CVE-2026-77767

Reconmap , a penetration-testing engagement management platform, has an unauthenticated information disclosure in its report preview endpoint. The PreviewReport action in ReportsController.cs is decorated with [AllowAnonymous], bypassing the API's fallback authorization policy that requires an au...

CVE-2026-77767 Reconmap Report Preview Endpoint Is Marked AllowAnonymous, Exposing Every Project and Client Organisation Without Authentication

Reconmap's API applies a fallback authorization policy in apps/api/app/Program.cs that requires an authenticated user holding the administrator role, so controllers without their own attribute reject anonymous callers. The report preview action in apps/api/app/Controllers/ReportsController.cs...

CVE-2026-16934

creationtimestamp| type| source ---|---|--- 2026-08-21 01:49:10+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mtknfuvdj72k 2026-08-26 01:07:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mtx5fbpcwr2u...

CVE-2026-17422

creationtimestamp| type| source ---|---|--- 2026-08-21 00:09:30+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mtkhtoeben2b 2026-08-21 00:30:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mtkiygvnyg2y 2026-08-26 18:07:07+00:00| seen|...

PT-2026-79361

Name of the Vulnerable Software and Affected Versions Reconmap affected versions not specified Description An authorization bypass exists in the API due to a fallback policy in apps/api/app/Program.cs that is bypassed by the AllowAnonymous attribute in apps/api/app/Controllers/ReportsController.c...

PT-2026-79363

The report.list procedure in packages/trpc/src/routers/report.ts accepted a projectId and a dashboardId and returned getReportsByDashboardIddashboardId. The enforceAccess middleware in packages/trpc/src/trpc.ts verified membership for the supplied projectId, but nothing verified that the supplied...

MINI-JXXQ-CM5P-RX6C

Bulletin has no description...

CVE-2026-77113 Path Traversal Vulnerability in apport-unpack

Path traversal in apport-unpack in Canonical Apport before 2.36.0, 2.34.2, and 2.28.4 on Linux allows an attacker to create or overwrite arbitrary files with the privileges of the executing user via an attacker controlled key names in crash report files...

CVE-2026-77113 Path Traversal Vulnerability in apport-unpack

Path traversal in apport-unpack in Canonical Apport before 2.36.0, 2.34.2, and 2.28.4 on Linux allows an attacker to create or overwrite arbitrary files with the privileges of the executing user via an attacker controlled key names in crash report files...

CVE-2026-77113 Path Traversal Vulnerability in apport-unpack

Path traversal in apport-unpack in Canonical Apport before 2.36.0, 2.34.2, and 2.28.4 on Linux allows an attacker to create or overwrite arbitrary files with the privileges of the executing user via an attacker controlled key names in crash report files...

CVE-2026-77113

The apport-unpack utility in Canonical Apport (versions before 2.36.0, 2.34.2, and 2.28.4) is vulnerable to path traversal: attacker-controlled key names in crash report files allow creation or overwriting of arbitrary files with the privileges of the executing user. CVSS 6.7 (MEDIUM), local vect...

faction v1.8.13

OWASP - FACTION PenTesting Report Generation and Collaboration Framework Faction is now an OWASP Project! You can find more informationhere Sponsors Premium Sponsors otto-js - PCI and Client Side Security | Secninjaz Technologies LLP ---|--- Become a Sponsor ❤️ If you like the project and would...

MINI-PPX7-9JR8-89PF

Bulletin has no description...

faraday_plugins v1.29.0

Install root@kitploit: pip install faraday-plugins Commands List Plugins List all plugins and if its compatible with command or/and report Optional params: -cpf / --custom-plugins-folder PATH: If given will also look for custom plugins on that path root@kitploit: faraday-plugins list-plugins Test...

CVE-2026-32475

creationtimestamp| type| source ---|---|--- 2026-08-19 23:00:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mthtintyc32y 2026-08-20 06:21:25+00:00| seen| https://bsky.app/profile/infosecbriefly.bsky.social/post/3mtim5rbjj42a 2026-08-20 06:57:35+00:00| seen|...

CVE-2026-76310

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user who has an embedded report token could download the associated search job dispatch archive, recover session material, and use it to access all relevant data available to the report owner and affect...

CVE-2026-76311

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user who has an embedded report token could download the dispatch archive for an embedded report search job and use exposed session material to access all relevant data and affect system integrity on the...

CVE-2026-55089

creationtimestamp| type| source ---|---|--- 2026-08-19 22:11:56+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mthqsjpskr2e 2026-08-20 01:20:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mti3cwawod24 2026-08-20 08:00:04+00:00| published-proof-of-concept|...

CVE-2026-76139

creationtimestamp| type| source ---|---|--- 2026-08-19 22:00:51+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mthq6olui527 2026-08-20 14:47:10+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3mtjig5p2f42w...

CVE-2026-76347

Splunk Secure Gateway's Report Notifications REST API fails to validate notification path values before sending system-authenticated internal requests, allowing non-admin users to trigger SSRF, alter Search Head Cluster state, and cause denial of service. Affected versions: Splunk Enterprise belo...