kalici-dosya-silme-araci

Permanent File Deletion Tool & Kalıcı Dosya Silme Aracı This project is a simple tool that allows users to permanently delete specified files. The program overwrites the specified file with random data, changes the content of the file, and then deletes it, effectively removing any traces of the...

CVE-2026-115871

The WP STAGING – Backups & Restore, Migration & Clone Plugin – Cloud Backups, Scheduled Backups plugin for WordPress is vulnerable to Arbitrary Directory Deletion in all versions up to, and including, 4.19.0. This is due to insufficient path validation in the cleanStagingDirectory function, where...

CVE-2023-5044

CVE-2023-5044 Code injection via nginx.ingress.kubernetes.io/permanent-redirect annotation Firstly, you need deploy Pod & Service: kind: Pod apiVersion: v1 metadata: name: apple-app labels: app: apple spec: containers: - name: apple-app image: hashicorp/http-echo args: - "-text=apple" --- kind:...

EUVD-2026-123197

The Photo Engine Media Organizer & Lightroom WordPress plugin before 6.6.2 does not check that a user may delete the media in a collection before deleting it along with the collection, allowing users with the Author role and above to permanently delete other users' synced media, including...

PT-2026-145039

The Security For WooCommerce WordPress plugin through 1.0.16 does not check that the requester is authorised before running several of its comment cleanup actions, allowing unauthenticated users to permanently delete all comments on the site, including approved ones and WooCommerce order notes...

CVE-2026-123700: Unknown Security For WooCommerce: The Security For WooCommerce WordPress plugin through 1.0.16 does not check that the requester is authorised before…

The Security For WooCommerce WordPress plugin through 1.0.16 does not check that the requester is authorised before running several of its comment cleanup actions, allowing unauthenticated users to permanently delete all comments on the site, including approved ones and WooCommerce order notes...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-151094)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-151094 advisory. In the Linux kernel, the following vulnerability has been resolved: NFSv4.2: fix LAYOUTSTATS send buffer exhaustion encodelayoutstatsmaxsz budgets...

CVE-2026-119759

TrailBase 0.28.2 before 0.35.10 contains an insecure direct object reference in std.FileUpload columns, where the Record API accepts attacker-supplied object-store file ids on insert and update without ownership validation. An authenticated attacker who can read a victim’s row can recover its...

CVE-2026-119759

TrailBase versions 0.28.2 through 0.35.10 are affected by an insecure direct object reference (IDOR) vulnerability. The root cause is a lack of ownership validation when manipulating object-store id metadata within std.FileUpload columns during insert and update operations. Authenticated attacker...

Astra Linux – vulnerability in linux-6.1, linux-6.12, linux-6.18

In the Linux kernel, the following vulnerability has been resolved: NFSv4.2: fix LAYOUTSTATS send buffer exhaustion encodelayoutstatsmaxsz sets XDRQUADLENPNFSLAYOUTSTATSMAXSIZE to 256 bytes for the layout update4 body written by the layout driver. The flexfiles record can exceed this limit...

CVE-2026-121545

Dreeve before 5.8.0 contains a missing authentication vulnerability in StravaWebhookRequestHandler::handleEvent that allows unauthenticated attackers to forge Strava webhook events without signature, verify-token or ownerid checks. Attackers can send forged delete events with a known public Strav...

CVE-2026-121545

Dreeve versions prior to 5.8.0 are vulnerable to a missing authentication flaw in the StravaWebhookRequestHandler::handleEvent component. The root cause is the failure to perform necessary signature , verify-token , or owner_id checks. This allows unauthenticated attackers to forge Strava webhook...

CVE-2026-121545 Dreeve before 5.8.0 Missing Authentication in Strava Webhook POST Handler

Dreeve before 5.8.0 contains a missing authentication vulnerability in StravaWebhookRequestHandler::handleEvent that allows unauthenticated attackers to forge Strava webhook events without signature, verify-token or ownerid checks. Attackers can send forged delete events with a known public Strav...

EUVD-2026-115890

Dreeve before 5.8.0 contains a missing authentication vulnerability in StravaWebhookRequestHandler::handleEvent that allows unauthenticated attackers to forge Strava webhook events without signature, verify-token or ownerid checks. Attackers can send forged delete events with a known public Strav...

CVE-2026-121545

Dreeve before 5.8.0 contains a missing authentication vulnerability in StravaWebhookRequestHandler::handleEvent that allows unauthenticated attackers to forge Strava webhook events without signature, verify-token or ownerid checks. Attackers can send forged delete events with a known public Strav...

CVE-2026-121545 Dreeve before 5.8.0 Missing Authentication in Strava Webhook POST Handler

Dreeve before 5.8.0 contains a missing authentication vulnerability in StravaWebhookRequestHandler::handleEvent that allows unauthenticated attackers to forge Strava webhook events without signature, verify-token or ownerid checks. Attackers can send forged delete events with a known public Strav...

CVE-2026-121545: robiningelbrecht dreeve: Dreeve before 5.8.0 contains a missing authentication vulnerability in StravaWebhookRequestHandler::handleEvent that…

Dreeve before 5.8.0 contains a missing authentication vulnerability in StravaWebhookRequestHandler::handleEvent that allows unauthenticated attackers to forge Strava webhook events without signature, verify-token or ownerid checks. Attackers can send forged delete events with a known public Strav...

CVE-2026-119441

DELETE /api/v1/orgs/org/repos deletes all repositories of an organization, but it did not enforce the public-only restriction of access tokens: the route only checked that the organization itself was public. A public-only token of an owner of a public organization could therefore permanently dele...

EUVD-2026-114805

DELETE /api/v1/orgs/org/repos deletes all repositories of an organization, but it did not enforce the public-only restriction of access tokens: the route only checked that the organization itself was public. A public-only token of an owner of a public organization could therefore permanently dele...

CVE-2026-119441: Gitea: `DELETE /api/v1/orgs/{org}/repos` deletes all repositories of an organization, but it did not enforce the public-only…

DELETE /api/v1/orgs/org/repos deletes all repositories of an organization, but it did not enforce the public-only restriction of access tokens: the route only checked that the organization itself was public. A public-only token of an owner of a public organization could therefore permanently dele...