rustcat

rustcat - The modern port listener and reverse shell What is Rustcat Rustcat is an easy to use port listener and reverse shell for Linux, MacOS, and Windows aimed to be easy to use and accessible. Modes Listen mode listen; Reverse shell mode connect; Features Command history & Tab completion...

CVE-2026-121558: Ricky-7-Yan intelligent-audit-system: AuditPilot before commit 4669c93 contains an authorization bypass vulnerability in _metadata_allowed in…

AuditPilot before commit 4669c93 contains an authorization bypass vulnerability in metadataallowed in rag/agenticrag.py that allows authenticated users to read other projects' knowledge by supplying projectid. Attackers with read:knowledge scoped to one project can set context.projectid via GET...

cve-2026-59827-metabase-cyber-range

CVE-2026-59827 — Metabase / H2 Unsafe Deserialization Cyber Range Educational laboratory modeling CVE-2026-59827 GHSA-w95f-x9v9-wv36: unsafe deserialization of H2 query result columns of type OTHER in Metabase. TRAINING ONLY — DO NOT EXPOSE TO THE INTERNET Quick start git clone...

CVE-2026-119649

Orchard CMS 1.10.3 through 1.11 contains an improper authorization vulnerability in MediaLibraryService.CheckMediaFolderPermission that allows authenticated Authors and Contributors to access other users' media. Attackers can display, clone, and delete other users' media items by content id and...

EUVD-2026-114065

Orchard CMS 1.10.3 through 1.11 contains an improper authorization vulnerability in MediaLibraryService.CheckMediaFolderPermission that allows authenticated Authors and Contributors to access other users' media. Attackers can display, clone, and delete other users' media items by content id and...

CVE-2026-119649

Orchard CMS versions 1.10.3 through 1.11 are vulnerable to an improper authorization flaw within the MediaLibraryService.CheckMediaFolderPermission() method. This vulnerability allows authenticated users with Author or Contributor roles to bypass permission checks and access media belonging to ot...

CVE-2026-119649 Orchard CMS 1.10.3 through 1.11 Improper Authorization via Media Library Folder Permission Check

Orchard CMS 1.10.3 through 1.11 contains an improper authorization vulnerability in MediaLibraryService.CheckMediaFolderPermission that allows authenticated Authors and Contributors to access other users' media. Attackers can display, clone, and delete other users' media items by content id and...

CVE-2026-119649 Orchard CMS 1.10.3 through 1.11 Improper Authorization via Media Library Folder Permission Check

Orchard CMS 1.10.3 through 1.11 contains an improper authorization vulnerability in MediaLibraryService.CheckMediaFolderPermission that allows authenticated Authors and Contributors to access other users' media. Attackers can display, clone, and delete other users' media items by content id and...

CVE-2026-119647: dromara RuoYi-Vue-Plus: RuoYi-Vue-Plus through 6.0.0 contains an authorization bypass vulnerability in SysUserServiceImpl.selectUserListByDept…

RuoYi-Vue-Plus through 6.0.0 contains an authorization bypass vulnerability in SysUserServiceImpl.selectUserListByDept that allows authenticated users to read users of other departments. Users holding system:user:list under a department-restricted role can request GET /system/user/list/dept/deptI...

CVE-2026-119649: OrchardCMS Orchard: Orchard CMS 1.10.3 through 1.11 contains an improper authorization vulnerability in…

Orchard CMS 1.10.3 through 1.11 contains an improper authorization vulnerability in MediaLibraryService.CheckMediaFolderPermission that allows authenticated Authors and Contributors to access other users' media. Attackers can display, clone, and delete other users' media items by content id and...

CVE-2026-119665: MGdaasLab WHartTest: WHartTest 2.2.0 through 2.8.1 contains a missing authorization vulnerability in ScheduledTaskViewSet and…

WHartTest 2.2.0 through 2.8.1 contains a missing authorization vulnerability in ScheduledTaskViewSet and TaskExecutionViewSet that allows authenticated users to access other projects' tasks. Attackers can set projectpk to another project's sequential ID to modify, delete, or trigger scheduled tas...

PT-2026-133772

NodeBB 1.18.0 through 4.16.5 contains an authorization bypass vulnerability that allows unauthenticated visitors to act on other accounts by supplying a uid during POST /register. Attackers can submit an empty email at the /register/complete interstitial to clear a victim's email and confirmation...

PT-2026-133579

Orchard CMS 1.10.3 through 1.11 contains an improper authorization vulnerability in MediaLibraryService.CheckMediaFolderPermission that allows authenticated Authors and Contributors to access other users' media. Attackers can display, clone, and delete other users' media items by content id and...

Jonas Kalderstam NoNonsense Notes Security Vulnerabilities

Jonas Kalderstam’s NoNonsense Notes has a security vulnerability stemming from insecure permissions in the NotificationHelper component. Unauthorized attackers can exploit this flaw by providing a note ID and writing to other users’ notes...

CVE-2026-117977

Other issue in the Console component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6...

EUVD-2026-111008

Other issue in the Console component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6...

CVE-2026-117977

This vulnerability affects the Console component in the Firefox web browser. While the specific root cause and practical consequences are not detailed in the provided documents, the issue was addressed in Firefox 159 and Firefox ESR 153.6 . No information regarding active exploitation or specific...

CVE-2026-117977 Other issue in the Console component

Other issue in the Console component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6...

CVE-2026-116017 Xiaozhi-esp32-server before 0.9.8 IDOR via device address-book endpoint

Xiaozhi-esp32-server before 0.9.8 contains an insecure direct object reference vulnerability in the manager-api DeviceController.getAddressBook handler that allows authenticated users to read other users' device address books. Attackers with a normal or self-registered account can request...

CVE-2026-113606 Stirling-PDF 3.0.0 through 3.2.0 Authorization Bypass via Processing Folders

Stirling-PDF 3.0.0 through 3.2.0 contains an authorization bypass vulnerability that allows authenticated users to access other users' stored files by pointing a processing folder at the server storage directory. Attackers can create a folder via POST /api/v1/processing-folders targeting storage/...