EUVD-2026-92289

DigitalCanion has discovered a path traversal vulnerability that allows to view or download sensitive system files over the portal https://:8443 via menus Administration - View Logs...

CVE-2026-104706 Mitel MiVoice Office 400 view system files path traversal

DigitalCanion has discovered a path traversal vulnerability that allows to view or download sensitive system files over the portal https://:8443 via menus Administration - View Logs...

CVE-2026-104706

The Mitel MiVoice Office 400 system is affected by a path traversal vulnerability (CWE-31). This flaw allows an attacker with high privileges to view or download sensitive system files via the portal at https://:8443 specifically through the Administration -> View Logs menu. The vulnerability ...

CVE-2026-104706 Mitel MiVoice Office 400 view system files path traversal

DigitalCanion has discovered a path traversal vulnerability that allows to view or download sensitive system files over the portal https://:8443 via menus Administration - View Logs...

Exchange_IOC_Hunter

ExchangeIOCHunter विवरण: IIS लॉग में IOCs की खोज करें - CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, CVE-2021-27065 समर्थित आर्टिफैक्ट्स: C2 IP पते स्कैनिंग और शोषण के लिए उपयोग फ़ाइल नाम शोषण प्रयासों में देखे गए रिमोट कोड निष्पादन RCE उपयोग: powershell .\ExchangeIOCHunter.ps1 अपडेट: यह...

CVE-2026-105636: Server-Side Request Forgery (SSRF)

Plane is an open-source project management tool. Prior to 1.4.0, the webhook delivery task in apps/api/plane/bgtasks/webhooktask.py calls requests.post without allowredirects=False and does not validate redirect targets. validateurl blocks private, loopback, link-local, and reserved addresses in...

PT-2026-104743

DigitalCanion has discovered a path traversal vulnerability that allows to view or download sensitive system files over the portal https://:8443 via menus Administration - View Logs...

PT-2026-106083

Name of the Vulnerable Software and Affected Versions Plane versions prior to 1.4.0 Description The webhook delivery task in apps/api/plane/bgtasks/webhook task.py uses the requests.post function without setting allow redirects=False and fails to validate redirect targets. While the validate url...

CVE-2026-104806: Path Traversal: 'dir\..\..\filename'

DigitalCanion has discovered a path traversal vulnerability that allows an attacker to access files outside of the intended directory. The specific flaw exists within the Maintenance → System Logs functionality of the web management portal listening on TCP port 443. The application fails to...

PT-2026-104771

DigitalCanion has discovered a path traversal vulnerability that allows an attacker to access files outside of the intended directory. The specific flaw exists within the Maintenance → System Logs functionality of the web management portal listening on TCP port 443. The application fails to...

CVE-2026-104706: Path Traversal: 'dir\..\..\filename'

DigitalCanion has discovered a path traversal vulnerability that allows to view or download sensitive system files over the portal https:// :8443 via menus Administration - View Logs...

Zeek-Endpoint-Enrichment

Zeek-Endpoint-Enrichment Zeek लॉग्स को होस्ट जानकारी के साथ समृद्ध करें सभी लॉग्स को id फ़ील्ड के साथ समृद्ध करने के लिए, टैग ".-all" का उपयोग करें। सभी लॉग्स को id फ़ील्ड और Known Entities के साथ समृद्ध करने के लिए, टैग ".-known-all" का उपयोग करें। केवल conn.log को समृद्ध करने के लिए, टैग ".-con...

GPEWebDefender

GPEWebDefender مراقب هجمات الويب. يجلس بجانب nginx / Caddy / التطبيق، ويتابع سجلات الوصول، ويخبرك عندما يتم استهداف موقع أو استغلاله. إذا ماتت هذه العملية، يستمر الموقع في تقديم الخدمة. إنه ليس Wazuh، وليس OSSEC، وليس WAF. الأمر هو gpewebdefender. المضيفون، والرموز، ودبابيس الخريطة، وGeoIP، ومسار...

CVE-2014-0094

CVE-2014-0094 सत्यापन के लिए। https://piyolog.hatenadiary.jp/entry/20140417/1397750195 के संदर्भ में, vulhub/java:7u55-jdk tomcat-8.0.5 struts-2.3.16 पुनः निर्मित। classLoader काम कर रहा है, लेकिन महत्वपूर्ण लॉग प्रतिशत-एन्कोडेड हो रहा है, इसलिए RCE तक नहीं पहुँच पा रहा विंडोज़ संस्करण भी जोड़ा ग...

CVE-2026-80518

The WP Ultimate CSV Importer WordPress plugin before 9.2 does not use a site-specific secret when deriving the storage location of the import logs it writes under the uploads directory, nor does it block direct access to them, allowing unauthenticated attackers to retrieve the personal data of...

CVE-2026-80518

The WP Ultimate CSV Importer WordPress plugin (versions before 9.2 ) is vulnerable to unauthenticated data disclosure. The root cause is the failure to use a site-specific secret when deriving the storage location for import logs within the uploads directory , combined with a lack of direct acces...

EUVD-2026-91830

Armatura One's message broker logs client connection credentials and the associated password in plain text during normal operation. Any party with read access to this log, or to a backup or support bundle that includes it, can obtain the logged credential...

PT-2026-104522

Name of the Vulnerable Software and Affected Versions WP Ultimate CSV Importer versions prior to 9.2 Description The plugin fails to use a site-specific secret when determining the storage location for import logs within the uploads directory. Additionally, it does not block direct access to thes...

CVE-2026-80518: Exposure of Sensitive Information to an Unauthorized Actor

The WP Ultimate CSV Importer WordPress plugin before 9.2 does not use a site-specific secret when deriving the storage location of the import logs it writes under the uploads directory, nor does it block direct access to them, allowing unauthenticated attackers to retrieve the personal data of...

GHSA-FJ2X-MQQP-3V2W Trigger.dev: Trigger CLI debug deployment logs expose resolved environment secret values

Affected version: trigger.dev 4.5.3 4.5.6 was advertised by the CLI but was not tested. A staging dry-run executed with trigger.dev deploy --env staging --dry-run --log-level debug. The debug output logged the complete build-worker options object. Its envVars property contained unredacted values...