112426 matches found
CVE-2026-105633
The open-source project management tool Plane is vulnerable to an authorization bypass in the V2 issue-attachment PATCH endpoint prior to version 1.4.0 . The root cause is that the server accepts an issue_id in the URL but fails to include it in the database query, matching only on pk, workspace,...
CVE-2026-105633 Plane: Issue Attachment Ownership Hijacking via Missing `issue_id` Scope
Plane is an open-source project management tool. Prior to 1.4.0, the V2 issue-attachment PATCH endpoint accepts issueid in the URL but omits it from the database query. A project member can use an issueid they control in the URL while targeting another user's attachment by its pk UUID. Because th...
CVE-2026-105633 Plane: Issue Attachment Ownership Hijacking via Missing `issue_id` Scope
Plane is an open-source project management tool. Prior to 1.4.0, the V2 issue-attachment PATCH endpoint accepts issueid in the URL but omits it from the database query. A project member can use an issueid they control in the URL while targeting another user's attachment by its pk UUID. Because th...
CVE-2025-1307
ثغرة نيوسكرانش CVE-2025-1307 🚨 نظرة عامة يستهدف هذا الاستغلال ثغرة حرجة CVE-2025-1307 في قالب نيوسكرانش لووردبريس. يسمح الخلل للمستخدمين المُوثَّقين من مستوى المشترك فما فوق برفع ملفات عشوائية بسبب عدم وجود فحوصات الصلاحية في دالة newscrunchinstallandactivateplugin. يمكن أن يؤدي ذلك إلى تنفيذ أكو...
CVE-2026-104978 Plane: Invitation Hijack in Project Join Flow via Missing Authorization and Email-Only Acceptance
Plane is an open-source project management tool. Prior to 1.4.0, Plane's project invitation list endpoint is accessible to any authenticated user who knows the workspace slug and project ID, while the public project invitation join endpoint accepts an invitation based only on a submitted email...
CVE-2026-104978
The open-source project management tool Plane is vulnerable to an invitation hijack prior to version 1.4.0 . The project invitation list endpoint lacks proper authorization, allowing any authenticated user who knows the workspace slug and project ID to access it. An attacker can enumerate pending...
CVE-2026-104978 Plane: Invitation Hijack in Project Join Flow via Missing Authorization and Email-Only Acceptance
Plane is an open-source project management tool. Prior to 1.4.0, Plane's project invitation list endpoint is accessible to any authenticated user who knows the workspace slug and project ID, while the public project invitation join endpoint accepts an invitation based only on a submitted email...
CVE-2026-104978 Plane: Invitation Hijack in Project Join Flow via Missing Authorization and Email-Only Acceptance
Plane is an open-source project management tool. Prior to 1.4.0, Plane's project invitation list endpoint is accessible to any authenticated user who knows the workspace slug and project ID, while the public project invitation join endpoint accepts an invitation based only on a submitted email...
CVE-2026-46455
CVE-2026-46455 — camel-keycloak : vérification ISACTIVE manquante jetons expirés acceptés Reproducteurs de preuve de concept exécutables pour la même vulnérabilité Apache Camel, un par environnement d'exécution : Environnement| Répertoire| Pile ---|---|--- Camel Spring Boot| camel-spring-boot/|...
SiYuan: /history/*path and /repo/diff/*path potentially exposing historical snapshots of data/.siyuan/publishAccess.json and data/templates/*
Summary GHSA-c8r8-95hg-mp34 added a centralized guard, util.IsForbiddenAbsPath, specifically to block access to a small set of sensitive files: conf/conf.json plaintext accessAuthCode/API token/cookie key, data/snippets/conf.json, the entire data/templates/ directory, and...
GHSA-3CM4-CCVW-6XR6 SiYuan: /history/*path and /repo/diff/*path potentially exposing historical snapshots of data/.siyuan/publishAccess.json and data/templates/*
Summary GHSA-c8r8-95hg-mp34 added a centralized guard, util.IsForbiddenAbsPath, specifically to block access to a small set of sensitive files: conf/conf.json plaintext accessAuthCode/API token/cookie key, data/snippets/conf.json, the entire data/templates/ directory, and...
CVE-2026-5865
Ce depot n’a pas de fichier README...
CVE-2026-3910
Ce depot n’a pas de fichier README...
CVE-2026-104971
The open-source project management tool Plane contains multiple authorization vulnerabilities affecting versions prior to 1.4.0 . The DuplicateAssetEndpoint fails to restrict FileAsset fetching to the caller's workspace, enabling cross-workspace asset duplication . Additionally, WorkspaceFileAsse...
CVE-2026-104971 Plane: Cross-Workspace Asset Duplication IDOR + WorkspaceFileAssetEndpoint and FileAssetEndpoint Missing Authorization
Plane is an open-source project management tool. Prior to 1.4.0, DuplicateAssetEndpoint fetches a source FileAsset without limiting it to the caller's workspace, allowing cross-workspace asset duplication. WorkspaceFileAssetEndpoint and the legacy FileAssetEndpoint omit workspace authorization,...
RCE
لا يحتوي هذا المستودع على ملف README...
CVE-2026-31694-POC
CVE-2026-31694: تجاوز كتابة خارج الحدود في ذاكرة التخزين المؤقت لـ readdir في FUSE خلل في التحقق من الحدود في fs/fuse/readdir.c:fuseadddirenttocache. يُرجع خادم FUSE اتجاهًا بقيمة namelen = 4095، والذي يُسلسل إلى سجل بحجم 4120 بايت. تنسخه النواة إلى صفحة واحدة بحجم 4096 بايت من ذاكرة التخزين المؤ...
cve-2017-12615
لا يحتوي هذا المستودع على ملف README...
CVE-2026-104963 Plane: Workspace cycle and module endpoints missing project-membership filter expose private project metadata to any workspace member
Plane is an open-source project management tool. Prior to 1.4.0, GET /api/workspaces/slug/cycles/ through WorkspaceCyclesEndpoint and GET /api/workspaces/slug/modules/ through WorkspaceModulesEndpoint return records from every project in a workspace without checking whether the requester belongs ...