8010 matches found
CVE-2026-89151
Forgejo before 16.0.4 allows use of restricted API tokens for unintended access to the "allow maintainer edit" feature...
CVE-2026-89151
Forgejo before 16.0.4 allows use of restricted API tokens for unintended access to the "allow maintainer edit" feature...
PT-2026-89744
Forgejo before 16.0.4 allows use of restricted API tokens for unintended access to the "allow maintainer edit" feature...
shiro-cve-2010-3863
Apache Shiro Path Traversal CVE-2010-3863 Vulnerability Reproduction Local environment setup with Docker Open Yakit to capture packets Payload: /./admin/ Successful...
CVE-2026-19583 Velociraptor Required Permissions bypass by using client monitoring queries
Velociraptor allows some sensitive artifacts to be gated by additional permissions. For example, the Linux.Sys.BashShell artifact allows arbitrary command execution on endpoints, and so it requires the EXECVE permission to schedule. However, no such check was implemented for client monitoring...
UBUNTU-CVE-2026-87818
GitPython 3.1.59 fails to restrict the --no-index option in the high-l...
Privilege-escalation-ASKEY
Privilege-escalation-ASKEY-Router-RTF3505VW-N1 CVE-2022-47040 Privilege escalation vulnerability on ASKEY routers Device: ASKEY RTF3505VW-N1 Firmware: BRSVg000R3505VMN1001s327 not tested in other version CLI Version: ReducedCLIHGUv13 Exploit: ASKEY RTF3505VW-N1 devices are provided with access...
CVE-2026-62801
CVE-2026-62801 is a path traversal vulnerability in Windows PowerShell that allows an unauthorized, remote attacker to bypass a security feature. The improper limitation of a pathname to a restricted directory means an attacker can reference files or resources outside the intended directory. The ...
DNSlivery
DNSlivery Easy files and payloads delivery over DNS. DNSlivery Acknowledgments Description TL;DR What problem are you trying to solve? How does it work? Requirements Setup DNS Zone DNSlivery Usage Server Target Acknowledgments This project has been originally inspired by PowerDNS and Joff Thyer's...
CVE-2026-86481
In JetBrains YouTrack before 2026.2.18634 signed URL reuse allowed disclosure of restricted project icons...
CVE-2026-86481
In JetBrains YouTrack before 2026.2.18634 signed URL reuse allowed disclosure of restricted project icons...
EUVD-2026-72497
In JetBrains YouTrack before 2026.2.18634 signed URL reuse allowed disclosure of restricted project icons...
EUVD-2026-72460
Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Next4Biz Information Technologies Inc. CSM Customer Service Management allows Path Traversal. This issue affects CSM Customer Service Management: from 6.8.9 through 07092026. NOTE: The vendor was contact...
EUVD-2026-71227
Postgres MCP Pro 0.3.0 contains a restricted-mode bypass vulnerability where function-name validation is not applied to RangeFunction nodes in FROM clauses. Attackers can execute file-reading functions like pgreadfile through FROM-clause syntax to read arbitrary files despite restricted-mode...
CVE-2026-85620 Postgres MCP Pro 0.3.0 Restricted-Mode Bypass via FROM-Clause Function
Postgres MCP Pro 0.3.0 contains a restricted-mode bypass vulnerability where function-name validation is not applied to RangeFunction nodes in FROM clauses. Attackers can execute file-reading functions like pgreadfile through FROM-clause syntax to read arbitrary files despite restricted-mode...
CVE-2026-85620
Postgres MCP Pro 0.3.0 contains a restricted-mode bypass in its SQL validation layer. The root cause is that function-name validation is not applied to RangeFunction nodes in FROM clauses , allowing attackers to invoke file-reading functions such as pg_read_file via FROM-clause syntax and read ar...
CVE-2026-74853
The Pods WordPress plugin before 3.3.9.2 does not restrict which functions a display callback may resolve to, allowing users with the author role and above to read arbitrary files from the server, including files outside the web root. Only sites using the restricted display-callback mode are...
CVE-2026-74853
The Pods WordPress plugin versions 3.3 through 3.3.9.1 allow users with the author role or above to read arbitrary files from the server—including files outside the web root—because the plugin's display callback does not restrict which functions it may resolve to. The vulnerability only affects s...
PT-2026-85544
Postgres MCP Pro 0.3.0 contains a restricted-mode bypass vulnerability where function-name validation is not applied to RangeFunction nodes in FROM clauses. Attackers can execute file-reading functions like pg read file through FROM-clause syntax to read arbitrary files despite restricted-mode...