116 matches found
EUVD-2026-44623
Capgo Cap-go/capgo before 12.128.2 contains an information disclosure vulnerability in the Supabase PostgREST SECURITY DEFINER RPC function public.rescindinvitation that allows unauthenticated attackers to enumerate organization existence. The function returns distinct error messages NOORG vs...
CVE-2026-34358
CtrlPanel is open-source billing software for hosting providers. Versions 1.1.1 and prior contains a broken access control vulnerability where multiple admin controllers enforce permission checks on form display methods but omit equivalent checks on the corresponding write methods, allowing any...
EUVD-2026-34075
The ugw-restore method allows a remote attacker with user privileges to delete arbitrary local files due to insufficient validation of user-controlled input...
The vulnerability of the Load method in the LoadLoadedArsc.cpp script of the Android operating system’s Framework component, which allows a hacker to escalate their privileges.
The vulnerability of the Load method in the LoadLoadedArsc.cpp script of the Android operating system’s framework component is related to the execution of operations outside of the buffer in memory. Exploiting this vulnerability can allow an attacker to gain increased privileges...
CVE-2026-39831
The Verify method for FIDO/U2F security key types [email protected], [email protected] did not check the User Presence flag. Signatures generated without physical touch were accepted, allowing unattended use of a hardware security key. To restore the previous behavior,...
EUVD-2026-30993
CtrlPanel is open-source billing software for hosting providers. Versions 1.1.1 and prior contains a broken access control vulnerability where multiple admin controllers enforce permission checks on form display methods but omit equivalent checks on the corresponding write methods, allowing any...
CVE-2026-42551
Flight is an extensible micro-framework for PHP. Prior to 3.18.1, Request::getMethod unconditionally honors the X-HTTP-Method-Override header and the $REQUEST'method' parameter on any HTTP verb including safe verbs such as GET, with no opt-in and no whitelist of permitted target methods. A GET...
CVE-2026-41317
The CVE concerns Press, a Frappe-based app, where the API endpoint press.api.account.create_api_secret is vulnerable to CSRF-like exploits. The issue stems from the endpoint accepting unsafe HTTP methods (GET) and writing to the database, enabling unauthorized actions without user interaction. A ...
ERB 安全漏洞
ERB is an open-source embedded Ruby template processing tool developed by The Ruby Programming Language. There is a security vulnerability in ERB, which stems from the lack of protection for @src in methods like ERBdefmethod, ERBdefmodule, and ERBdefmodule. This vulnerability could allow attacker...
Cross-site Scripting (XSS)
Overview nicegui is a Create web-based user interfaces with Python. The nice way. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the runmethod function. An attacker can execute arbitrary JavaScript in the victim's browser by supplying crafted input as a method...
The vulnerability of the Incoming Goods Suite registration method, related to lack of access control, allows attackers to compromise the integrity and accessibility of the protected information.
The vulnerability of the Incoming Goods Suite registration and delivery method is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker operating remotely to compromise the integrity and accessibility of the protected information...
EUVD-2021-0848
Malware in sbrugna...
EUVD-2009-2382
Malware in sbrugna...
EUVD-2009-0811
Malware in sbrugna...
EUVD-2010-2233
Malware in sbrugna...
EUVD-2021-25603
Malware in sbrugna...
EUVD-2009-0226
Malware in sbrugna...
EUVD-2009-4420
Malware in sbrugna...