CVE-2026-102923 SparkyFitness: SSRF via unvalidated custom_url in AI service settings

SparkyFitness is a self-hosted, AI-powered health and fitness tracker for families. Prior to 1.6.0, SparkyFitnessServer/services/chatService.ts and SparkyFitnessServer/services/labelScanService.ts do not validate destinations supplied in custom AI service settings. An authenticated user saves a...

CVE-2026-102923

Prior to version 1.6.0 , the SparkyFitness health and fitness tracker is vulnerable to Server-Side Request Forgery (SSRF) . The flaw exists because the components SparkyFitnessServer/services/chatService.ts and SparkyFitnessServer/services/labelScanService.ts fail to validate destinations provide...

CVE-2026-102923 SparkyFitness: SSRF via unvalidated custom_url in AI service settings

SparkyFitness is a self-hosted, AI-powered health and fitness tracker for families. Prior to 1.6.0, SparkyFitnessServer/services/chatService.ts and SparkyFitnessServer/services/labelScanService.ts do not validate destinations supplied in custom AI service settings. An authenticated user saves a...

LLMNR Network Service Reporter

This plugin aggregates LLMNR network service settings collected by individual detection plugins and reports the result as a structured internal host tag. The structured data object is reported even when only a subset of the source plugins ran. %NASLMINLEVEL 80900 C Tenable, Inc...

SMB Network Service Reporter

This plugin aggregates SMB network service settings collected by individual detection plugins and reports the result as a structured internal host tag. The structured data object is reported even when only a subset of the source plugins ran. %NASLMINLEVEL 80900 C Tenable, Inc. include'compat.inc'...

Missing Authorization

Overview kibana is an open source Apache Licensed, browser-based analytics and search dashboard for Elasticsearch. Affected versions of this package are vulnerable to Missing Authorization via direct requests to insufficiently protected product endpoints. An attacker can access and modify...

CVE-2026-63141

Missing Authorization CWE-862 in Kibana allows an authenticated user to access and modify Cloud Connect configuration and service settings without the required feature privileges, via direct requests to insufficiently protected product endpoints...

CVE-2026-63141 Missing Authorization in Kibana Leading to Unauthorized Access to Cloud Connect Management Functions

Missing Authorization CWE-862 in Kibana allows an authenticated user to access and modify Cloud Connect configuration and service settings without the required feature privileges, via direct requests to insufficiently protected product endpoints...

PT-2026-62410

Name of the Vulnerable Software and Affected Versions Kibana affected versions not specified Description An authenticated user can access and modify Cloud Connect configuration and service settings without the necessary feature privileges. This occurs due to missing authorization in product...

Improper Authentication

Overview @n8n/api-types is a fair-code workflow automation platform with native AI capabilities Affected versions of this package are vulnerable to Improper Authentication via the Self-Service Settings API. An attacker can circumvent centralized identity management and multi-factor authentication...

Improper Authentication

Overview @n8n/rest-api-client is a This package contains the REST API calls for n8n. Affected versions of this package are vulnerable to Improper Authentication via the Self-Service Settings API. An attacker can circumvent centralized identity management and multi-factor authentication by disabli...

GHSA-VJF3-2GPJ-233V n8n has an SSO Enforcement Bypass in its Self-Service Settings API

Impact An authenticated user signed in through Single Sign-On SSO could disable SSO enforcement for their own account through the n8n API. This allowed the user to create a local password and authenticate directly with email and password, completely bypassing the organization's SSO policy,...

Improper Authentication

Overview n8n is a n8n Workflow Automation Tool Affected versions of this package are vulnerable to Improper Authentication via the Self-Service Settings API. An attacker can circumvent centralized identity management and multi-factor authentication by disabling SSO enforcement for their own accou...

n8n has an SSO Enforcement Bypass in its Self-Service Settings API

Impact An authenticated user signed in through Single Sign-On SSO could disable SSO enforcement for their own account through the n8n API. This allowed the user to create a local password and authenticate directly with email and password, completely bypassing the organization's SSO policy,...

EUVD-2020-29002

Malware in sbrugna...

uptux

uptux Specialized privilege escalation checks for Linux systems. Implemented so far: - Writable systemd paths, services, timers, and socket units - Disassembles systemd unit files looking for: - References to executables that are writable - References to broken symlinks pointing to writeable...

CVE-2024-57677

The D-Link DIR-816A2 router (specifically firmware FWv1.10CNB05_R1B011D88210 ) is vulnerable to an access control issue within the form2Wan.cgi component. This flaw allows an unauthenticated attacker to set the device's WAN service by sending a specially crafted HTTP POST request . While some sou...

Progress Software WhatsUp Gold: Access control error vulnerability

Progress Software WhatsUp Gold is a network monitoring software from Progress Software, Inc. It is used to monitor the entire network infrastructure as well as applications, configurations and network traffic. An Access Control Error vulnerability exists in Progress Software WhatsUp Gold versions...

CVE-2024-8903

Local active protection service settings manipulation due to unnecessary privileges assignment. The following products are affected: Acronis Cyber Protect Cloud Agent Windows, macOS before build 38565...

D-Link DIR-846W security vulnerabilities

D-Link DIR-846W is a dual-band Gigabit wireless router with second-generation 11AC technology and MU-MIMO technology, supporting dual-band concurrent transmission rates up to 1200Mbps for 200M and above broadband users. The D-Link DIR-846W suffers from a command execution vulnerability that...