CVE-2021-45232-RCE

CVE-2021-45232-RCE CVE-2021-45232-RCE - Multi-threaded batch vulnerability detection FOFA Query title="Apache APISIX Dashboard" Affected Scope Apache APISIX Dashboard 2.10.1 POC: IP:PORT/apisix/admin/migrate/export If this helps, please give the author a star before you leave, thank you! Batch...

Craftcms-PoC-CVE-2026-31266

CVE-2026-31266 - Craft CMS Missing Authorization CVE Information Field| Value ---|--- CVE ID| CVE-2026-31266 Vendor| Pixel & Tonic Product| Craft CMS Affected Versions| self::ALLOWANONYMOUSLIVE | self::ALLOWANONYMOUSOFFLINE, ; Proof of Concept With allowAdminChanges=false curl -X POST...

CVE-2021-45232-RCE

CVE-2021-45232 CVE-2021-45232 Apache apisix Dashboard api unauth rce Version: 2.10.1 Fofa: title="Apache APISIX Dashboard" POC: IP:PORT/apisix/admin/migrate/export...

go-dbmigrate

migrate A migration helper written in Go. Use it in your existing Golang code or run commands via the CLI. GoCode import github.com/mattes/migrate/migrate CLI go get -u github.com/mattes/migrate Features Super easy to implement Driver interface. Gracefully quit running migrations on ^C. No magic...

CVE-2026-97054 vulnerabilities

Vulnerabilities for packages: hugo-extended, terraform-provider-kubernetes, maru, prometheus, nsc, verticadb-operator, wgcf, gitness, crossplane-provider-aws-memorydb, helm-operator, kubernetes-csi-driver-hostpath, delve, timestamp-authority, cluster-autoscaler, tempo, dive, ksops, chartmuseum,...

GO-2026-6859 vulnerabilities

Vulnerabilities for packages: hugo-extended, terraform-provider-kubernetes, maru, prometheus, nsc, verticadb-operator, wgcf, gitness, crossplane-provider-aws-memorydb, helm-operator, kubernetes-csi-driver-hostpath, delve, timestamp-authority, cluster-autoscaler, tempo, dive, ksops, chartmuseum,...

GHSA-RG98-F588-44XG vulnerabilities

Vulnerabilities for packages: hugo-extended, terraform-provider-kubernetes, maru, prometheus, nsc, verticadb-operator, wgcf, gitness, crossplane-provider-aws-memorydb, helm-operator, kubernetes-csi-driver-hostpath, delve, timestamp-authority, cluster-autoscaler, tempo, dive, ksops, chartmuseum,...

CVE-2026-123519

Vikunja before 2.7.1 contains a denial of service vulnerability that allows authenticated users to exhaust API process memory by uploading WeKan or vikunja-file imports with no item-count cap. Attackers can submit a 22 MB WeKan JSON with hundreds of thousands of cards or duplicate IDs to the weka...

CVE-2026-123519

Vikunja versions prior to 2.7.1 are vulnerable to a Memory Exhaustion Denial of Service (DoS) . The issue resides in the wekan migrate endpoint, which lacks an item-count cap when processing WeKan or vikunja-file imports. An authenticated attacker can crash the instance by submitting a large WeKa...

CVE-2026-123519 Vikunja before 2.7.1 Memory Exhaustion DoS via WeKan and Vikunja-File Imports

Vikunja before 2.7.1 contains a denial of service vulnerability that allows authenticated users to exhaust API process memory by uploading WeKan or vikunja-file imports with no item-count cap. Attackers can submit a 22 MB WeKan JSON with hundreds of thousands of cards or duplicate IDs to the weka...

EUVD-2026-119404

Vikunja before 2.7.1 contains a denial of service vulnerability that allows authenticated users to exhaust API process memory by uploading WeKan or vikunja-file imports with no item-count cap. Attackers can submit a 22 MB WeKan JSON with hundreds of thousands of cards or duplicate IDs to the weka...

CVE-2026-123519 Vikunja before 2.7.1 Memory Exhaustion DoS via WeKan and Vikunja-File Imports

Vikunja before 2.7.1 contains a denial of service vulnerability that allows authenticated users to exhaust API process memory by uploading WeKan or vikunja-file imports with no item-count cap. Attackers can submit a 22 MB WeKan JSON with hundreds of thousands of cards or duplicate IDs to the weka...

CVE-2026-123519: go-vikunja vikunja: Vikunja before 2.7.1 contains a denial of service vulnerability that allows authenticated users to exhaust API process…

Vikunja before 2.7.1 contains a denial of service vulnerability that allows authenticated users to exhaust API process memory by uploading WeKan or vikunja-file imports with no item-count cap. Attackers can submit a 22 MB WeKan JSON with hundreds of thousands of cards or duplicate IDs to the weka...

PT-2026-139800

Vikunja before 2.7.1 contains a denial of service vulnerability that allows authenticated users to exhaust API process memory by uploading WeKan or vikunja-file imports with no item-count cap. Attackers can submit a 22 MB WeKan JSON with hundreds of thousands of cards or duplicate IDs to the weka...

CVE-2026-118395

Gitea 1.27.3 stopped personal access tokens restricted to public resources public-only from creating repositories through POST /api/v1/user/repos and POST /api/v1/repos/migrate, but POST /api/v1/org/org/repos, POST /api/v1/orgs/org/repos, POST /api/v1/orgs and POST /api/v1/repos/owner/repo/genera...

CVE-2026-118395 Gitea public-only token bypass in repository and organization creation

Gitea 1.27.3 stopped personal access tokens restricted to public resources public-only from creating repositories through POST /api/v1/user/repos and POST /api/v1/repos/migrate, but POST /api/v1/org/org/repos, POST /api/v1/orgs/org/repos, POST /api/v1/orgs and POST /api/v1/repos/owner/repo/genera...

CVE-2026-118395

Gitea versions prior to 28.3.0 are vulnerable to a security bypass where personal access tokens restricted to public resources (public-only ) can still be used to create private resources. While the software stopped this behavior for certain routes (like POST /api/v1/user/repos), it remained acti...

CVE-2026-118395 Gitea public-only token bypass in repository and organization creation

Gitea 1.27.3 stopped personal access tokens restricted to public resources public-only from creating repositories through POST /api/v1/user/repos and POST /api/v1/repos/migrate, but POST /api/v1/org/org/repos, POST /api/v1/orgs/org/repos, POST /api/v1/orgs and POST /api/v1/repos/owner/repo/genera...

EUVD-2026-114803

Gitea 1.27.3 stopped personal access tokens restricted to public resources public-only from creating repositories through POST /api/v1/user/repos and POST /api/v1/repos/migrate, but POST /api/v1/org/org/repos, POST /api/v1/orgs/org/repos, POST /api/v1/orgs and POST /api/v1/repos/owner/repo/genera...

PT-2026-128180

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the Linux kernel where the perf pmu remove function incorrectly handles the removal of group leaders for a CPU and PMU. When using perf event groups for cpu pmu, the...