is already confined by a profile stack , the unprivileged user-namespace transition restriction on the unconfined profile is not correctly enforced. This allows a confinement escape if two transitions through an unconf...
EUVD-2026-81279
In AVideo through 29.0, the autoCSRFGuard function maintains a hardcoded allowlist of exempt basenames tested without directory context, allowing plugin files matching core filenames to inherit CSRF exemptions. The LoginWordPress plugin file login.json.php inherits an exemption and unconditionall...
CVE-2026-92579 AVideo through 29.0 Broken Access Control via CSRF Exemption Basename Collision
In AVideo through 29.0, the autoCSRFGuard function maintains a hardcoded allowlist of exempt basenames tested without directory context, allowing plugin files matching core filenames to inherit CSRF exemptions. The LoginWordPress plugin file login.json.php inherits an exemption and unconditionall...
CVE-2026-92579 AVideo through 29.0 Broken Access Control via CSRF Exemption Basename Collision
In AVideo through 29.0, the autoCSRFGuard function maintains a hardcoded allowlist of exempt basenames tested without directory context, allowing plugin files matching core filenames to inherit CSRF exemptions. The LoginWordPress plugin file login.json.php inherits an exemption and unconditionall...
TOTOLINK T6 Access Control Vulnerability (CNVD-2026-38439)
The TOTOLINK T6 is a dual-band wireless Mesh router released by ZhiOn Electronics TOTOLINK. The TOTOLINK T6 contains an access control vulnerability stemming from improper access control in the setScheduleCfg function. An attacker could exploit this vulnerability by sending a specially crafted PO...