560 matches found
onedrive_user_enum
onedriveuserenum v2.10 enumerate valid onedrive users For a full rundown of the enumeration technique and OneDrive enum, check out the blog here: https://www.trustedsec.com/blog/onedrive-to-enum-them-all/ If you are looking for the old, non-database vesion of OneDrive Enum, you can find it here:...
Astra Linux – Vulnerability in Chromium
Inappropriate implementation in DevTools in Google Chrome prior to 118.0.5993.70 allowed an attacker who convinced a user to install a malicious extension to bypass discretionary access control via a crafted Chrome Extension. Chromium security severity: Medium...
PT-2026-90401
Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.2.6-1.1 Description A clock domain mismatch exists in the clients still reclaiming function. The function calculates a deadline using nn-boot time based on CLOCK REALTIME but compares it against ktime get...
CVE-2026-73646
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.18, lib/previous-map.js loadMap passes attacker-controlled sourceMappingURL values to joindirnameopts.from, annotation, and loadFile permits traversed ...
EUVD-2026-60239
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.18, lib/previous-map.js loadMap passes attacker-controlled sourceMappingURL values to joindirnameopts.from, annotation, and loadFile permits traversed ...
CVE-2026-73646 PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.18, lib/previous-map.js loadMap passes attacker-controlled sourceMappingURL values to joindirnameopts.from, annotation, and loadFile permits traversed ...
CVE-2026-73646
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.18, lib/previous-map.js loadMap passes attacker-controlled sourceMappingURL values to joindirnameopts.from, annotation, and loadFile permits traversed ...
CVE-2026-73646
Affected component: lib/previous-map.js in PostCSS
CVE-2026-73646: Improper Limitation of a Pathname to a Restricted Directory
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.18, lib/previous-map.js loadMap passes attacker-controlled sourceMappingURL values to joindirnameopts.from, annotation, and loadFile permits traversed ...
CVE-2026-68256
Summary: CVE-2026-68256 affects the Linux kernel DRM/AMD Display stack, specifically the function detect_link_and_local_sink. The issue: on the DP alt mode timeout path inside SIGNAL_TYPE_DISPLAY_PORT, prev_sink is not released, whereas all other paths correctly call dc_sink_release(prev_sink). T...
CVE-2026-68130 ksmbd: defer destroy_previous_session() until after NTLM authentication
In the Linux kernel, the following vulnerability has been resolved: ksmbd: defer destroyprevioussession until after NTLM authentication In ntlmauthenticate, destroyprevioussession is called using a user pointer resolved from the client-supplied NTLM blob username field before the NTLMv2 response ...
CVE-2026-68130
CVE-2026-68130 (ksmbd, Linux kernel) : The vulnerability arises in ntlm_authenticate() where destroy_previous_session() is invoked using a pre-authentication user pointer derived from the client NTLM blob, before NTLMv2 response validation. An attacker could set the NTLM blob username to a victim...
JLSEC-2026-1221 A vulnerability in libcurl caused the HTTP `Referer:` header to persist even when explicitly...
A vulnerability in libcurl caused the HTTP Referer: header to persist even when explicitly cleared. While the documentation states that passing NULL to CURLOPTREFERER suppresses the header, the option failed to clear the internal state. As a result the previous referrer string was erroneously...
CVE-2026-70375
HashBrown CMS through 1.4.6 contains an OS Command Injection vulnerability CWE-78 in the Git deployer component. GitDeployer.pullRepo in src/Server/Entity/Deployer/GitDeployer.js executes AppService.execgit checkout $this.branch || 'master', interpolating the configured branch value directly into...
Directory Traversal
Overview postcss is a PostCSS is a tool for transforming styles with JS plugins. Affected versions of this package are vulnerable to Directory Traversal in the PreviousMap.loadFile method of lib/previous-map.js, which nests its traversal guard inside an if cssFile branch that is skipped when the...
CVE-2026-13339
The CVE-2026-13339 issue concerns the CubeWP Framework WordPress plugin, affected versions are all up to and including 1.1.30. Affected component: cubewp_get_svg_content function, which allows a Directory Traversal. Unauthenticated attackers can read arbitrary server files containing sensitive in...
CVE-2026-52857 Wings: Maliciously or erroneously created parsed config files can cause wings process to OOM
Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to 1.13.0, unbounded json, yaml, and xml configuration-file parsers in parser.go can process an oversized non-file parser configuration file and exhaust Wings process memory. This issue is...
Cross Site Scripting
DOMPurify is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to persistent function handlers in ADDATTR and ADDTAGS across multiple sanitize calls, where previously approved attributes or tags continue to bypass sanitization, allowing attackers to inject malicious HTML or...
CVE-2026-17761
Insufficient validation of untrusted input in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to inject arbitrary scripts or HTML UXSS via malicious network traffic. Chromium security severity: Medium...