CVE-2026-66751-Insufficient-Access-Controls-Allow-for-Unauthorized-Room-Deletion-Let-s-Chat-

Aviso de seguridad: los controles de acceso insuficientes permiten la eliminación no autorizada de salas Let's Chat Identificador CVE asignado: CVE-2026-66751 Resumen DELETE /rooms/:room no realiza ninguna comprobación de autorización más allá de requerir un inicio de sesión. Cualquier cuenta pue...

CVE-2026-49254 Dragonfly Manager OAuth provider client_secret disclosure via unauthenticated GET /api/v1/oauth

Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.4.4, manager/router/router.go registers GET /api/v1/oauth and GET /api/v1/oauth/:id without jwt.MiddlewareFunc or RBAC, while manager/handlers/oauth.go returns models.Oauth records and...

CVE-2026-49254 Dragonfly Manager OAuth provider client_secret disclosure via unauthenticated GET /api/v1/oauth

Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.4.4, manager/router/router.go registers GET /api/v1/oauth and GET /api/v1/oauth/:id without jwt.MiddlewareFunc or RBAC, while manager/handlers/oauth.go returns models.Oauth records and...

CVE-2026-49254

Dragonfly Manager (an open-source P2P file distribution system) exposes the OAuth client_secret to unauthenticated clients via GET /api/v1/oauth and GET /api/v1/oauth/:id. The root cause is missing JWT and RBAC middleware on these two GET routes in manager/router/router.go, while the sibling POST...

CVE-2026-49254 Dragonfly Manager OAuth provider client_secret disclosure via unauthenticated GET /api/v1/oauth

Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.4.4, manager/router/router.go registers GET /api/v1/oauth and GET /api/v1/oauth/:id without jwt.MiddlewareFunc or RBAC, while manager/handlers/oauth.go returns models.Oauth records and...

EUVD-2026-78577

Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.4.4, manager/router/router.go registers GET /api/v1/oauth and GET /api/v1/oauth/:id without jwt.MiddlewareFunc or RBAC, while manager/handlers/oauth.go returns models.Oauth records and...

CVE-2026-54637 Dragonfly scheduler v1 gRPC unauthenticated SSRF via attacker-controlled PeerHost in DownloadTinyFile

Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.4.4-rc.3, the scheduler's default unauthenticated v1 gRPC flow accepts attacker-controlled PeerHost.Ip and PeerHost.DownPort values through RegisterPeerTask and ReportPeerResult, storeHost copies tho...

CVE-2026-54637

Dragonfly (open-source P2P file distribution system) versions prior to 2.4.4-rc.3 contain an unauthenticated read-SSRF in the scheduler's v1 gRPC service. An attacker who can reach the scheduler's gRPC port (insecure by default) can supply arbitrary PeerHost.Ip and PeerHost.DownPort values, causi...

CVE-2026-54637 Dragonfly scheduler v1 gRPC unauthenticated SSRF via attacker-controlled PeerHost in DownloadTinyFile

Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.4.4-rc.3, the scheduler's default unauthenticated v1 gRPC flow accepts attacker-controlled PeerHost.Ip and PeerHost.DownPort values through RegisterPeerTask and ReportPeerResult, storeHost copies tho...

EUVD-2026-78576

Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.4.4-rc.3, the scheduler's default unauthenticated v1 gRPC flow accepts attacker-controlled PeerHost.Ip and PeerHost.DownPort values through RegisterPeerTask and ReportPeerResult, storeHost copies tho...

CVE-2026-54637 Dragonfly scheduler v1 gRPC unauthenticated SSRF via attacker-controlled PeerHost in DownloadTinyFile

Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.4.4-rc.3, the scheduler's default unauthenticated v1 gRPC flow accepts attacker-controlled PeerHost.Ip and PeerHost.DownPort values through RegisterPeerTask and ReportPeerResult, storeHost copies tho...

CVE-2026-66749-Unchecked-Room-Lookup-Leads-to-Server-Crash-Let-s-Chat-

Aviso de seguridad: la búsqueda de sala sin verificar provoca la caída del servidor Let's Chat ID de CVE asignado: CVE-2026-66749 Resumen Una única solicitud HTTP desde cualquier cuenta iniciada detiene el proceso del servidor de Let's Chat. GET /messages toma un parámetro room, busca esa sala po...

CVE-2026-26719

Descripción Resumen Existe una vulnerabilidad de Cross‑Site Scripting almacenado en xxl-job-admin JobInfoController.java donde el parámetro addressList acepta JavaScript codificado en URL sin sanitizar. El payload se almacena y posteriormente se ejecuta en los navegadores de los usuarios, lo que...

CVE-2026-40864

CVE-2026-40864 — JupyterHub XSRF bypass via cross-origin form POST Sec-Fetch-Mode: no-cors Severity : Medium CVSS 5.4 CWE : CWE-352 — Cross-Site Request Forgery XSRF Affected : jupyterhub 4.1.0 ≤ version posting to a different origin — precisely the classic CSRF vector the token is supposed to...

PEASS-ng v20260914-6273eb76

PEASS-ng - Privilege Escalation Awesome Scripts SUITE new generation Linux Privesc official course to master LinPEAS Checkhttps://hacktricks-training.com/courses/lhe/ to learn tens of linux privesc techniques and master LinPEAS Basic Tutorial Here you will find privilege escalation tools for...

CVE-2026-2942

ProSolution WP Client — 未认证文件上传与RCE扫描器 插件: prosolution-wp-client 受影响版本: 漏洞类型: 未认证任意文件上传 → 远程代码执行 风险等级: 🔴 严重 CVSS 9.8 前置条件: 包含 prosolfrontend 短代码的公开页面 📌 关于漏洞 ProSolution WP Client 插件的 proSolfileUploadProcess AJAX 动作， 检查上传文件的 MIME 类型，但不验证扩展名。 攻击者可以将 .php 文件伪装成 image/jpeg MIME 类型发送， 从而在无需身份验证...

Security update for the Linux Kernel (Live Patch 58 for SUSE Linux Enterprise 15 SP4)

This update for the SUSE Linux Enterprise Kernel 5.14.21-150400.24.235 fixes various security issues: The following security issues were fixed: CVE-2026-64423: ipv4: igmp: remove multicast group from hash table on device destruction bsc1275458. CVE-2026-68138: net/sched: serialize qdiscrtablist...

SUSE-SU-2026:4193-1 Security update for the Linux Kernel (Live Patch 58 for SUSE Linux Enterprise 15 SP4)

This update for the SUSE Linux Enterprise Kernel 5.14.21-150400.24.235 fixes various security issues: The following security issues were fixed: - CVE-2026-64423: ipv4: igmp: remove multicast group from hash table on device destruction bsc1275458. - CVE-2026-68138: net/sched: serialize qdiscrtabli...

asterion-network-minotaur

道德网络安全审计器 — 超过50项检查覆盖SMB、RDP、LDAP、SSH、Kerberos等，配备AI驱动的CVE分析和OWASP/CIS/NIST合规映射。 快速开始 · 文档 · Docker · AI功能 · 在GitHub上标星 实际运行 本地扫描 · 127.0.0.1 · 33个发现 0C/4H/2M/3L/24I · 16项检查 · 57.74秒 · .NET 8.0.22 !Asterion —...

CVE-2026-32646

CVE-2026-32646: Falta de autenticación en el endpoint administrativo de gestión de dispositivos Aviso Campo| Valor ---|--- CVE| CVE-2026-32646 ICSA| ICSA-26-055-03 Actualización A CVSS 3.1| 7.5 Alto Vector| CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CWE| CWE-306 Falta de autenticación para...