CVE-2026-104971 Plane: Cross-Workspace Asset Duplication IDOR + WorkspaceFileAssetEndpoint and FileAssetEndpoint Missing Authorization

Plane is an open-source project management tool. Prior to 1.4.0, DuplicateAssetEndpoint fetches a source FileAsset without limiting it to the caller's workspace, allowing cross-workspace asset duplication. WorkspaceFileAssetEndpoint and the legacy FileAssetEndpoint omit workspace authorization,...

CVE-2026-104971

The open-source project management tool Plane contains multiple authorization vulnerabilities affecting versions prior to 1.4.0 . The DuplicateAssetEndpoint fails to restrict FileAsset fetching to the caller's workspace, enabling cross-workspace asset duplication . Additionally, WorkspaceFileAsse...

RCE

Questo repository non contiene un README...

CVE-2026-31694-POC

CVE-2026-31694: scrittura fuori dai limiti nella cache readdir di FUSE Un controllo dei limiti mancante in fs/fuse/readdir.c:fuseadddirenttocache. Un server FUSE restituisce un dirent con namelen = 4095, che viene serializzato in un record di 4120 byte. Il kernel lo copia in una singola pagina di...

cve-2017-12615

Questo repository non contiene un README...

CVE-2026-104963 Plane: Workspace cycle and module endpoints missing project-membership filter expose private project metadata to any workspace member

Plane is an open-source project management tool. Prior to 1.4.0, GET /api/workspaces/slug/cycles/ through WorkspaceCyclesEndpoint and GET /api/workspaces/slug/modules/ through WorkspaceModulesEndpoint return records from every project in a workspace without checking whether the requester belongs ...

CVE-2020-0022

Dieses Repository hat keine README-Datei...

CVE-2026-104961 Plane: WorkspaceOwnerPermission missing is_active check allows deactivated users to retain owner access

Plane is an open-source project management tool. Prior to 1.4.0, WorkspaceOwnerPermission does not require isactive=True when checking whether a user is a workspace owner. A deactivated user can therefore remain authorized as the workspace owner and retain owner-level access. This issue is fixed ...

CVE-2026-104961

The open-source project management tool Plane is vulnerable to an incorrect authorization issue (CWE-863) prior to version 1.4.0 . The WorkspaceOwnerPermission check fails to verify if a user's is_active status is set to True. Consequently, a deactivated user can retain owner-level access to a wo...

CVE-2026-104961 Plane: WorkspaceOwnerPermission missing is_active check allows deactivated users to retain owner access

Plane is an open-source project management tool. Prior to 1.4.0, WorkspaceOwnerPermission does not require isactive=True when checking whether a user is a workspace owner. A deactivated user can therefore remain authorized as the workspace owner and retain owner-level access. This issue is fixed ...

CVE-2020-3580

Dieses Repository hat keine README-Datei...

SNP

Questo repository non contiene un README...

PoC-for-CVE-2021-38540-

CVE-2021-38540 Prova di concetto Autenticazione mancante su un componente critico noto come CVE-2021-38540 Informazioni su questo bug: L'endpoint di importazione delle variabili non era protetto da autenticazione in Airflow =2.0.0, =2.0.0, variables List Variables Sorgente della PoC: POST...

CVE-2026-48558

CVE-2026-48558: Bypass dell'autenticazione OIDC di SimpleHelp !WARNING Questo codice è fornito COSÌ COM'È solo a scopo educativo e di ricerca. Non utilizzare questo PoC su sistemi di produzione, ambienti condivisi o bersagli non autorizzati. Questo exploit dimostra una vulnerabilità critica di...

NotCVE-2026-0010

Zusammenfassung Schwachstelle: Nicht authentifizierte lokale IPC-Privilegienerweiterung auf SYSTEM über den Barrier-Daemon-TCP-Port 24801 Anbieter: debauchee Barrier-Projekt Produkt: Barrier 2.4.0 finale Version, 2021-11-01 CWE: CWE-306: Fehlende Authentifizierung für kritische Funktion...

CVE-2023-4800

CVE-ID: CVE-2023-4800 Schwachstellentyp: Offenlegung sensibler Daten Beschreibung: Das DoLogin Security Plugin für WordPress ist anfällig für nicht autorisierten Zugriff auf Daten aufgrund einer fehlenden Berechtigungsprüfung im Dashboard-Widget in Versionen bis einschließlich 3.7. Dies ermöglich...

CVE-2026-56164-EXP

Microsoft SharePoint Server Erhöhung von Berechtigungen - CVE-2026-56164 Funktionaler unauthentifizierter EOP-Exploit. Übersicht Fehlende Authentifizierung für kritische Funktionen CWE-306 in Benutzerprofil- und Websitesammlungs-Endpunkten von SharePoint Server. Ermöglicht es entfernten Angreifer...

ghostlock-honor-aak-probe

Dieses Repository hat keine README-Datei...

bloodit

Dieses Repository hat keine README-Datei...

spring-retry-toolkit

This project provides declarative retry support for Spring applications. It is used in Spring Batch, Spring Integration, and others. Imperative retry is also supported for explicit usage. Version The version fix spring-retry with 2.0.13 for java8 and spring4 or spring5, For more information, plea...