CVE-2024-6782

CVE-2024-6782 Calibre Remote Code Execution CVE-2024-6782 Improper access control in Calibre 6.9.0 7.14.0 allow unauthenticated attackers to achieve remote code execution...

CVE-2026-112025

A weakness has been identified in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. This impacts an unknown function of the file App/Home/Controller/UserController.class.php of the component Captcha Validation. Executing a manipulation can lead to...

CVE-2024-6782

CVE-2024-6782 Improper access control in Calibre 6.9.0 7.14.0 allow unauthenticated attackers to achieve remote code execution. It's a simpler version lol...

CVE-2025-46018-CSC-Pay-Mobile-App-Payment-Authentication-Bypass

CVE-2025-46018 – CSC Pay Mobile App Payment Authentication Bypass Summary A payment authentication bypass vulnerability was discovered in the CSC Pay Mobile App, affecting version 2.19.4. The flaw allowed an attacker to initiate a payment, disable Bluetooth at a specific point in the process, and...

CVE-2026-24055-OAuth-Langfuse

CVE-2026-24055 — Unauthenticated Slack OAuth Install in Langfuse Course Project for Web and Application Security — Group 06, class NT213.Q21.ANTT 📌 Summary The project reproduces a real-world security vulnerability that has been publicly disclosed CVE-2026-24055 on the Langfuse platform — an OAut...

PT-2026-117158

A weakness has been identified in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. This impacts an unknown function of the file App/Home/Controller/UserController.class.php of the component Captcha Validation. Executing a manipulation can lead to...

CVE-2026-111919

Vikunja 0.22.0 before 2.7.0 contains an improper access revocation vulnerability that allows removed collaborators to keep receiving project data through webhooks they created. Former collaborators keep receiving task titles and descriptions through their webhook, including content created after...

CVE-2026-111919

Vikunja 0.22.0 before 2.7.0 contains an improper access revocation vulnerability that allows removed collaborators to keep receiving project data through webhooks they created. Former collaborators keep receiving task titles and descriptions through their webhook, including content created after...

CVE-2026-111919 Vikunja 0.22.0 before 2.7.0 Improper Access Revocation via Webhooks

Vikunja 0.22.0 before 2.7.0 contains an improper access revocation vulnerability that allows removed collaborators to keep receiving project data through webhooks they created. Former collaborators keep receiving task titles and descriptions through their webhook, including content created after...

EUVD-2026-103287

Vikunja 0.22.0 before 2.7.0 contains an improper access revocation vulnerability that allows removed collaborators to keep receiving project data through webhooks they created. Former collaborators keep receiving task titles and descriptions through their webhook, including content created after...

CVE-2026-111919 Vikunja 0.22.0 before 2.7.0 Improper Access Revocation via Webhooks

Vikunja 0.22.0 before 2.7.0 contains an improper access revocation vulnerability that allows removed collaborators to keep receiving project data through webhooks they created. Former collaborators keep receiving task titles and descriptions through their webhook, including content created after...

CVE-2026-111919

Vikunja versions 0.22.0 before 2.7.0 are vulnerable to an improper access revocation flaw regarding webhooks. The root cause allows removed collaborators to continue receiving project data, specifically task titles and descriptions , via webhooks they created prior to their removal. This includes...

CVE-2022-1388

CVE-2022-1388 - F5 BIG-IP iControl REST Authentication Bypass RCE This Python script exploits CVE-2022-1388, a critical vulnerability in F5 BIG-IP iControl REST that allows unauthenticated remote command execution via improper access control and HTTP header handling. ⚠️ For educational and...

CVE-2025-25968

CVE-2025-25968: Improper Access Control vulnerability in DDSN Interactive cm3 Acora CMS version 10.1.1 DDSN Interactive cm3 Acora CMS version 10.1.1 contains an improper access control vulnerability. An editor-privileged user can access sensitive information, such as system administrator...

CVE-2020-11539

CVE-2020-11539: Improper Access Control in Tata Sonata Smartband Information Description: It has been identified that the smart band has no pairing mode 0 BLE security level The data being transmitted over the air is not encrypted. Adding to this, the data being sent to the smart band doesn't hav...

Linux Distros Unpatched Vulnerability : CVE-2026-110111

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Xen Orchestra before 6.9.0 contains an improper access control vulnerability that allows any authenticated user to become global administrator by abusing the...

CVE-2026-106705

ELADMIN eladmin-mp up to 2.7 contains an improper access control vulnerability in the role management module. The endpoint PUT /api/roles/menu RoleController.updateRoleMenu authorizes the request only by comparing the target role's level with the caller's minimum level. The application neither...

CVE-2026-110287

Improper access control in asset contact password in Devolutions Server 2026.3.8.0 and earlier allows an authenticated user with general Edit but without Edit asset permission to modify the asset contact password via a crafted direct request to the partial-save endpoint...

EUVD-2026-102874

Improper access control in asset contact password in Devolutions Server 2026.3.8.0 and earlier allows an authenticated user with general Edit but without Edit asset permission to modify the asset contact password via a crafted direct request to the partial-save endpoint...

CVE-2026-110287

Improper access control in asset contact password in Devolutions Server 2026.3.8.0 and earlier allows an authenticated user with general Edit but without Edit asset permission to modify the asset contact password via a crafted direct request to the partial-save endpoint...