41274 matches found
GHSA-273Q-QGH5-WRJ6 nebula-mesh's web UI lacks CSRF tokens on /ui/* mutating endpoints
Every /ui/ POST / PUT / PATCH / DELETE route processes the request as soon as the session cookie validates. SameSite=Lax on the session cookie prevents most cross-site form submits but does not protect: - top-level form-submit navigations from third-party pages some browsers still send Lax cookie...
nebula-mesh's web UI lacks CSRF tokens on /ui/* mutating endpoints
Every /ui/ POST / PUT / PATCH / DELETE route processes the request as soon as the session cookie validates. SameSite=Lax on the session cookie prevents most cross-site form submits but does not protect: - top-level form-submit navigations from third-party pages some browsers still send Lax cookie...
coruna-postexploit
Coruna Post-Exploitation Framework Overview This is a com...
CVE-2026-44631
creationtimestamp| type| source ---|---|--- 2026-06-08 23:00:40+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mnsrxdvbsz27 2026-06-09 00:51:01+00:00| seen| https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-in-apache-http-server 2026-06-09 12:35:09+00:00| seen|...
CVE-2026-49141
creationtimestamp| type| source ---|---|--- 2026-06-08 21:04:32+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnsledm6gl2f...
CVE-2026-52778
creationtimestamp| type| source ---|---|--- 2026-06-08 20:00:38+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mnshvh27vg2y 2026-06-09 09:12:19+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3mntu5424d22s 2026-07-09 21:42:04+00:00| seen|...
CVE-2026-49141 WACRM Authorization Bypass via Automation Engine Endpoint
WACRM prior to commit 73041bf contain an authorization bypass vulnerability in the automation engine that allows authenticated attackers to access and modify contacts belonging to other tenants by supplying an arbitrary caller-controlled contactid in the POST request body without tenant ownership...
EUVD-2026-35194
WACRM prior to commit 73041bf contain an authorization bypass vulnerability in the automation engine that allows authenticated attackers to access and modify contacts belonging to other tenants by supplying an arbitrary caller-controlled contactid in the POST request body without tenant ownership...
CVE-2026-11697
creationtimestamp| type| source ---|---|--- 2026-06-08 18:00:00+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260609 2026-06-09 01:35:15+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnt2ls5wj626 2026-06-09 12:00:39+00:00| seen|...
CVE-2026-11701
creationtimestamp| type| source ---|---|--- 2026-06-08 18:00:00+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260609 2026-06-09 01:40:16+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnt2uqtw5s2a 2026-06-15 18:00:00+00:00| seen|...
CVE-2026-11684
creationtimestamp| type| source ---|---|--- 2026-06-08 18:00:00+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260609 2026-06-09 00:40:49+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnsxk3lvs52i 2026-06-15 18:00:00+00:00| seen|...
CVE-2026-49755
creationtimestamp| type| source ---|---|--- 2026-06-08 17:44:19+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnsabozbgi2a 2026-07-29 16:35:09+00:00| published-proof-of-concept| https://github.com/wojtekmach/req/security/advisories/GHSA-655f-mp8p-96gv...
CVE-2026-49756
creationtimestamp| type| source ---|---|--- 2026-06-08 17:34:18+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mns7prs24r2y 2026-07-29 16:35:07+00:00| published-proof-of-concept| https://github.com/wojtekmach/req/security/advisories/GHSA-px9f-whj3-246m...
CVE-2026-46274
creationtimestamp| type| source ---|---|--- 2026-06-08 16:55:08+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mns5jr2z2a2r 2026-07-01 02:34:26+00:00| seen| https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities20260630 2026-08-03 08:01:05+00:00| seen...
EUVD-2026-35136
OpenMetadata is a unified metadata platform. Prior to version 1.12.4, a non-admin SSO user can trigger a TESTCONNECTION workflow for a Database Service and receive, in the HTTP 201 response of POST /api/v1/automations/workflows, both the cleartext database password in...
CVE-2014-2855
creationtimestamp| type| source ---|---|--- 2026-06-08 16:20:55+00:00| seen| https://bsky.app/profile/ryan.m29.us.ap.brid.gy/post/3mns3k6sk7kx2...
CVE-2026-46442 Flowise: Authenticated Host RCE via POST /api/v1/node-custom-function and NodeVM Sandbox Escape
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.1.2, POST /api/v1/node-custom-function lacks route-level authorization, allowing any authenticated user or API key to submit arbitrary JavaScript to the Custom JS Function node. When...
Critical Check Point VPN Flaw Exploited to Bypass Passwords in IKEv1 Setups
Check Point has warned of active exploitation of a critical vulnerability impacting Remote Access VPN and Mobile Access deployments that are configured to use the deprecated IKEv1 key exchange protocol. The vulnerability, tracked as CVE-2026-50751 CVSS score: 9.3, is a case of a logic flow weakne...