CVE-2026-104962

Plane is an open-source project management tool. Prior to 1.4.0, GET /api/v1/workspaces/slug/projects/projectid/members/ returns the complete project-member roster, including each member's email address, first and last name, display name, avatar, and role. ProjectMemberPermission gates the...

EUVD-2026-92483

Plane is an open-source project management tool. Prior to 1.4.0, GET /api/v1/workspaces/slug/projects/projectid/members/ returns the complete project-member roster, including each member's email address, first and last name, display name, avatar, and role. ProjectMemberPermission gates the...

EUVD-2026-92481

Plane is an open-source project management tool. Prior to 1.4.0, Plane exposes the workspace-scoped GET /api/assets/v2/workspaces/workspaceslug/download/assetid/ endpoint for project-bound FileAsset objects without enforcing access to the asset's owning project. An authenticated user who belongs ...

CVE-2026-104960 Plane: Authorization bypass in workspace-scoped asset download endpoint exposes secret project file assets to non-project workspace users

Plane is an open-source project management tool. Prior to 1.4.0, Plane exposes the workspace-scoped GET /api/assets/v2/workspaces/workspaceslug/download/assetid/ endpoint for project-bound FileAsset objects without enforcing access to the asset's owning project. An authenticated user who belongs ...

CVE-2026-104960 Plane: Authorization bypass in workspace-scoped asset download endpoint exposes secret project file assets to non-project workspace users

Plane is an open-source project management tool. Prior to 1.4.0, Plane exposes the workspace-scoped GET /api/assets/v2/workspaces/workspaceslug/download/assetid/ endpoint for project-bound FileAsset objects without enforcing access to the asset's owning project. An authenticated user who belongs ...

CVE-2026-104960 Plane: Authorization bypass in workspace-scoped asset download endpoint exposes secret project file assets to non-project workspace users

Plane is an open-source project management tool. Prior to 1.4.0, Plane exposes the workspace-scoped GET /api/assets/v2/workspaces/workspaceslug/download/assetid/ endpoint for project-bound FileAsset objects without enforcing access to the asset's owning project. An authenticated user who belongs ...

CVE-2018-6574

CVE-2018-6574 Удаленное выполнение команд в команде Golang go get. CVE-2018-6574 эта уязвимость затрагивает команду go get в Golang и позволяет атакующему получить выполнение кода в системе путем установки вредоносной библиотеки. Эта уязвимость была исправлена в Go 1.8.7, 1.9.4 и 1.10rc2. Golang...

go-get-RCE

go-get-RCE Это эксплойт для CVE-2018-6574: go get RCE Эта уязвимость затрагивает команду Golang go get и позволяет атакующему получить выполнение кода на системе, устанавливающей их вредоносную библиотеку. Это хороший пример уязвимости, которая может быть использована с помощью typosquatting для...

SnakeYAML-CVE-2022-1471-POC

SnakeYAML-CVE-2022-1471-POC Code pour le blog de Veracode Pour démontrer l'exécution de code, 1. Compilez le projet avec maven 2. Exécutez python3 -m http.server 8080 pour lancer le serveur HTTP 3. Exécutez exploit.java. Vous devriez observer une requête HTTP GET sur le serveur 4. Pour démontrer...

CVE-2026-81000

cve-id Пожертвование Помогите поддерживать этот проект Если вы находите этот проект полезным, пожалуйста, рассмотрите возможность поддержки его дальнейшего сопровождения через PayPal или ABA Mobile. ❤️ ១០% នៃការបរិច្ចាគរបស់អ្នក នឹងត្រូវបានបរិច្ចាគជូនមន្ទីរពេទ្យគន្ធបុប្ផា។ ❤️ Десять процентов от...

go-get-rce

В этом репозитории нет README...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: md/md-bitmap: Synchronized bitmapgetstats with the lifetime of the bitmap. After the commit with the code ec6bb299c7c3 “md/md-bitmap: add ‘syncsize’ into struct mdbitmapstats, a panic is reported: Oops: General Protection Fault,...

Astra Linux – Vulnerability in Linux 5.10, Linux

In the Linux kernel, the following vulnerabilities have been resolved: Thermal: Fix NULL pointer dereferencing in ofthermal functions. ofparsethermalzones parses the thermal-zone node and registers a thermalzone device for each subnode. However, if a thermal zone uses a thermal sensor, and that...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerability has been resolved: drm/exynos/vidi: fixed a memory leak in the .getmodes function. The duplicated EDID values are never freed. This issue needs to be addressed...

Astra Linux – Vulnerability in Linux 5.10, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: mm/swapfile: condresched was added to getswappages. A softlockup still occurs in getswappages under memory pressure. With 64 CPU cores, 64GB of memory, and 28 zram devices, the size of each zram device is 50MB, and they all have...

CVE-2026-63269

LibreOffice can link to audio and video files from a document, and on Linux it plays them with GStreamer. A linked media file could be an HLS playlist that made GStreamer read the local files and remote URLs it listed while the document loaded, and their contents could end up in the document. In...

CVE-2026-63267 LFI and GET SSRF via calcext:data-mappings and csv provider

LibreOffice Calc can link a cell range to an external csv data source, and the link is saved in the document. Such a link was fetched while the document loaded, so opening a document could read a local file into the sheet, or make a request to a host of the document's choosing. In fixed versions...

CVE-2024-9796

CVE-2024-9796 POC SQLi - CVE-2024-9796 Функциональный PoC для уязвимости CVE-2024-9796, затрагивающей плагин WP Advanced Search автодополнение в WordPress и позволяющей выполнить SQL-инъекцию SQL Injection через несанитизированные GET-параметры. 📌 Описание Эта уязвимость позволяет атакующему...

CVE-2025-55885

CVE-2025-55885 Description Vulnérabilité d'injection SQL dans Alpes Recherche et Developpement ARD GEC en Ligne avant la version 2025-04-23 permet à un attaquant distant d'élever ses privilèges via les paramètres GET dans index.php Vecteurs d'attaque Injection SQL via le paramètre GET non assaini...

CVE-2025-24893-PoC

CVE-2025-24893 – Exécution de commande à distance sur XWiki Preuve de concept Aperçu Ce dépôt contient une Preuve de Concept PoC contrôlée pour CVE-2025-24893 , une vulnérabilité d'exécution de commande à distance RCE sans authentification affectant XWiki. La vulnérabilité permet à un attaquant...