rosenbridge

project:rosenbridge : puertas traseras de hardware en CPUs x86 github.com/xoreaxeaxeax/rosenbridge // domas // @xoreaxeaxeax Resumen project:rosenbridge revela una puerta trasera de hardware en algunos procesadores x86 de escritorio, portátiles y embebidos. La puerta trasera permite que el código...

EUVD-2026-89144

Incorrect authorization in Mobile in Google Chrome on on Android prior to 154.0.8037.57 allowed a local attacker to bypass system access restrictions into a privileged page via a co-installed app. Chromium security severity: Medium...

CVE-2025-20029

CVE-2025-20029: Command Injection in TMSH CLI in F5 BIG-IP A command injection vulnerability exists in the F5 “tmsh” restricted CLI which allows an authenticated attacker to leverage the commands accessible by a low privilege user in order to bypass restrictions, inject arbitrary commands and...

cve-2020-13933

cve-2020-13933 cve-2020-13933 Apache Shiro privilege bypass vulnerability This reproduction is very simple. First, set up the environment using IDEA + Shiro Reference: https://www.cnblogs.com/ph4nt0mer/p/13535999.html Then run, access, and capture packets...

YellowKey-Bitlocker-CVE-2026-45585

🛡️ YellowKey-Bitlocker-CVE-2026-45585 - Recover Your BitLocker Keys Safely 📋 What This Software Does YellowKey is a free open-source utility for Windows 10 and Windows 11. It helps you extract, backup, and view your BitLocker recovery keys. This is useful if you lost access to your encrypted drive...

CVE-2021-36750

CVE-2021-36749 About - In the Druid ingestion system, the InputSource is used for reading data from a certain data source. However, the HTTP InputSource allows authenticated users to read data from other sources than intended, such as the local file system, with the privileges of the Druid server...

CVE-2026-87544

A flaw was found in Chromium. A remote attacker could exploit incorrect authorization in Extensions by crafting a malicious HTML page. This could allow the attacker to bypass system access restrictions and gain access to a privileged page...

EUVD-2026-44773

Cilium: Namespaced HTTPRoutes can redirect traffic to other namespaces...

CVE-2026-77243

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, ENABLEDTOOLS and TOOLSETS are applied when tools are listed but are not rechecked when a tools/call request is dispatched. A client that knows a hidden tool name can directly invoke...

CVE-2026-77243 MCP Atlassian: ENABLED_TOOLS / Toolset authorization bypass

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, ENABLEDTOOLS and TOOLSETS are applied when tools are listed but are not rechecked when a tools/call request is dispatched. A client that knows a hidden tool name can directly invoke...

CVE-2026-77243

The MCP Atlassian Model Context Protocol server for Confluence and Jira is vulnerable to an authorization bypass in versions prior to 0.22.0 . The root cause is that while ENABLED_TOOLS and TOOLSETS are applied during tool listing, they are not rechecked when a tools/call request is dispatched. T...

CVE-2026-77243: Missing Authorization

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, ENABLEDTOOLS and TOOLSETS are applied when tools are listed but are not rechecked when a tools/call request is dispatched. A client that knows a hidden tool name can directly invoke...

UBUNTU-CVE-2026-61821

pgpartman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, droppartitionid and droppartitiontime use partconfig.retentionschema as the target for ALTER TABLE SET SCHEMA and accept any nonempty schema name. A role with partmanuser access can select a target...

EulerOS 2.0 SP10 : docker-engine (EulerOS-SA-2026-3735)

According to the versions of the docker-engine package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Moby is an open source container framework. Prior to version 29.3.1, a security vulnerability has been detected that allows plugins privileg...

CVE-2026-73579

Incorrect Authorization vulnerability in Apache Syncope. Any search requests are transformed into SQL, Neo4J or Elasticsearch / Opensearch queries, depending on the actual deployment configuration. An important component of such transformation is the Realms filter, which ensures that the search...

Astra Linux – Vulnerability in docker.io-app

Moby is an open-source container framework. Prior to version 29.3.1, a security vulnerability was detected that allowed for bypassing the privilege validation process during Docker plugin installation. Due to an error in the daemon’s privilege comparison logic, the daemon might incorrectly accept...

CVE-2026-72524

Incorrect Authorization vulnerability in Apache Doris allows an authenticated user to bypass privilege checks and access or modify data they are not authorized to. This issue affects Apache Doris: from 3.1.0 through 3.1., from 4.0.0 through 4.0.7, and from 4.1.0 through 4.1.3. Users are recommend...

CVE-2026-68570

Incorrect Authorization vulnerability in Apache Doris allows an authenticated user to bypass privilege checks and access data they are not authorized to read, resulting in unauthorized disclosure of information. This issue affects Apache Doris: from 2.0.0 through 2.1., from 3.0.0 through 3.0., fr...

EUVD-2026-77355

Incorrect Authorization vulnerability in Apache Doris allows an authenticated user to bypass privilege checks and access data they are not authorized to read, resulting in unauthorized disclosure of information. This issue affects Apache Doris: from 2.0.0 through 2.1., from 3.0.0 through 3.0., fr...

EUVD-2026-77353

Incorrect Authorization vulnerability in Apache Doris allows an authenticated user to bypass privilege checks and access or modify data they are not authorized to. This issue affects Apache Doris: from 3.1.0 through 3.1., from 4.0.0 through 4.0.7, and from 4.1.0 through 4.1.3. Users are recommend...