CVE-2026-55863 motionEye: Missing authentication on ActionHandler allows unauthenticated camera action execution

motionEye mEye is an online interface for a piece of software called "motion," which is a video surveillance program with motion detection. Prior to 0.44.0, the ActionHandler.post method in motioneye/handlers/action.py lacks the BaseHandler.auth decorator, allowing an unauthenticated remote...

CVE-2026-55863 motionEye: Missing authentication on ActionHandler allows unauthenticated camera action execution

motionEye mEye is an online interface for a piece of software called "motion," which is a video surveillance program with motion detection. Prior to 0.44.0, the ActionHandler.post method in motioneye/handlers/action.py lacks the BaseHandler.auth decorator, allowing an unauthenticated remote...

OPENSUSE-SU-2026:21861-1 Security update for gh

This update for gh fixes the following issues: Changes in gh: Update to version 2.100.0, fixing two deadlock issues in the vendored golang.org/x/crypto/ssh library reachable via crafted SSH channel messages CVE-2026-56854, CVE-2026-56855, CVE-2026-78662, bsc1278604: Fix gh api telemetry disableme...

EUVD-2023-60691

Yonyou U8 Cloud contains an unauthenticated Java deserialization vulnerability in the nc.impl.pub.filesystem.FileManageServlet component that allows remote unauthenticated attackers to execute arbitrary OS commands by sending a serialized payload via POST request. Attackers can exploit the doActi...

CVE-2023-54398 Yonyou U8 Cloud Java Deserialization RCE via FileManageServlet

Yonyou U8 Cloud contains an unauthenticated Java deserialization vulnerability in the nc.impl.pub.filesystem.FileManageServlet component that allows remote unauthenticated attackers to execute arbitrary OS commands by sending a serialized payload via POST request. Attackers can exploit the doActi...

CVE-2023-54398 Yonyou U8 Cloud Java Deserialization RCE via FileManageServlet

Yonyou U8 Cloud contains an unauthenticated Java deserialization vulnerability in the nc.impl.pub.filesystem.FileManageServlet component that allows remote unauthenticated attackers to execute arbitrary OS commands by sending a serialized payload via POST request. Attackers can exploit the doActi...

CVE-2023-54398

Yonyou U8 Cloud is affected by an unauthenticated Java deserialization vulnerability in the nc.impl.pub.filesystem.FileManageServlet component. The doAction method passes raw HTTP request body data directly to ObjectInputStream.readObject() without filtering, enabling remote attackers to execute ...

EUVD-2026-78834

Yeger is a monorepo for npm packages maintained under the yeger scope. Prior to 2.8.9, the turbo-graph package starts its embedded Next.js server from packages/turbo-graph/src/index.ts on all interfaces, including 0.0.0.0:29312 by default, while the GET handler for /api/run in...

CVE-2026-59160 Yeger: Unauthenticated Network-Exposed Turborepo Task Execution via /api/run

Yeger is a monorepo for npm packages maintained under the yeger scope. Prior to 2.8.9, the turbo-graph package starts its embedded Next.js server from packages/turbo-graph/src/index.ts on all interfaces, including 0.0.0.0:29312 by default, while the GET handler for /api/run in...

CVE-2026-59160 Yeger: Unauthenticated Network-Exposed Turborepo Task Execution via /api/run

Yeger is a monorepo for npm packages maintained under the yeger scope. Prior to 2.8.9, the turbo-graph package starts its embedded Next.js server from packages/turbo-graph/src/index.ts on all interfaces, including 0.0.0.0:29312 by default, while the GET handler for /api/run in...

CVE-2026-59160 Yeger: Unauthenticated Network-Exposed Turborepo Task Execution via /api/run

Yeger is a monorepo for npm packages maintained under the yeger scope. Prior to 2.8.9, the turbo-graph package starts its embedded Next.js server from packages/turbo-graph/src/index.ts on all interfaces, including 0.0.0.0:29312 by default, while the GET handler for /api/run in...

CVE-2026-59160

@yeger/turbo-graph (an npm package in the Yeger monorepo) prior to version 2.8.9 exposes an embedded Next.js server on all network interfaces (0.0.0.0:29312 by default) due to a missing hostname argument in .listen() at packages/turbo-graph/src/index.ts:44. The /api/run GET handler (packages/turb...

sql_injection_exploit.sh

sqlinjectionexploit.sh Why do we perfrom SQL Injection atta...

CVE-2026-46552

CVE-2026-46552 NocoDB 공유 베이스 링크가 실제 베이스 멤버를 초대할 수 있고 공유 취소 후에도 유지될 수 있음 소개 NocoDB 를 검토하던 중 이 문제를 발견했으며, 간단한 보안 질문을 염두에 두었습니다: 공유 베이스 링크가 일시적인 공유 접근에서 실제 인증된 베이스 멤버십으로 경계를 넘을 수 있는가? 이 경우, 답은 '예'였습니다. xc-shared-base-id로만 인증된 공유 베이스 세션은 ACL 목적상 일반 베이스 뷰어로 취급되었습니다. 뷰어 권한이 여전히 멤버 관리 엔드포인트에 도달할 수 있었기...

CVE-2024-20767

CVE-2024-20767에 대한 개념 증명PoC 스크립트 개요 get-the-files.py는 Adobe ColdFusion 서버의 취약점CVE-2024-20767을 악용하여 서버에서 파일을 읽어오는 Python 스크립트입니다. 이 스크립트는 https://jeva.cc/2973.html에 설명된 방법을 기반으로 합니다. 면책 조항 이 스크립트는 교육 목적으로만 제공됩니다. 허가 없이 서버를 테스트하거나, 권한 없이 취약점을 악용하거나, 동의 없이 개인 데이터에 접근하거나 공개하는 행위는 불법적이고 비윤리적인 활동입니다. 이...

stop-bots

Stop Bots CDN 뒤에 숨지 않고도 악성 봇을 차단하도록 서버를 구성하는 데 도움을 주는 TUI, 웹 UI, CLI입니다. NGINX 및 기존 방화벽iptables 또는 nftables과 함께 두 개의 개별 계층에서 작동합니다: NGINX 설정. - 알려진 봇을 카테고리스캐너, 검색 엔진, AI 크롤러별로 분류하고, 사이트 설정에 규칙을 주입하여 차단하거나 허용합니다. NGINX 로그를 스캔하여 봇을 동적으로 탐지하고, 아직 어떤 규칙 세트에도 등록되지 않은 봇도 차단합니다. 방화벽 스크립트. - 전체 국가, 데이터센터...

CVE-2026-91982

Vikunja before 2.6.0 continues to expose the raw TOTP shared secret after enrollment through the GET /api/v1/user/settings/totp and /api/v1/user/settings/totp/qrcode endpoints without re-authentication. Attackers with a valid access token can read the secret, import it into their own authenticato...

CVE-2026-91933

Flowise before 3.1.4 fails to enforce workspace-level authorization checks in openai-realtime endpoints, allowing authenticated users to access tools from ChatFlows in other workspaces by supplying an unscoped chatflowid. Attackers can invoke GET and POST requests to retrieve tool definitions and...

CVE-2026-88621

OneNav v1.2.4 contains an authenticated arbitrary file deletion vulnerability in the Api::upload method in class/Api.php. An authenticated administrator can submit a non-HTML upload filename matching an existing file in the application's working directory. The application passes the user-controll...

CVE-2026-88619

1024-lab SmartAdmin v3.30.0 contains a missing authorization vulnerability in the scheduled-job management module. The AdminSmartJobController exposes scheduled-job management endpoints without method-level permission checks, allowing a low-privileged authenticated user to access functionality...