CVE-2026-90999

Sentry Seer , the automated debugging assistant within the Sentry error-monitoring platform (vendor: Functional Software, Inc. ), is affected by a multi-stage trust-boundary violation . When configured to automatically hand issues to a coding agent, an unauthenticated attacker can submit fabricat...

CVE-2025-9074

CVE-2025-9074: Docker Engine API 未授权远程代码执行 严重性 ：严重 | CVSS评分 ：9.8（估计） | 受影响版本 ：Docker Desktop options 选项 模式：命令执行 在目标上执行单个命令： root@kitploit: 简单命令 php poc.php -u http://192.168.65.7:2375 -m cmd -c "id" 从主机读...

Security Bulletin: IBM® Db2® is vulnerable to a denial of service where a specific functionality on a Db2 server can be disabled by a DBADM privileged user under certain conditions (CVE-2026-87958)

Summary IBM® Db2® is vulnerable to a denial of service where a specific functionality on a Db2 server can be disabled by a database administration authority DBADM privileged user under certain conditions CVE-2026-87958 Vulnerability Details CVEID:CVE-2026-87958 DESCRIPTION: IBM Db2 11.5.0 through...

CVE-2026-19535

Nozomi Networks Labs identified a CWE-352: Cross-Site Request Forgery CSRF vulnerability in the LuCI administrative web interface of Advantech EKI-1242IEIMS in firmware version V1.06.01 that allows a remote unauthenticated attacker to perform unauthorized state-changing requests on behalf of a...

EUVD-2026-80737

Nozomi Networks Labs identified a CWE-352: Cross-Site Request Forgery CSRF vulnerability in the LuCI administrative web interface of Advantech EKI-1242IEIMS in firmware version V1.06.01 that allows a remote unauthenticated attacker to perform unauthorized state-changing requests on behalf of a...

CVE-2026-19535

Nozomi Networks Labs identified a CWE-352: Cross-Site Request Forgery CSRF vulnerability in the LuCI administrative web interface of Advantech EKI-1242IEIMS in firmware version V1.06.01 that allows a remote unauthenticated attacker to perform unauthorized state-changing requests on behalf of a...

CVE-2021-31762

..| CVE-2021-31762 |.. 描述： 利用跨站请求伪造（CSRF）攻击，通过Webmin的添加用户功能创建特权用户，然后通过Webmin的运行进程功能获取反向Shell 测试版本： Webmin 1.973（GitHub最新版本 2021年7月3日） 攻击类型： 远程 影响： 远程命令执行 利用代码POC： YouTube POC： https://youtu.be/qCvEXwyaF5U 产品供应商： https://www.webmin.com 附加信息：...

CVE-2026-27553

A low-privileged remote attacker can manipulate the schema path parameter in the /index.php/diagnosticstab/ajaxdiagtablerows endpoint using a valid user cookie allowing disclosure of all user password hashes...

CVE-2026-27559 Command Injection via GET in /api/status/data

A low-privileged remote attacker can exploit a command injection vulnerability in the /api/status/data endpoint by sending a crafted GET request with user credentials allowing execution of commands with root privileges on the device...

CVE-2026-27556 Local File Inclusion in /index.php/ajax/save_iodd_parameters

A low-privileged remote attacker can exploit a local file inclusion vulnerability in the /index.php/ajax/saveioddparameters endpoint using a valid operator cookie allowing execution of arbitrary PHP code on the device...

EUVD-2026-80235

A low-privileged remote attacker can exploit improper authorization in the /index.php/attacheddevicestab/doupload endpoint to upload IODD files to the device, potentially altering device behavior or causing system crashes...

CVE-2026-27551 Command Injection in /index.php/ajax/parameterManage

A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/ajax/parameterManage endpoint using user credentials allowing execution of commands with root privileges on the device...

CVE-2026-34621

Adobe Acrobat 零日漏洞分析 针对 Adobe Acrobat JavaScript 信任模型及其与所报告的涉及特权 Acrobat API 的零日漏洞滥用路径之间关系的逆向工程笔记与支撑材料。 概述 本仓库包含对 Adobe Acrobat 如何通过原生处理器暴露特权 JavaScript 功能、这些处理器如何被门控，以及为何所观察到的问题应被理解为信任/上下文处理缺陷 而非简单的缺失访问检查的技术分析。 该分析聚焦于以下已恢复的执行路径： util.readFileIntoStream app.trustedFunction app.beginPriv...

EUVD-2026-80093

The VeloCloud Edge software update workflow may accept update bundles without properly validating their signatures because the workflow does not restrict the digest algorithm used for artifact verification. An attacker with either sufficient privileges to upload packages to VeloCloud Orchestrator...

EUVD-2026-80014

The mySCADA myPRO Manager command API does not properly enforce authentication for privileged functions. An unauthenticated attacker with network access to the affected API could exploit this vulnerability to access privileged management functions...

Oracle Coherence (September 2026 CSPU)

The 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 versions of Coherence installed on the remote host are affected by multiple vulnerabilities as referenced in the September 2026 CSPU advisory. - Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware component: Core...

Cisco Identity Services Engine Incorrect Use of Privileged APIs Vulnerability

Cisco Identity Services Engine ISE and Cisco ISE Passive Identity Connector ISE-PIC contain an incorrect use of privileged APIs vulnerability that could allow an unauthenticated, remote attacker to gain unauthorized access to the affected device by bypassing the web-based management interface...

CVE-2026-73807

The mySCADA myPRO Manager command API does not properly enforce authentication for privileged functions. An unauthenticated attacker with network access to the affected API could exploit this vulnerability to access privileged management functions...

CVE-2026-73807

mySCADA myPRO Manager has a missing authorization vulnerability in its command API , which fails to properly enforce authentication for privileged functions. An unauthenticated attacker with network access to the affected API can reach privileged management functions, rated CVSS 3.1 9.8 (Critical...

CVE-2026-73807 mySCADA myPRO Manager Missing Authorization

The mySCADA myPRO Manager command API does not properly enforce authentication for privileged functions. An unauthenticated attacker with network access to the affected API could exploit this vulnerability to access privileged management functions...