NodeGoat

NodeGoat Being lightweight, fast, and scalable, Node.js is becoming a widely adopted platform for developing web applications. This project provides an environment to learn how OWASP Top 10 security risks apply to web applications developed using Node.js and how to effectively address them. Getti...

pip3line

Pip3line Codacy Badge Linux / MacOS Builds Windows Builds Raw bytes manipulation utility, able to apply well known and less well known transformations, quick binary search, network proxy interception and more. Install on Windows: Download the release zip here Remember to install/repair the VS...

CVE-2026-126545

WWBN AVideo through 29.7.1 contains a missing authorization vulnerability in API::getapitags in plugin/API/API.php that allows registered users to access restricted video data by querying the tags API. Attackers can subscribe to a tag and query APIName=tags to obtain filenames, titles and stored...

CVE-2026-126545 WWBN AVideo through 29.7.1 Missing Authorization via get_api_tags API

WWBN AVideo through 29.7.1 contains a missing authorization vulnerability in API::getapitags in plugin/API/API.php that allows registered users to access restricted video data by querying the tags API. Attackers can subscribe to a tag and query APIName=tags to obtain filenames, titles and stored...

EUVD-2026-123070

WWBN AVideo through 29.7.1 contains a missing authorization vulnerability in API::getapitags in plugin/API/API.php that allows registered users to access restricted video data by querying the tags API. Attackers can subscribe to a tag and query APIName=tags to obtain filenames, titles and stored...

CVE-2026-126545

WWBN AVideo through 29.7.1 contains a missing authorization vulnerability in API::getapitags in plugin/API/API.php that allows registered users to access restricted video data by querying the tags API. Attackers can subscribe to a tag and query APIName=tags to obtain filenames, titles and stored...

CVE-2026-126545

The WWBN AVideo software (versions through 29.7.1 ) is susceptible to a missing authorization vulnerability in the API::get_api_tags() function within plugin/API/API.php. This flaw allows registered users to bypass restrictions by querying the tags API. By subscribing to a tag and querying APINam...

CVE-2026-126545 WWBN AVideo through 29.7.1 Missing Authorization via get_api_tags API

WWBN AVideo through 29.7.1 contains a missing authorization vulnerability in API::getapitags in plugin/API/API.php that allows registered users to access restricted video data by querying the tags API. Attackers can subscribe to a tag and query APIName=tags to obtain filenames, titles and stored...

CVE-2026-126545: WWBN AVideo: WWBN AVideo through 29.7.1 contains a missing authorization vulnerability in API::get_api_tags() in plugin/API/API.php…

WWBN AVideo through 29.7.1 contains a missing authorization vulnerability in API::getapitags in plugin/API/API.php that allows registered users to access restricted video data by querying the tags API. Attackers can subscribe to a tag and query APIName=tags to obtain filenames, titles and stored...

PT-2026-144924

WWBN AVideo through 29.7.1 contains a missing authorization vulnerability in API::get api tags in plugin/API/API.php that allows registered users to access restricted video data by querying the tags API. Attackers can subscribe to a tag and query APIName=tags to obtain filenames, titles and store...

CVE-2026-120322

A vulnerability was identified in Termix-SSH Termix up to 2.9.2. This issue affects some unknown processing of the file /plugin-api/file-manager/transferToHost. The manipulation of the argument destPath leads to path traversal. The attack may be initiated remotely. The exploit is publicly availab...

EUVD-2026-114924

A vulnerability was identified in Termix-SSH Termix up to 2.9.2. This issue affects some unknown processing of the file /plugin-api/file-manager/transferToHost. The manipulation of the argument destPath leads to path traversal. The attack may be initiated remotely. The exploit is publicly availab...

CVE-2026-120322 Termix-SSH Termix transferToHost path traversal

A vulnerability was identified in Termix-SSH Termix up to 2.9.2. This issue affects some unknown processing of the file /plugin-api/file-manager/transferToHost. The manipulation of the argument destPath leads to path traversal. The attack may be initiated remotely. The exploit is publicly availab...

CVE-2026-120322: Termix-SSH Termix: A vulnerability was identified in Termix-SSH Termix up to 2.9.2

A vulnerability was identified in Termix-SSH Termix up to 2.9.2. This issue affects some unknown processing of the file /plugin-api/file-manager/transferToHost. The manipulation of the argument destPath leads to path traversal. The attack may be initiated remotely. The exploit is publicly availab...

PT-2026-135254

A vulnerability was identified in Termix-SSH Termix up to 2.9.2. This issue affects some unknown processing of the file /plugin-api/file-manager/transferToHost. The manipulation of the argument destPath leads to path traversal. The attack may be initiated remotely. The exploit is publicly availab...

Obsidian-tc: Default Folder ACL Is Fail-open; .obsidian Plugin Secrets Are Readable By Default

Impact With a default configuration, an undefined "readPaths"/"writePaths" meant allow-all, the "strictReadDefault" flag was inert, and the ".obsidian"/".git"/".trash" control directories were denied only during enumeration — not on the direct request path. A caller could read...

obsidian-tc: Default folder ACL is fail-open; .obsidian plugin secrets are readable by default

Impact With a default configuration, an undefined readPaths/writePaths meant allow-all, the strictReadDefault flag was inert, and the .obsidian/.git/.trash control directories were denied only during enumeration — not on the direct request path. A caller could read .obsidian/plugins//data.json,...

GHSA-CVP8-VVGF-69Q4 obsidian-tc: Default folder ACL is fail-open; .obsidian plugin secrets are readable by default

Impact With a default configuration, an undefined readPaths/writePaths meant allow-all, the strictReadDefault flag was inert, and the .obsidian/.git/.trash control directories were denied only during enumeration — not on the direct request path. A caller could read .obsidian/plugins//data.json,...

CVE-2026-112188

MISP contains a vulnerability in its server settings lookup mechanism that allows an authenticated user to retrieve sensitive configuration data that should have been redacted. The settings lookup function resolves a dotted setting name to a node in the configuration tree. When a branch name such...

CVE-2026-112188: Exposure of Sensitive Information to an Unauthorized Actor

MISP contains a vulnerability in its server settings lookup mechanism that allows an authenticated user to retrieve sensitive configuration data that should have been redacted. The settings lookup function resolves a dotted setting name to a node in the configuration tree. When a branch name such...