CVE-2025-32462

CVE-2025-32462 – sudo POC Script This is a CVE‑2025‑32462 privilege escalation detection script, providing two modes: direct sudo detection and non-privileged user traversal detection. File Structure File| Description ---|--- poc.sh| Vulnerability verification file for CVE-2025-32462 supports bas...

CVE-2026-118678 n8n before 2.41.4 and 2.42.1 Prototype Pollution DoS via Workflow History Compaction

n8n before 2.41.4 and 2.42.x before 2.42.1 contains a prototype pollution vulnerability that allows low-privileged users to alter built-in object behaviour by saving workflows with specially named connection keys. Attackers can add keys such as proto to workflow connections, which the periodic...

CVE-2026-118678

The software n8n versions before 2.41.4 and 2.42.x before 2.42.1 is vulnerable to a prototype pollution vulnerability. Low-privileged users can manipulate built-in object behavior by saving workflows containing specially named connection keys, such as __proto__. When the periodic history compacti...

authcov

AuthCov Web app authorisation coverage scanning. Introduction AuthCov crawls your web application using a Chrome headless browser while logged in as a pre-defined user. It intercepts and logs API requests as well as pages loaded during the crawling phase. In the next phase it logs in under a...

CVE-2026-4950

The CustomerAdministration portal KundenManager of VertiGIS WebOrderSystem allows privileged users to manage the employees of defined companies user groups. User properties, for example the "secondName" parameter, can be filled with JavaScript code while editing a user. The code is stored and...

CVE-2026-4950

The VertiGIS WebOrderSystem is vulnerable to a Stored Cross-Site Scripting (XSS) flaw in its CustomerAdministration portal (KundenManager) . The issue occurs because user properties, such as the "secondName" parameter , can be populated with malicious JavaScript code during user editing. This cod...

CVE-2026-4950 Stored Cross-Site Scripting in CustomerAdministration Portal (KundenManager) in VertiGIS WebOrderSystem

The CustomerAdministration portal KundenManager of VertiGIS WebOrderSystem allows privileged users to manage the employees of defined companies user groups. User properties, for example the "secondName" parameter, can be filled with JavaScript code while editing a user. The code is stored and...

EUVD-2026-108612

The CustomerAdministration portal KundenManager of VertiGIS WebOrderSystem allows privileged users to manage the employees of defined companies user groups. User properties, for example the "secondName" parameter, can be filled with JavaScript code while editing a user. The code is stored and...

PT-2026-121784

The CustomerAdministration portal KundenManager of VertiGIS WebOrderSystem allows privileged users to manage the employees of defined companies user groups. User properties, for example the "secondName" parameter, can be filled with JavaScript code while editing a user. The code is stored and...

CVE-2026-28328

SolarWinds Observability Self-Hosted was found to be affected by a broken authorization schema that can allow low-privileged users to access and modify information beyond their assigned permissions...

EUVD-2026-105175

SolarWinds Observability Self-Hosted was found to be affected by a broken authorization schema that can allow low-privileged users to access and modify information beyond their assigned permissions...

CVE-2026-28328 SolarWinds Observability Self-Hosted broken authorization schema

SolarWinds Observability Self-Hosted was found to be affected by a broken authorization schema that can allow low-privileged users to access and modify information beyond their assigned permissions...

CVE-2026-28328 SolarWinds Observability Self-Hosted broken authorization schema

SolarWinds Observability Self-Hosted was found to be affected by a broken authorization schema that can allow low-privileged users to access and modify information beyond their assigned permissions...

CVE-2026-28328

SolarWinds Observability Self-Hosted is impacted by a broken authorization schema (CWE-863). This vulnerability allows low-privileged users to access and modify information that falls outside of their assigned permissions. The issue results in a HIGH base severity (CVSS 3.1 score of 8.8), with si...

PT-2026-118504

Name of the Vulnerable Software and Affected Versions SolarWinds Observability Self-Hosted affected versions not specified Description A broken authorization schema allows low-privileged users to access and modify information that exceeds their assigned permissions. Recommendations At the moment,...

CVE-2026-112306

NocoBase @nocobase/plugin-collection-sql through 2.2.28 contains an SQL injection vulnerability that allows privileged users to store unvalidated SQL by bypassing checkSQL through the sqlCollection:setFields action. Attackers holding the collection-sql snippet can replace a benign collection quer...

EUVD-2026-104398

NocoBase @nocobase/plugin-collection-sql through 2.2.28 contains an SQL injection vulnerability that allows privileged users to store unvalidated SQL by bypassing checkSQL through the sqlCollection:setFields action. Attackers holding the collection-sql snippet can replace a benign collection quer...

CVE-2026-112306

NocoBase @nocobase/plugin-collection-sql through 2.2.28 contains an SQL injection vulnerability that allows privileged users to store unvalidated SQL by bypassing checkSQL through the sqlCollection:setFields action. Attackers holding the collection-sql snippet can replace a benign collection quer...

CVE-2026-112306: Improper Neutralization of Special Elements used in an SQL Command

NocoBase @nocobase/plugin-collection-sql through 2.2.28 contains an SQL injection vulnerability that allows privileged users to store unvalidated SQL by bypassing checkSQL through the sqlCollection:setFields action. Attackers holding the collection-sql snippet can replace a benign collection quer...

CVE-2026-111670 ClickVisual through 1.1.2 Missing Authorization in apiv2 Report Module

ClickVisual through 1.1.2 contains a missing authorization vulnerability in the /api/v2/reports handlers that allows authenticated low-privileged users to access ClickHouse instances they were not granted. Attackers can iterate the instance-id parameter in ReportSourceDatabases, ReportSourceTable...