CVE-2024-48590

CVE-2024-48590 Divulgación de Vulnerabilidad: SSRF en Inflectra SpiraTeam 7.2.00 Descripción Inflectra SpiraTeam versión 7.2.00 es vulnerable a Server-Side Request Forgery SSRF a través del componente NewsReaderService. Tipo de Vulnerabilidad Falsificación de Solicitudes del Lado del Servidor SSR...

CVE-2026-104854 Nx daemon and plugin worker sockets are accessible to other local users

Nx is a monorepo solution for TypeScript and polyglot codebases. From 14.6.0 until 22.7.9 and 23.1.2, Nx creates Unix domain sockets for its daemon and isolated plugin workers in shared temporary locations without owner-only directory and socket permissions. Another unprivileged local account on ...

CVE-2023-31014_Lab

CVE-2023-31014 Implicit Intent Hijacking Lab An educational Android Lab created based on the public report of CVE-2023-31014 in NVIDIA GeForce NOW for Android. It does not include NVIDIA source code, actual Action strings, or real authentication credentials. Facts confirmed from the public report...

CVE-2026-96613

The Meari IoT Cloud Platform OpenAPI Service is vulnerable to an authorization flaw that allows authenticated users to access the complete device shadow of any device by specifying its device ID. This vulnerability exposes sensitive information, such as device credentials, owner details, network...

CVE-2026-94544

Next.js is a React framework for building full-stack web applications. From 16.3.0 until 16.3.8, pending use cache fills for the same key are shared without separating Draft Mode requests from regular requests. An overlapping regular request can receive unauthenticated unpublished content from an...

CVE-2026-94485

Next.js is a React framework for building full-stack web applications. From 16.0.0 until 16.3.8, the next dev development server exposes a Model Context Protocol endpoint without reliably restricting cross-site requests. A malicious website visited by a developer can reach the endpoint and read t...

CVE-2026-94486

Next.js is a React framework for building full-stack web applications. From 16.0.0 until 16.3.8, the next dev development server exposes a Model Context Protocol endpoint without reliably restricting cross-site requests. A malicious website visited by a developer can reach the endpoint and read t...

CVE-2026-103627

Information leak in SVG in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to obtain sensitive information via a crafted HTML page. Chromium security severity: Medium...

DEBIAN-CVE-2026-103627

Information leak in SVG in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to obtain sensitive information via a crafted HTML page. Chromium security severity: Medium...

EUVD-2026-91716

Information leak in SVG in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to obtain sensitive information via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-103627

Information leak in SVG in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to obtain sensitive information via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-103627

Information leak in SVG in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to obtain sensitive information via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-103627

Google Chrome versions prior to 154.0.8037.97 are vulnerable to an information leak within the SVG component. A remote attacker can exploit this vulnerability to obtain sensitive information by interacting with a crafted HTML page . The issue has been addressed in the 154.0.8037.97 release for Wi...

EUVD-2026-91751

MISP contains an authorization flaw in its correlation handling during attribute searches. When a user performs an attribute search that triggers correlation lookups, the system authorized access to correlated attributes and events based on a stale distribution snapshot stored on the correlation...

CVE-2026-104912 MISP Correlation Authorization Bypass Exposes Restricted Event and Attribute Data

MISP contains an authorization flaw in its correlation handling during attribute searches. When a user performs an attribute search that triggers correlation lookups, the system authorized access to correlated attributes and events based on a stale distribution snapshot stored on the correlation...

CVE-2026-96613

The Meari IoT Cloud Platform OpenAPI Service is vulnerable to an authorization flaw (CWE-862) that allows authenticated users to access the complete device shadow of any device by specifying its device ID . The service fails to verify a relationship between the requester and the target device, le...

CVE-2026-96613 Missing Authorization in Meari IoT Cloud Platform OpenAPI Service

The Meari IoT Cloud Platform OpenAPI Service is vulnerable to an authorization flaw that allows authenticated users to access the complete device shadow of any device by specifying its device ID. This vulnerability exposes sensitive information, such as device credentials, owner details, network...

EUVD-2026-91750

The Meari IoT Cloud Platform OpenAPI Service is vulnerable to an authorization flaw that allows authenticated users to access the complete device shadow of any device by specifying its device ID. This vulnerability exposes sensitive information, such as device credentials, owner details, network...

CVE-2026-104910 MISP Information Disclosure via Related Events Listing Bypassing Per-Event Authorization

MISP contains an authorization bypass in the related events listing functionality. When a user requests the list of events correlated to a given event, the system retrieved related event metadata directly from the correlation table without re-validating the caller's access rights against each...

CVE-2026-104910 MISP Information Disclosure via Related Events Listing Bypassing Per-Event Authorization

MISP contains an authorization bypass in the related events listing functionality. When a user requests the list of events correlated to a given event, the system retrieved related event metadata directly from the correlation table without re-validating the caller's access rights against each...