631 matches found
backup_dc_registry
Backup Operator Registry Backup to Domain Compromise A simple POC that abuses Backup Operator privileges to remote dump SAM, SYSTEM, and SECURITY hives. Research credit to: @filipdragovic Ported from @mpgn Windows PoC Usage This proof of concept is a modified version of impacket/examples/reg.py a...
CVE-2026-115706
Authorization Bypass Through User-Controlled Key CWE-639 in Elastic Cloud Enterprise ECE can lead to privilege escalation via Privilege Abuse CAPEC-122. An attacker who controls any host in an ECE installation can obtain credentials that are reserved for other platform roles. These credentials ca...
EUVD-2026-112888
Authorization Bypass Through User-Controlled Key vulnerability in EventPrime EventPrime eventprime-event-calendar-management allows Privilege Abuse.This issue affects EventPrime: from n/a through 4.3.6.0...
CVE-2026-42691
The EventPrime eventprime-event-calendar-management WordPress plugin (versions
CVE-2026-115706
A vulnerability in Elastic Cloud Enterprise (ECE) allows an Authorization Bypass Through User-Controlled Key (CWE-639) , leading to Privilege Abuse (CAPEC-122) . An attacker who controls any host within an ECE installation—including a host running only the allocator role—or has network access to ...
CVE-2026-115706 Authorization Bypass Through User-Controlled Key in Elastic Cloud Enterprise (ECE) Leading to Privilege Escalation
Authorization Bypass Through User-Controlled Key CWE-639 in Elastic Cloud Enterprise ECE can lead to privilege escalation via Privilege Abuse CAPEC-122. An attacker who controls any host in an ECE installation can obtain credentials that are reserved for other platform roles. These credentials ca...
litespeed-cpanel-cve-2026-54420-fix
CVE-2026-54420 Mitigation Toolkit Defensive remediation, auditing, and verification toolkit for CVE-2026-54420 affecting LiteSpeed cPanel Plugin in shared hosting environments using CloudLinux / CageFS. ⚠️ Security Notice This repository is intended for system administrators, hosting providers, an...
CLEANSTART-2026-VN72569 Missing Authorization (CWE-862) in the Elasticsearch custom inference service can lead to information disclosure via Privilege Abuse (CAPEC-122)
Security vulnerability affects the sonarqube package. Missing Authorization CWE-862 in the Elasticsearch custom inference service can lead to information disclosure via Privilege Abuse CAPEC-122...
[SECURITY] [DLA 4843-1] python-django security update
------------------------------------------------------------------------- Debian LTS Advisory DLA-4843-1 [email protected] https://www.debian.org/lts/security/ Chris Lamb October 19, 2026 https://wiki.debian.org/LTS -...
Debian dla-4843 : python-django-doc - security update
The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4843 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-4843-1 [email protected]...
MGASA-2026-0510 Updated python-django package fixes security vulnerabilities
Potential denial-of-service vulnerability in getsupportedlanguagevariant. CVE-2026-77050 Potential denial-of-service vulnerability in HTTP header parsing. CVE-2026-84429 Potential request forgery via spatial lookup byte values. CVE-2026-87890 Privilege abuse in model formsets with editable primar...
Updated python-django package fixes security vulnerabilities
Potential denial-of-service vulnerability in getsupportedlanguagevariant. CVE-2026-77050 Potential denial-of-service vulnerability in HTTP header parsing. CVE-2026-84429 Potential request forgery via spatial lookup byte values. CVE-2026-87890 Privilege abuse in model formsets with editable primar...
Fedora 43 : python-django5 (2026-a7b8ff851a)
The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-a7b8ff851a advisory. Update Django 5 to version 5.2.18 - Fixes CVE-2026-77050 low: Potential denial-of-service vulnerability in getsupportedlanguagevariant - Fixes...
Fedora 44 : python-django6 (2026-dbd9eb6961)
The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-dbd9eb6961 advisory. Update Django 6 to version 6.1.2 - Fixes CVE-2026-77050 low: Potential denial-of-service vulnerability in getsupportedlanguagevariant - Fixes...
Fedora 44 : python-django5 (2026-8a0e918188)
The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-8a0e918188 advisory. Update Django 5 to version 5.2.18 - Fixes CVE-2026-77050 low: Potential denial-of-service vulnerability in getsupportedlanguagevariant - Fixes...
CVE-2026-87975 Privilege abuse in model formsets with editable primary keys
An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18. django.forms.models.BaseModelFormSet.saveexistingobjects used the presence of a primary key on a submitted form's instance as evidence that the instance belonged to the formset's limiting queryset. An...
CVE-2026-87975 Privilege abuse in model formsets with editable primary keys
An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18. django.forms.models.BaseModelFormSet.saveexistingobjects used the presence of a primary key on a submitted form's instance as evidence that the instance belonged to the formset's limiting queryset. An...
CVE-2026-87975
A privilege abuse vulnerability exists in Django versions 6.1 before 6.1.2 , 6.0 before 6.0.9 , and 5.2 before 5.2.18 . The root cause lies in django.forms.models.BaseModelFormSet.save_existing_objects(), which incorrectly assumes that the presence of a primary key in submitted data confirms the ...
CVE-2026-87975 Privilege abuse in model formsets with editable primary keys
An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18. django.forms.models.BaseModelFormSet.saveexistingobjects used the presence of a primary key on a submitted form's instance as evidence that the instance belonged to the formset's limiting queryset. An...