CVE-2026-105686 Penpot: Repeated chunk index causes temporary-storage amplification

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the chunked media upload RPC validates that a chunk index is in range but neither rejects an already stored index nor replaces its previous object. An authenticated user can repeatedly upload the same valid index, causing...

CVE-2026-105686 Penpot: Repeated chunk index causes temporary-storage amplification

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the chunked media upload RPC validates that a chunk index is in range but neither rejects an already stored index nor replaces its previous object. An authenticated user can repeatedly upload the same valid index, causing...

CVE-2026-105686

The open-source design and prototyping platform Penpot is vulnerable to temporary-storage amplification in versions prior to 2.18.0 . The issue exists within the chunked media upload RPC , which fails to reject or replace previously stored chunk indexes. An authenticated user can repeatedly uploa...

CVE-2026-105679 Ghost: Stored XSS via File Uploads on Local Storage

Ghost is a Node.js content management system. From 6.22.1 until 6.64.0, Ghost restricted the content type used to serve uploaded files to prevent browsers from executing them. On sites using the default local storage adapter, this restriction was not applied, so files uploaded by any staff user...

CVE-2026-105679 Ghost: Stored XSS via File Uploads on Local Storage

Ghost is a Node.js content management system. From 6.22.1 until 6.64.0, Ghost restricted the content type used to serve uploaded files to prevent browsers from executing them. On sites using the default local storage adapter, this restriction was not applied, so files uploaded by any staff user...

CVE-2026-105679 Ghost: Stored XSS via File Uploads on Local Storage

Ghost is a Node.js content management system. From 6.22.1 until 6.64.0, Ghost restricted the content type used to serve uploaded files to prevent browsers from executing them. On sites using the default local storage adapter, this restriction was not applied, so files uploaded by any staff user...

CVE-2026-105679

The Ghost Node.js content management system is vulnerable to Stored XSS in versions 6.22.1 through 6.64.0 . The root cause is that the restriction on content types for uploaded files is not applied when using the default local storage adapter , allowing files to be served with content types deriv...

CVE-2026-105679

Ghost is a Node.js content management system. From 6.22.1 until 6.64.0, Ghost restricted the content type used to serve uploaded files to prevent browsers from executing them. On sites using the default local storage adapter, this restriction was not applied, so files uploaded by any staff user...

cve-2022-23131

cve-2022-23131 cve-2022-23131 zabbix-saml-bypass-exp 1. замените zbxsignedsession на cookie 2. войдите с помощью единого входа SAML автор: @random-robbie、@jweny и @Mr-xn ссылка: https://blog.sonarsource.com/zabbix-case-study-of-unsafe-session-storage...

CyberQRM

CyberQRM – Cyber Quantitative Risk Management A local, open-source platform for quantitative cybersecurity risk assessment using the FAIR v3.1 Factor Analysis of Information Risk framework. Model threats, run Monte Carlo simulations, measure control effectiveness, and manage risk portfolios — all...

CVE-2024-24488

CVE-2024-24488 مشكلة في جهاز Shenzen Tenda Technology CP3V2.0 الإصدار V11.10.00.2311090948 تسمح لمهاجم محلي بالحصول على معلومات حساسة عبر مكون كلمة المرور. الإصدارات المختبرة CP3V2.0 - V11.10.00.2311090948 CWE CWE-313: تخزين النص الصريح في ملف أو على قرص نظرة عامة على الثغرة يمكن للأجهزة المتأثرة...

cve-2022-21877

إثبات المفهوم لـ CVE-2022-21877 يحتوي هذا المستودع على إثبات المفهوم لـ CVE-2022-21877، الذي اكتشفه Quang Linh، العامل في STAR Labs. وهو تسرب معلومات موجود داخل برنامج التشغيل spaceport.sys. يمكن العثور على مقال مصاحب على هذا الرابط. استخدامه لبناء إثبات المفهوم، قم بتشغيل .\build. لتشغيله، تحتاج...

Security Bulletin: Automation Assets in IBM Cloud Pak for Integration are vulnerable to multiple vulnerabilities in multer

Summary Assets in IBM Cloud Pak for Integration are vulnerable to multiple vulnerabilities in multer. CVE-2026-77037, CVE-2026-77063, CVE-2026-77078, CVE-2026-82333 The vulnerabilities have been addressed. Vulnerability Details CVEID:CVE-2026-77037 DESCRIPTION: multer is a middleware for handling...

Dell has uncovered vulnerabilities in container storage modules

Dell has addressed the vulnerabilities in Container Storage Modules version 1.18.0 and later. These vulnerabilities reside in Dell Container Storage Modules CSM, which are used for integrating Dell storage systems with container platforms such as Kubernetes and OpenShift. The identified...

CVE-2026-60093

CVE-2026-60093 — camel-azure-storage-datalake : traversée de chemin downloadToFile Preuves de concept exécutables de la même vulnérabilité Apache Camel, une par runtime : Runtime| Répertoire| Stack ---|---|--- Camel Spring Boot| camel-spring-boot/| Spring Boot 3.5.13 + camel-azure-storage-datalak...

CVE-2024-56428

CVE-2024-56428 بيانات الاعتماد النصية الصريحة في قاعدة البيانات المحلية لـ iLabClient قراءة التكوين بما في ذلك كلمة المرور يُستخدم iLabClient لتنزيل النتائج من خادم المختبر. يتم تخزين بيانات التكوين محليًا في مثيل Apache Derby iLabClient. يتم تخزين كلمة المرور كنص عادي. لقراءة ذلك، يجب أولاً إنشا...

CVE-2025-70962

CVE-2025-70962 Utilisation d'identifiants codés en dur dans le service RTSP de la caméra IP ZOSI C519M Champ| Valeur ---|--- ID CVE| CVE-2025-70962 Fournisseur| ZOSI Technology Produit| Caméra IP intelligente ZOSI C519M également répertoriée sous le modèle 1NC-519M Versions concernées| Firmware...

Astra Linux – Vulnerability in Python-Django

In Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1, directory traversal is allowed if the filenames are passed to it directly...

Astra Linux – Vulnerability in Chromium

The Race in Storage feature in Google Chrome prior to version 150.0.7871.47 allowed a remote attacker to leak cross-origin data through a crafted HTML page. Chromium security severity: Low...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: usb: udc: remove warning when queue disabled ep It is possible for the warning message to be triggered during the execution of the mass storage function. WARNING: CPU: 6, PID: 3839 Location: drivers/usb/gadget/udc/core.c:294...