EUVD-2026-67230

Trilium is an open-source hierarchical note-taking application. In versions up to and including 0.103.0, the public share-search endpoint does not enforce the per-note shareCredentials and shareHiddenFromTree controls, allowing an unauthenticated visitor to read the titles, tree paths, and conten...

CVE-2026-77438

Trilium (open-source hierarchical note-taking app), in versions up to and including 0.103.0 , has an authorization flaw in its public share-search endpoint . The endpoint authorizes only the ancestor note supplied in the request, then performs a full-text search across the entire published subtre...

CVE-2020-23968-ILEX-SignGo-EoP

CVE-2020-23968 Ilex International Sign&go Workstation Security Suite 7.1 consente l'elevazione dei privilegi tramite un attacco di symlink su C:\ProgramData\Ilex\S&G\Logs\000-sngWSService1.log...

herpaderping

Process Herpaderping Process Herpaderping è un metodo per oscurare le intenzioni di un processo modificando il contenuto su disco dopo che l'immagine è stata mappata. Ciò risulta in un comportamento curioso da parte dei prodotti di sicurezza e del sistema operativo stesso. Sommario Generalmente, ...

GO-2026-6296 Kyverno's NamespacedGeneratingPolicy generator.apply() namespace argument unvalidated -- background controller creates RoleBindings in any namespace including kube-system in github.com/kyverno/kyverno

Kyverno's NamespacedGeneratingPolicy generator.apply namespace argument unvalidated -- background controller creates RoleBindings in any namespace including kube-system in github.com/kyverno/kyverno...

GO-2026-6298 Cloudreve WebDAV (`/dav`) has Path Traversal / Broken Access Control — scoped DAV credential escapes its configured account root in github.com/cloudreve/Cloudreve

Cloudreve WebDAV /dav has Path Traversal / Broken Access Control — scoped DAV credential escapes its configured account root in github.com/cloudreve/Cloudreve...

GO-2026-6301 Kargo has Open Redirect in UI OIDC Login Flow via redirectTo Query Parameter in github.com/akuity/kargo

Kargo has Open Redirect in UI OIDC Login Flow via redirectTo Query Parameter in github.com/akuity/kargo...

CVE-2018-16509

CVE-2018-16509 Parco giochi Docker "È stato scoperto un problema in Artifex Ghostscript prima della versione 9.24. Un controllo errato del 'ripristino dei privilegi' durante la gestione delle eccezioni /invalidaccess potrebbe essere utilizzato da attaccanti in grado di fornire PostScript manipola...

Vxscan

Vxscan 2.0 Inglese | 简体中文 Strumento di scansione completo per Python3, utilizzato principalmente per il rilevamento di file sensibili scansione directory e interfacce di leak da JS, identificazione WAF/CDN, scansione porte, identificazione impronte digitali/servizi, identificazione sistema...

CVE-2025-25062

CVE-2025-25062 Beschreibung Verwendung Beispiel Zeitleiste Beschreibung Im Backdrop CMS 1.29.2 besteht auf der Beitragsbearbeitungsseite eine Schwachstelle für gespeichertes Cross-Site-Scripting XSS. Dieses Skript verkettet die Schwachstelle mit einem CSRF-Payload, um eine Privilegienausweitung v...

CVE-2021-3156

CVE-2021-3156 https://www.qualys.com/2021/01/26/cve-2021-3156/baron-samedit-heap-based-overflow-sudo.txt https://blog.qualys.com/vulnerabilities-research/2021/01/26/cve-2021-3156-heap-based-buffer-overflow-in-sudo-baron-samedit https://access.redhat.com/security/vulnerabilities/RHSB-2021-002...

CVE-2024-10511

CVE-2024-10511 CWE-287: Autenticazione impropria Sommario Il prodotto Schneider Electric PowerChute Serial Shutdown è un software di gestione UPS che consente lo spegnimento ordinato del sistema e funzionalità di gestione dell'energia per desktop, server e workstation. PowerChute Serial Shutdown...

Openbsd-Privilege-Escalation

Openbsd-Privilege-Escalation Ein Skript, das den Prozess der Rechteausweitung auf OpenBSD-Systemen automatisiert CVE-2019-19520, indem es das xlock-Binary ausnutzt und dessen sgid erlangt und dann zum Root-Benutzer eskaliert CVE-2019-19522 durch Ausnutzung der Privilegien der auth-Gruppe und...

CVE-2014-4322_poc

CVE-2014-4322poc كود الـ poc يعمل على Nexus Android 4.4/5.0 اكتساب صلاحيات: system - root، كجزء من https://github.com/retme7/CVE-2014-7911poc المؤلف: retme [email protected] @returnsme على تويتر و @retme على ويبو الموقع: retme.net يجب تنفيذ الإكسبلويت بصلاحيات النظام وسياق SELinux محدد. إذا...

CVE-2026-8023

CVE-2026-8023 — اجتياز المسار في HTTP static-fs في Zephyr PoC اجتياز المسار قبل المصادقة في معالج static-fs لخادم HTTP في Zephyr subsys/net/lib/http عند استخدام مطابقة الموارد باستخدام حرف البدل CONFIGHTTPSERVERRESOURCEWILDCARD=y مع HTTPRESOURCETYPESTATICFS. يؤثر على كلٍّ من HTTP/1.1 و HTTP/2...

EUVD-2026-67229

Trilium is an open-source hierarchical note-taking application. In versions prior to 0.104.0, the automatic image-download feature accepts file:// URLs in a note's img tags and reads the referenced local file with no path validation, allowing any authenticated user to disclose arbitrary files...

CVE-2026-53580

Trilium is an open-source hierarchical note-taking application affected in versions prior to 0.104.0 . The automatic image-download feature accepts file:// URLs in tags within text notes and performs a filesystem read with no path validation . Because the HTML sanitizer allows the file scheme, a...

CVE-2026-53580 Trilium arbitrary file read and denial of service via file:// URLs in the automatic image-download feature

Trilium is an open-source hierarchical note-taking application. In versions prior to 0.104.0, the automatic image-download feature accepts file:// URLs in a note's img tags and reads the referenced local file with no path validation, allowing any authenticated user to disclose arbitrary files...

CVE-2026-24135

CVE-2026-24135: Eliminazione arbitraria di file in Gogs tramite path traversal nel Wiki Gravità: Alta CVSS 7.5 Software interessato: Gogs Corretto in: 0.13.4, 0.14.0+dev Avviso: GHSA-jp7c-wj6q-3qf2 Patch: gogs/gogs8099 Riepilogo Durante un audit di sicurezza di Gogs un popolare servizio Git...

CVE-2026-50751-Mitigation-Scripts

CVE-2026-50751-Mitigation-Scripts Es gibt mehrere Sicherungsmaßnahmen, die Sie aus der SK verwenden können; https://support.checkpoint.com/results/sk/sk185033 1. Deaktivieren Sie die Unterstützung für Legacy-Clients. 2. Konfigurieren Sie den Remotezugriff so, dass nur IKE v2 verwendet wird. Es gi...