CVE-2021-43129

CVE-2021-43129 D2L Brightspaceの学習管理システム（LMS）における脆弱性 脆弱性の種類: CWE-668: リソースの誤った領域への公開 製品ベンダー: Desire2Learn/D2L 影響を受ける製品コードベース: D2L Brightspaceの学習管理システム（LMS） テスト済みバージョン: 20.21.7 D2Lは「右クリック無効化」設定が2022年8月に廃止されることを発表しました。 影響を受けるコンポーネント: クイズ機能の「右クリック無効化」設定 攻撃タイプ: リモート 権限昇格の影響: あり 攻撃ベクトル:...

cloudsplaining

Cloudsplaining Cloudsplaining is an AWS IAM Security Assessment tool that identifies violations of least privilege and generates a risk-prioritized HTML report. Example report Documentation For full documentation, please visit the project on ReadTheDocs. Installation Cheatsheet Example report...

aws_exposable_resources

AWS 노출 가능 리소스 이 저장소의 목표는 공개적으로 노출될 수 있는 모든 AWS 리소스 목록을 유지 관리하고, 궁극적으로는 신뢰할 수 없는 계정과 공유할 수 있는 리소스 목록도 포함하는 것입니다 해당 섹션은 아직 개발 중이며 여기에 포함되지 않았습니다. 이 목록에는 다음 개념이 적용됩니다: 다른 리소스를 통해 간접적으로 노출될 수 있는 리소스는 포함되지 않습니다. 예를 들어, CloudTrail 로그는 공개된 S3 버킷으로 전송될 수 있지만, 잘못 구성된 것은 S3 버킷이므로 CloudTrail은 공개 가능한 리소스로 나열...

CVE-2026-106557 Backstage: Improper input validation in TechDocs Markdown extension configuration

Backstage is an open framework for building developer portals. Prior to 1.14.6 and 1.15.4, the @backstage/plugin-techdocs-node package did not sufficiently validate TechDocs Markdown extension configuration. An authenticated user who can register or modify documentation sources may cause a TechDo...

CVE-2026-106354

Improper resource exposure in Extensions in Google Chrome prior to 155...

PT-2026-107582

Name of the Vulnerable Software and Affected Versions Backstage versions prior to 1.14.6 Backstage versions prior to 1.15.4 Description The @backstage/plugin-techdocs-node package fails to sufficiently validate TechDocs Markdown extension configuration. An authenticated user with permissions to...

Linux Distros Unpatched Vulnerability : CVE-2026-106354

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper resource exposure in Extensions in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to obtain cross-origin data via a crafted HTML page...

CVE-2026-106487

The @backstage/plugin-kubernetes-backend package in Backstage (prior to version 0.21.10 ) is vulnerable to an unsupported catalog cluster authentication mode in the Kubernetes backend. If catalog contributors can modify kubernetes-cluster Resource entities , the backend might use its local in-clu...

CVE-2026-106354

Improper resource exposure in Extensions in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. Chromium security severity: Medium...

EUVD-2026-93704

Improper resource exposure in Extensions in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-106354

A flaw in the Extensions subsystem of Google Chrome (and chromium-browser ) prior to version 155.0.8059.39 allows for improper resource exposure. A remote attacker can exploit this by convincing a user to view a crafted HTML page , which enables them to obtain cross-origin data (information belon...

CVE-2026-106354

Improper resource exposure in Extensions in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. Chromium security severity: Medium...

PT-2026-107026

Improper resource exposure in Extensions in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. Chromium security severity: Medium...

Astra Linux – Vulnerability in Chromium

Improper resource exposure in StreamsAPI in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially bypass web origin policy into a privileged page via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-54495: Exposure of Resource to Wrong Sphere

The OpenFeature Operator allows users to expose feature flags to applications. In version 0.9.2 and earlier, a tenant who can create a controller-owned workload can use the openfeature.dev/featureflagsource annotation with NAMESPACE/NAME syntax to reference a FeatureFlagSource or...

CVE-2026-21586

This High severity Improper Authorization vulnerability was introduced in versions 7.4.0, 7.13.0, 8.5.0, 8.9.0, 9.0.1, 9.1.0, 9.2.0, 9.3.1, 9.4.0, 9.5.1, 10.0.2, 10.1.0, and 10.2.0 of Confluence Data Center. This Improper Authorization vulnerability, with a CVSS Score of 7.1, allows an...

CVE-2026-21587

CVE-2026-21587 is a High severity Improper Authorization vulnerability (CVSS 4.0 score 7.1 ) introduced in Jira Service Management Data Center 11.3.0 . An authenticated attacker can gain unintended access, potentially exposing sensitive information or enabling arbitrary code execution . The flaw ...

EUVD-2026-78935

This High severity Improper Authorization vulnerability was introduced in versions 7.4.0, 7.13.0, 8.5.0, 8.9.0, 9.0.1, 9.1.0, 9.2.0, 9.3.1, 9.4.0, 9.5.1, 10.0.2, 10.1.0, and 10.2.0 of Confluence Data Center. This Improper Authorization vulnerability, with a CVSS Score of 7.1, allows an...

CVE-2026-21586: Improper Authorization

This High severity Improper Authorization vulnerability was introduced in versions 7.4.0, 7.13.0, 8.5.0, 8.9.0, 9.0.1, 9.1.0, 9.2.0, 9.3.1, 9.4.0, 9.5.1, 10.0.2, 10.1.0, and 10.2.0 of Confluence Data Center. This Improper Authorization vulnerability, with a CVSS Score of 7.1, allows an...

PT-2026-92135

Name of the Vulnerable Software and Affected Versions Confluence Data Center version 7.4.0 Confluence Data Center version 7.13.0 Confluence Data Center version 8.5.0 Confluence Data Center version 8.9.0 Confluence Data Center version 9.0.1 Confluence Data Center version 9.1.0 Confluence Data Cent...