CVE-2026-88959 Anchor CMS through 0.12.7 Privilege Escalation via Missing Authorization on Admin User-Management Endpoints

Anchor CMS through 0.12.7 fails to enforce role-based access control in admin user-management endpoints, allowing any authenticated low-privilege user to create administrator accounts or modify existing ones. Attackers with editor or user roles can POST directly to admin/users/add or...

CVE-2026-81049

Dell ThinOS 10 , in versions prior to 2605_10.2616 , is affected by a Missing Support for Integrity Check vulnerability. A high-privileged attacker with local access can potentially exploit this flaw to achieve arbitrary code execution . The CVSS 3.1 score is 4.4 (MEDIUM) , with the primary impac...

CVE-2026-4129 Improper Access Controls in NI SystemLink

There is an improper access control vulnerability in NI SystemLink that may allow an authenticated user with limited privileges to access host operating system files and directories that should be restricted. This vulnerability affects NI SystemLink and NI SystemLink Server versions prior to 2026...

CVE-2026-4129

NI SystemLink and NI SystemLink Server (versions 2026 Q3 and prior) contain an improper access control vulnerability that allows an authenticated user with limited privileges to access host operating system files and directories that should be restricted. The CVSS 3.1 score is 8.1 (HIGH) with hig...

CVE-2026-81051

Dell ThinOS 10 , in versions prior to 2605_10.2616 , is affected by a Security Version Number Mutable to Older Versions vulnerability. A low-privileged attacker with physical access can potentially exploit this flaw to bypass the system's protection mechanism, resulting in high impact across conf...

CVE-2026-53519

Lab CVE-2026-53519 - Nezha Dashboard pre-auth path traversal Lab reproduce la vulnerabilidad pre-auth path traversal via/dashboard.. prefix confusion en Nezha Dashboard, que conduce a la filtración de jwtsecretkey - forge JWT - toma de privilegios de admin. Entorno Docker, separado A/B por versió...

nagiosxi-root-rce-exploit

nagiosxi-root-exploit Resumen Existe una vulnerabilidad en Nagios XI = 5.6.5 que permite a un atacante aprovechar un RCE para escalar privilegios a root. El exploit requiere acceso al servidor como el usuario 'nagios', o acceso CCM a través de la interfaz web con permisos para administrar plugins...

CVE-2022-24637

CVE-2022-24637 — Open Web Analytics anterior a 1.7.4 Notas defensivas sobre un problema crítico de divulgación de información no autenticada en Open Web Analytics OWA que puede conducir a una escalada de privilegios. Encontrado mientras se trabajaba en la máquina Fruityloops en echoCTF, que...

CVE-2022-0847

CVE-2022-0847 - Exploit Dirty Pipe Un exploit de prueba de concepto para CVE-2022-0847 Dirty Pipe, una vulnerabilidad del kernel de Linux que permite a usuarios sin privilegios escribir en archivos de solo lectura. Detalles de la vulnerabilidad CVE-2022-0847 afecta a los kernels de Linux 5.8 hast...

security-research

Investigación de Seguridad Una colección de archivos relacionados con mi investigación personal de seguridad. Contenido adicional se publicará en mi blog https://blog.mirch.io. Herramientas Herramienta| Descripción ---|--- openssldircheck| Utilidad de Windows para comprobar rutas potencialmente...

CVE-2025-20393

CVE-2025-20393 📌 Descripción general CVE-2025-20393 es una vulnerabilidad crítica de Ejecución Remota de Comandos RCE que afecta a los equipos Cisco Secure Email Gateway SEG y Cisco Secure Email and Web Manager SEWM que ejecutan Cisco AsyncOS. La vulnerabilidad existe debido a una validación de...

CVE-2025-24999

CVE-2025-24999 prueba de concepto para CVE-2025-24999 https://databasesecurityninja.wordpress.com/2026/04/02/microsoft-sql-server-privilege-elevation-through-msdatabasemanager-role-cve-2025-24999/...

DEBIAN-CVE-2026-88924

A flaw was found in the admin backend of gvfs. The privileged gvfsd-admin daemon changes the ownership of newly created private D-Bus sockets by calling the link-following chown function on a pathname inside a user-controlled directory. A local attacker can exploit this via a Time-of-Check...

CVE-2026-88924

A flaw was found in the admin backend of gvfs. The privileged gvfsd-admin daemon changes the ownership of newly created private D-Bus sockets by calling the link-following chown function on a pathname inside a user-controlled directory. A local attacker can exploit this via a Time-of-Check...

CVE-2026-88006

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.0 until 0.11.1, Open WebUI's OAuth token exchange endpoint issues a session for a provider access token without running the OAuth role management that the normal OAuth login callback runs. A user whose...

CVE-2026-81801

Subscriber Settings Change in WP-Stateless = 4.4.1 versions...

CVE-2026-81805

Unauthenticated Privilege Escalation in SiteSkite = 2.1.5 versions...

CVE-2025-10576

CVE-2025-10576 HP Sound Research SECOMNService Escalada de Privilegios. Permisos débiles del registro permiten a cualquier usuario crear un enlace simbólico de registro y forzar al servicio SECOMNService a crear una clave de registro arbitraria. Cómo hacerlo: root@kitploit: 1. soundresearchpoc.ex...

CVE-2023-27146-LocalPotato-Priviledge-Escalation

CVE-2023-27146-LocalPotato-Priviledge-Escalation...

EUVD-2026-75541

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.0 until 0.11.1, Open WebUI's OAuth token exchange endpoint issues a session for a provider access token without running the OAuth role management that the normal OAuth login callback runs. A user whose...