Tracgram

Trackgram Use Instagram location features to track an account Usage At this moment the usage of Trackgram is extremly simple: 1. Download this repository 2. Go through the instalation steps 3. Change the parameters in the tracgram main method directly: + Mandatory: - NICKNAME: your username on...

airo-heat

airoheat Repository of the T1GR3$ team at the Cybercamp 2018 hackathon Final presentation at Cybercamp 2018: https://www.youtube.com/watch?v=l-iBtYxHAbQ Video used at Cybercamp 2018: https://www.youtube.com/watch?v=0DEitQNn7GQ Aircrack-ng Installation modification sudo apt-get install...

CVE-2026-104867

Immich is a high-performance self-hosted photo and video management solution. From 3.0.0 until 3.2.0, the GET /api/admin/users/id/calendar-heatmap route in server/src/controllers/user-admin.controller.ts uses the ordinary Permission.UserRead permission without an admin-route requirement, and...

EUVD-2026-117603

Immich is a high-performance self-hosted photo and video management solution. From 3.0.0 until 3.2.0, the GET /api/admin/users/id/calendar-heatmap route in server/src/controllers/user-admin.controller.ts uses the ordinary Permission.UserRead permission without an admin-route requirement, and...

CVE-2026-104867 Immich calendar heatmap endpoint discloses cross-user activity through broken access control

Immich is a high-performance self-hosted photo and video management solution. From 3.0.0 until 3.2.0, the GET /api/admin/users/id/calendar-heatmap route in server/src/controllers/user-admin.controller.ts uses the ordinary Permission.UserRead permission without an admin-route requirement, and...

CVE-2026-104867

The Immich photo and video management solution is vulnerable to a broken access control issue in versions 3.0.0 through 3.2.0 . The GET /api/admin/users/{id}/calendar-heatmap route incorrectly uses the Permission.UserRead permission without an admin-route requirement. Furthermore, the UserAdminSe...

CVE-2026-104867 Immich calendar heatmap endpoint discloses cross-user activity through broken access control

Immich is a high-performance self-hosted photo and video management solution. From 3.0.0 until 3.2.0, the GET /api/admin/users/id/calendar-heatmap route in server/src/controllers/user-admin.controller.ts uses the ordinary Permission.UserRead permission without an admin-route requirement, and...

Immich permission and access control issue vulnerability

A security vulnerability exists in Immich versions 3.0.0 through 3.2.0. This vulnerability stems from improper permission checks during calendar heatmap routing; it fails to compare the identity of authenticated users with that of the requesting user, and does not apply asset visibility filters. ...

CVE-2026-114199

A flaw was found in Gitea. An authenticated user possessing a restricted, public-only access token can trigger an information disclosure vulnerability by querying the user contribution heatmap API endpoint. Due to improper enforcement of token scope restrictions, the endpoint computes activity da...

CVE-2026-114199

GET /api/v1/users/username/heatmap computed the contribution heatmap with the repository access of the token owner and ignored the public-only restriction of the access token, unlike the activity feed endpoints. A holder of a user's public-only token could read contribution counts and their...

CVE-2026-114199 Gitea contribution heatmap private activity disclosure to public-only tokens

GET /api/v1/users/username/heatmap computed the contribution heatmap with the repository access of the token owner and ignored the public-only restriction of the access token, unlike the activity feed endpoints. A holder of a user's public-only token could read contribution counts and their...

CVE-2026-114199 Gitea contribution heatmap private activity disclosure to public-only tokens

GET /api/v1/users/username/heatmap computed the contribution heatmap with the repository access of the token owner and ignored the public-only restriction of the access token, unlike the activity feed endpoints. A holder of a user's public-only token could read contribution counts and their...

EUVD-2026-114793

GET /api/v1/users/username/heatmap computed the contribution heatmap with the repository access of the token owner and ignored the public-only restriction of the access token, unlike the activity feed endpoints. A holder of a user's public-only token could read contribution counts and their...

CVE-2026-114199

The Gitea platform contains an information disclosure vulnerability in the GET /api/v1/users/{username}/heatmap endpoint. The vulnerability arises because the application fails to enforce public-only access token restrictions, instead using the repository permissions of the token owner. This allo...

CVE-2026-114199: Gitea: `GET /api/v1/users/{username}/heatmap` computed the contribution heatmap with the repository access of the token owner…

GET /api/v1/users/username/heatmap computed the contribution heatmap with the repository access of the token owner and ignored the public-only restriction of the access token, unlike the activity feed endpoints. A holder of a user's public-only token could read contribution counts and their...

PT-2026-134869

GET /api/v1/users/username/heatmap computed the contribution heatmap with the repository access of the token owner and ignored the public-only restriction of the access token, unlike the activity feed endpoints. A holder of a user's public-only token could read contribution counts and their...

Malware in orderly-plugin-liquidity-heatmap

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious Package

Overview orderly-plugin-liquidity-heatmap is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and...

CVE-2026-114697

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in QuarkA QA Analytics qa-heatmap-analytics allows Stored XSS.This issue affects QA Analytics: from n/a through 5.3.0.1...

CVE-2026-114697

The WordPress QA Analytics plugin (qa-heatmap-analytics) is vulnerable to Stored Cross-Site Scripting (XSS) in versions up to and including 5.3.0.1 . The root cause is the improper neutralization of input during web page generation. This vulnerability allows an attacker to store malicious scripts...