CVE-2026-78387 RansomLook Missing Authorization in Web Configuration Editor Allows Application Configuration Modification

RansomLook contains an authorization weakness in the web-based configuration editor exposed through the /admin/config endpoint. The endpoint requires an authenticated session but does not perform an explicit privilege or administrator authorization check before allowing access to...

CVE-2017-5415

Questo repository non contiene un README...

CVE-2021-1931-BBRY-KEY2

Questo repository non contiene un README...

CVE-2026-74596

A flaw was found in the Linux kernel's fsverity subsystem. The vulnerability is due to the removal of a check in the setattrprepare function, which previously verified if fs-verity was enabled. This change allows fsverity files to be truncated even when the fs-verity feature is not active on the...

CVE-2026-76847 act 0.2.81 through 0.2.89 Missing Authorization in the Artifacts V4 Backend

act starts an HTTP Artifacts V4 backend whenever a workflow uses actions/upload-artifact@v4 or actions/download-artifact@v4. The control-plane RPCs of that backend, including CreateArtifact, GetSignedArtifactURL, ListArtifacts, FinalizeArtifact and DeleteArtifact, accept a caller-supplied...

CVE-2026-76847 act 0.2.81 through 0.2.89 Missing Authorization in the Artifacts V4 Backend

act starts an HTTP Artifacts V4 backend whenever a workflow uses actions/upload-artifact@v4 or actions/download-artifact@v4. The control-plane RPCs of that backend, including CreateArtifact, GetSignedArtifactURL, ListArtifacts, FinalizeArtifact and DeleteArtifact, accept a caller-supplied...

EUVD-2026-64848

The Mercado Pago Node.js SDK interpolates caller-supplied identifiers into API request paths without percent-encoding them, so characters that are structural in a URL survive into the outgoing request. The payment get, capture, cancel, paymentRefund create, total, list, get, advancedPayment get,...

CVE-2026-78372 RansomLook Missing Authorization Allows Disclosure of Private Group and Ransom Note Data

RansomLook does not consistently enforce authorization checks when accessing groups, markets, and ransom notes marked as private. An unauthenticated or otherwise unauthorized remote attacker can access information associated with private entities through several web views and API endpoints. The...

CVE-2026-78372 RansomLook Missing Authorization Allows Disclosure of Private Group and Ransom Note Data

RansomLook does not consistently enforce authorization checks when accessing groups, markets, and ransom notes marked as private. An unauthenticated or otherwise unauthorized remote attacker can access information associated with private entities through several web views and API endpoints. The...

CVE-2026-78369 Missing Authentication Allows Unauthorized Creation of Crypto Groups in RansomLook

RansomLook contains a missing authentication vulnerability in the /admin/crypto/group/new endpoint. While the endpoint provides an administrative function for creating new crypto group entries, it was not protected by the application's authentication mechanism. An unauthenticated remote attacker...

CVE-2026-78369

RansomLook contains a missing authentication vulnerability in the /admin/crypto/group/new endpoint. Although this endpoint provides an administrative function for creating new crypto group entries, it was not protected by the application's authentication mechanism. An unauthenticated remote attac...

EUVD-2026-64841

RansomLook contains a missing authentication vulnerability in the /admin/crypto/group/new endpoint. While the endpoint provides an administrative function for creating new crypto group entries, it was not protected by the application's authentication mechanism. An unauthenticated remote attacker...

CVE-2026-78369 Missing Authentication Allows Unauthorized Creation of Crypto Groups in RansomLook

RansomLook contains a missing authentication vulnerability in the /admin/crypto/group/new endpoint. While the endpoint provides an administrative function for creating new crypto group entries, it was not protected by the application's authentication mechanism. An unauthenticated remote attacker...

RIUS

Dieses Repository hat keine README-Datei...

CVE-2026-74733

A flaw was found in the Linux kernel's gpio: pca953x driver, which manages General Purpose Input/Output GPIO expanders. The driver uses its own locking mechanism, but the pca953xirqbussyncunlock function failed to acquire the necessary lock when performing register operations. This oversight coul...

CVE-2025-26206

🚨 CVE-2025-26206: Cross-Site Request Forgery CSRF in Sell Done Storefront v.1.0 Benvenuti nel repository ufficiale che documenta la scoperta e i dettagli della CVE-2025-26206 , una critica vulnerabilità di Cross-Site Request Forgery CSRF in Sell Done Storefront v.1.0. Scoperta da B. Sibhi , quest...

CVE-2026-74646

A flaw was found in the Linux kernel's fastrpc subsystem. When an invoke operation is interrupted by a signal, the fastrpcinternalinvoke function moves memory mappings without properly holding the fl-lock. This missing lock during memory map manipulation creates a race condition, which could lead...

CVE-2025-6934

Questo repository non contiene un README...

CVE-2026-74649

A flaw was found in the Linux kernel's rtl8723bs driver. A remote attacker, by operating a malicious Access Point AP, could send a specially crafted Wi-Fi Protected Equivalent Privacy WEP shared-key authentication challenge. This could lead to an out-of-bounds write or information disclosure due ...

CVE-2026-6017 Missing Authentication for Critical Function in KAON PG5298

Firmware in KAON PG5298A and PG5298B routers allow an unauthenticated user to query a specific endpoint and acquire sensitive information such as a password to the administrative portal. This vulnerability has been fixed in firmware version: 3.0.82 for PG5298A and 4.0.82 for PG5298B...