Acronis cPanel Backup Plugin Vulnerability Exploited in Targeted Attacks

Acronis has warned that a high-severity security flaw in its Backup plugin for cPanel and Web Host Manager WHM deployments has been exploited in the wild. The vulnerability, tracked as CVE-2026-87886 CVSS score: 7.8, is described as a case of local privilege escalation due to insecure file...

CVE-2025-57392

CVE-2025-57392 🔒 Security Vulnerability Report Product: BenimPOS Desktop V3.0 Vulnerability Type: Insecure File Permissions Affected Components: BenimPOS.exe, unins000.exe, System.Data.SQLite.dll Vulnerability Class: CWE-276: Incorrect Default Permissions Proof of Concept by: Fatih Bülbül Test...

CVE-2026-79708

GitLab has remediated an issue in GitLab EE affecting all versions from 19.0 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that, under certain conditions could have allowed an authenticated user with developer permissions to execute a policy test pipeline on projects within their grou...

EUVD-2026-80221

GitLab has remediated an issue in GitLab EE affecting all versions from 19.0 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that, under certain conditions could have allowed an authenticated user with developer permissions to execute a policy test pipeline on projects within their grou...

CVE-2026-76555

The WP Import Export Lite WordPress plugin (versions before 3.9.33 ) contains an authenticated sensitive file disclosure vulnerability via path traversal in its existing file import functionality. A user with the plugin's import permission (typically granted by an administrator) can supply an unv...

CVE-2022-22296

CVE-2022-22296 All Details about CVE-2022-22296 Software: Hospital's Patient Records Management System 1.0 Software Link: https://www.sourcecodester.com/php/15116/hospitals-patient-records-management-system-php-free-source-code.html Vulnerability Type: Insecure Permissions - IDOR Affected...

CVE-2020-24028

CVE-2020-24028 Description ForLogic Qualiex v1 and v3 allows any authenticated customer to achieve privilege escalation via user creations, password changes, or user permission updates. Important Dates Announcement to Vendor: 2020-07-12 Public disclosure date: 2020-08-31 Vulnerability Type Insecu...

Acronis Backup Incorrect Default Permissions Vulnerability

Acronis Backup plugin for cPanel & WHM and extension for Plesk contains an incorrect default permissions vulnerability that could allow for privilege escalation...

CVE-2020-14066

CVE-2020-14066 Icewarp Email Server 12.3.0.1 insecurepermissions https://nvd.nist.gov/vuln/detail/CVE-2020-14066...

CVE-2026-18426

Concrete CMS versions 9.0.0 through 9.5.2 contained an authorization flaw in the Express Form block 's control-management actions. The actions relied solely on CSRF token validation rather than a block-level edit-permission check. Because the token is bound to the user and action—not to a specifi...

CVE-2021-39273-CVE-2021-39274

CVE-2021-39273 In XeroSecurity Sn1per 9.0 free version, insecure permissions 0777 are set upon application execution, allowing an unprivileged user to modify the application, modules, and configuration files. This leads to arbitrary code execution with root privileges. CVE-2021-39274 In...

CVE-2026-55226

Strimzi provides a way to run an Apache Kafka cluster on Kubernetes or OpenShift in various deployment configurations. In Strimzi 1.0.0 and earlier, deploying only the Topic Operator or only the User Operator through the Kafka custom resource leaves the Entity Operator ServiceAccount with RBAC...

CVE-2026-55226 Strimzi: Unrestricted access to all Secrets within namespace watched by the Topic operator

Strimzi provides a way to run an Apache Kafka cluster on Kubernetes or OpenShift in various deployment configurations. In Strimzi 1.0.0 and earlier, deploying only the Topic Operator or only the User Operator through the Kafka custom resource leaves the Entity Operator ServiceAccount with RBAC...

ACEshark

ACEshark 무엇인가? ACEshark는 Windows 서비스 구성 및 Access Control Entries를 신속하게 추출하고 분석하기 위해 설계된 유틸리티로, accesschk.exe 또는 기타 비-네이티브 바이너리 같은 도구가 필요 없습니다. 왜? 서비스 권한을 효율적으로 식별하고 분석하여 잠재적 권한 상승 벡터를 찾아냅니다서비스의 binpath를 변경하고 다시 시작. 특정 사용자 또는 모든 그룹 및 계정에 대한 서비스 권한을 감사합니다. 작동 방식 ACEshark를 실행하면 HTTP/HTTPS 서버가 시작되어 서...

CVE-2026-61549 Woodpecker: Privilege escalation via unrestricted serviceAccountName in the Kubernetes backend

Woodpecker is a CI/CD engine. From 1.0.0 until 3.16.0, pipeline/backend/kubernetes/backendoptions.go defines backendoptions.kubernetes.serviceAccountName, and the Kubernetes backend in pipeline/backend/kubernetes/pod.go copies that pipeline-step value directly into the pod specification without...

CVE-2025-47962-POC

CVE-2025-47962-POC Reproduction process： i686-w64-mingw32-gcc -shared -o CRYPTBASE.dll poc.c -lkernel32 copy CRYPTBASE.dll "C:\Microsoft Shared\Phone Tools\CoreCon\11.0\bin\CRYPTBASE.dll" net stop IpOverUsbSvc net start IpOverUsbSvc Explanation： IpOverUsbSvc root@kitploit: sc.exe qc IpOverUsbSvc...

CVE-2026-48722 Nextflow: Incorrect default permissions in the nextflow auth login command

Nextflow is a DSL for data-driven computational pipelines. From 25.09.2-edge until 25.10.6 and 26.04.3, nextflow auth login writes Seqera Platform OIDC bearer tokens to $NXFHOME:-/.nextflow/seqera-auth.config through AuthCommandImpl.writeConfig in...

CVE-2026-48722

Nextflow (a DSL for data-driven computational pipelines) contains an incorrect default permissions flaw (CWE-276) in the nextflow auth login command. The Seqera Platform OIDC bearer token is written to ${NXF_HOME:-~/.nextflow}/seqera-auth.config via Java NIO without setting restrictive file permi...

CVE-2026-1759

An improper handling of insufficient permissions or privileges vulnerability in Secomea GateManager allows privilege escalation . The affected versions are 11.5 and 11.4.625515072 . The issue is fixed in version 11.6 or 11.4.626194074 and above. The CVSS 3.1 score is 6.5 (Medium) with a network a...

AndroidSecurityEvolution

Android 보안 발전 Android 5.0 LollipopAPI 21부터 시작하는 최근 주요 Android 버전의 주요 보안 강화 사항. Android 5.0 API 21 - Lollipop 보안 강화 - Android 5 2023년 8월부터 Google Play 서비스 업데이트는 이 Android 버전에서만 수신됩니다. Google Play 서비스가 2023년 8월부터 KitKatAPI 레벨 19 및 20 업데이트를 중단합니다 참조 기본적으로 전체 디스크 암호화FDE 적용제조사가 선택 해제할 수 있음. 암호화 및...