CVE-2026-104966 Plane: Cross-Workspace IDOR in Estimate and Comment Endpoints Allows Read, Modify, and Inject Across Workspaces

Plane is an open-source project management tool. Prior to 1.4.0, two endpoint families fail to verify that nested resource identifiers belong to the workspace and project named in the URL. An authenticated user can read or modify estimates from another workspace through PATCH...

CVE-2024-40422

CVE-2024-40422 Python implementation/PoC for CVE-2024-40422. Exploits a critical directory traversal vulnerability in Devika v1's /api/get-browser-snapshot endpoint to read arbitrary system files...

CVE-2026-98080

A flaw was found in the Linux kernel's Btrfs file system. This vulnerability allows a local user to cause a Denial of Service DoS by performing snapshot creation and data relocation on a file system with quotas enabled. Due to improper metadata handling during snapshot quota accounting, the kerne...

EUVD-2026-92474

In Eclipse Che versions 7.29.0 and later, the GET /api/scm/resolve and POST /api/factory/resolver endpoints pass an attacker-controlled URL to URLFetcher.fetch, which calls new URLurl.openConnection with no scheme or host allow-list and returns the response body to the caller. Any authenticated C...

CVE-2026-86671

In Eclipse Che versions 7.29.0 and later , the GET /api/scm/resolve and POST /api/factory/resolver endpoints are vulnerable to Server-Side Request Forgery (SSRF) . The application passes attacker-controlled URLs to URLFetcher.fetch() without an allow-list for schemes or hosts. Consequently, an au...

CVE-2026-86671

In Eclipse Che versions 7.29.0 and later, the GET /api/scm/resolve and POST /api/factory/resolver endpoints pass an attacker-controlled URL to URLFetcher.fetch, which calls new URLurl.openConnection with no scheme or host allow-list and returns the response body to the caller. Any authenticated C...

Microsoft Exchange Flaw Lets Authenticated Attackers Read Other Users' Mailboxes

Microsoft has released out-of-band security updates to address a high-severity flaw in Microsoft Exchange Server that could allow an attacker to escalate privileges under certain conditions. The vulnerability, tracked as CVE-2026-96940 , is rated 8.8 on the CVSS scoring system. "Weak authorizatio...

CVE-2001-0931

CVE-2001-0931 Directory traversal vulnerability in Cooolsoft PowerFTP Server 2.03 allows attackers to list or read arbitrary files and directories via a .. dot dot in 1 LS or 2 GET. SecurityFocus publication at https://www.securityfocus.com/bid/3593/info Securiteam publication at...

CVE-2026-89039

A caller who can invoke the convertplaywrightscript prompt in mcp-k6 can pass a bare file path as the playwrightscript argument and receive the contents of any file readable by the user running the server, including SSH keys and cloud credentials in that user's home directory path traversal. The...

Security update for libX11

This update for libX11 fixes the following issues: CVE-2026-88806: XkbGetMap Reply Heap-based Buffer Overflow bsc1280910. CVE-2026-94283: out-of-bounds read vulnerability in libX11's XIM X Input Method attribute parser bsc1281653. CVE-2026-94284: out-of-bounds read vulnerability in libX11's XIM...

SUSE-SU-2026:4502-1 Security update for libX11

This update for libX11 fixes the following issues: - CVE-2026-88806: XkbGetMap Reply Heap-based Buffer Overflow bsc1280910. - CVE-2026-94283: out-of-bounds read vulnerability in libX11's XIM X Input Method attribute parser bsc1281653. - CVE-2026-94284: out-of-bounds read vulnerability in libX11's...

Security update for libX11

This update for libX11 fixes the following issues: CVE-2026-88806: XkbGetMap Reply Heap-based Buffer Overflow bsc1280910. CVE-2026-94283: out-of-bounds read vulnerability in libX11's XIM X Input Method attribute parser bsc1281653. CVE-2026-94284: out-of-bounds read vulnerability in libX11's XIM...

SUSE-SU-2026:4501-1 Security update for libX11

This update for libX11 fixes the following issues: - CVE-2026-88806: XkbGetMap Reply Heap-based Buffer Overflow bsc1280910. - CVE-2026-94283: out-of-bounds read vulnerability in libX11's XIM X Input Method attribute parser bsc1281653. - CVE-2026-94284: out-of-bounds read vulnerability in libX11's...

Security update for libX11

This update for libX11 fixes the following issues: CVE-2026-88806: XkbGetMap Reply Heap-based Buffer Overflow bsc1280910. CVE-2026-94283: out-of-bounds read vulnerability in libX11's XIM X Input Method attribute parser bsc1281653. CVE-2026-94284: out-of-bounds read vulnerability in libX11's XIM...

SUSE-SU-2026:4500-1 Security update for libX11

This update for libX11 fixes the following issues: - CVE-2026-88806: XkbGetMap Reply Heap-based Buffer Overflow bsc1280910. - CVE-2026-94283: out-of-bounds read vulnerability in libX11's XIM X Input Method attribute parser bsc1281653. - CVE-2026-94284: out-of-bounds read vulnerability in libX11's...

CVE-2026-89039 Arbitrary file read via the convert_playwright_script prompt in mcp-k6

A caller who can invoke the convertplaywrightscript prompt in mcp-k6 can pass a bare file path as the playwrightscript argument and receive the contents of any file readable by the user running the server, including SSH keys and cloud credentials in that user's home directory path traversal. The...

CVE-2026-89039 Arbitrary file read via the convert_playwright_script prompt in mcp-k6

A caller who can invoke the convertplaywrightscript prompt in mcp-k6 can pass a bare file path as the playwrightscript argument and receive the contents of any file readable by the user running the server, including SSH keys and cloud credentials in that user's home directory path traversal. The...

CVE-2026-89039

The k6 MCP server is vulnerable to a path traversal flaw in the convert_playwright_script prompt via the playwright_script argument. While @-prefixed paths are restricted to the current working directory, bare paths follow an undocumented code path with no restrictions, allowing callers to read a...

EUVD-2026-92434

A caller who can invoke the convertplaywrightscript prompt in mcp-k6 can pass a bare file path as the playwrightscript argument and receive the contents of any file readable by the user running the server, including SSH keys and cloud credentials in that user's home directory path traversal. The...

HPE-Aruba-AOS8-Vulnerabilities

⚠️ Disclosure Status: All findings in this repository were submitted to the HPE Networking Bug Bounty Program Bugcrowd between May–June 2026. Five of six submissions were closed as "Not Applicable" at triage level without technical reconciliation of the submitted evidence. No fixes have been issue...