CVE-2026-86749

Snipe-IT versions up to 8.6.3 contain a data-loss flaw in ImageUploadRequest::handleImages() . The application does not check the return value of Storage::disk('public')->put() or Storage::delete() , so when a storage backend transiently fails (e.g., an S3 network error, filesystem permission ...

CVE-2026-86749 snipe-it before 8.7.0 Data Loss via Failed Image Write

Snipe-IT versions put... call still caused the application to delete the previous image via deleteExistingImage and to reassign and persist the model's image reference to the new filename, destroying the existing image and leaving the database row pointing at a file that was never written. A mirr...

EUVD-2026-74926

Snipe-IT versions put... call still caused the application to delete the previous image via deleteExistingImage and to reassign and persist the model's image reference to the new filename, destroying the existing image and leaving the database row pointing at a file that was never written. A mirr...

CVE-2026-86740

Snipe-IT before 8.7.0 contains a flaw in UploadedFilesController::destroy() and Api\UploadedFilesController::destroy() where the return value of Storage::delete() is not checked. As a result, attachment deletion requests report success and files are hidden from listings, yet the physical files pe...

CVE-2026-86740 Snipe-IT before 8.7.0 Attachment Deletion Reports Success While File Remains

Snipe-IT before 8.7.0 fails to check the return value of Storage::delete in UploadedFilesController::destroy and Api\UploadedFilesController::destroy, allowing deletion requests to report success while files remain on disk. Administrators performing attachment deletions receive success responses...

EUVD-2026-74916

Snipe-IT 8.6.3 and earlier do not check the return value of Storage::put when writing the signature PNG and the generated acceptance PDF in Account\AcceptanceController::store. On filesystem drivers that return false instead of throwing on a write failure for example the local disk with restricti...

CVE-2026-86739

Snipe-IT versions 8.6.3 and earlier fail to check the return value of Storage::put() when writing the signature PNG and acceptance PDF in Account\AcceptanceController::store(). On filesystem drivers that return false instead of throwing on write failure (e.g., local disk with restrictive permissi...

CVE-2026-86739 Snipe-IT before 8.7.0 Acceptance Finalization Without Stored Evidence

Snipe-IT 8.6.3 and earlier do not check the return value of Storage::put when writing the signature PNG and the generated acceptance PDF in Account\AcceptanceController::store. On filesystem drivers that return false instead of throwing on a write failure for example the local disk with restricti...

CVE-2026-66066

🚨 CVE-2026-66066 — KindaRails2Shell Ejecución remota de código RCE sin autenticación previa en Ruby on Rails Active Storage Repositorio educativo de investigación de seguridad para CVE-2026-66066 "KindaRails2Shell". Este repositorio está destinado únicamente a investigación de seguridad, análisis...

React-Router-CVE-2025-61686-

Informe de análisis de la vulnerabilidad CVE-2025-61686 Resumen de la vulnerabilidad CVE ID : CVE-2025-61686 Versiones afectadas : @react-router/node 7.0.0 a 7.9.3 Tipo de vulnerabilidad : Path Traversal / Directory Traversal Principio de la vulnerabilidad 1. Ubicación de la vulnerabilidad La...

CVE-2025-2620-poc

CVE-2025-2620 Exploit de Prueba de Concepto Resumen Este repositorio contiene un exploit avanzado de prueba de concepto PoC para CVE-2025-2620 , una vulnerabilidad crítica de desbordamiento de búfer basado en pila descubierta en el router D-Link DAP-1620 que ejecuta la versión de firmware 1.03...

CVE-2026-79695

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Handling of Highly Compressed Data Data Amplification vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability,...

CVE-2026-65181

Insufficient authorization of Data Source tables in Impala 2.7-4.5 allows a client with privileges to upload a file to remote storage and create a table to execute arbitrary Java code. Users are recommended to upgrade to version 4.5.2, which fixes this issue...

firefox: thunderbird: Mitigation bypass in the Storage: Cache API component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Mitigation bypass in the Storage: Cache API component...

EUVD-2026-74800

Insufficient authorization of Data Source tables in Impala 2.7-4.5 allows a client with privileges to upload a file to remote storage and create a table to execute arbitrary Java code. Users are recommended to upgrade to version 4.5.2, which fixes this issue...

appledb_rs

Base de datos de artefactos de Apple Servidor que almacena diversa información sobre los componentes internos de Apple por plataforma/versión. Artefactos almacenados: Ejecutables Entitlements Frameworks Dispositivos Versiones Características principales: Acceso completo mediante llamadas API, CLI...

zabbix-cve-2022-23131

cve-2022-23131 cve-2022-23131 zabbix-saml-bypass-exp 1. Reemplace zbxsignedsession por cookie 2. Inicie sesión con Single Sign-On SAML autor: @random-robbie、@jweny y @Mr-xn enlace: https://blog.sonarsource.com/zabbix-case-study-of-unsafe-session-storage...

next_js_poisoning

CVE-2024-4698 es una vulnerabilidad de envenenamiento de caché en Next.js que afecta a las versiones 13.5.1 a 13.5.7, así como de la 14.0.0 a la 14.2.10. El problema surge cuando los sitios web utilizan la API next/image?url= con el parámetro ?url=, lo que permite a los atacantes cargar imágenes...

firefox: thunderbird: Mitigation bypass in the Storage: Cache API component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Mitigation bypass in the Storage: Cache API component...

CVE-2025-65320

CVE-2025-65320 CVE-2025-65320: Almacenamiento en texto claro de información sensible en memoria en Abacre Restaurant Point of Sale POS. Todas las versiones de Abacre Restaurant Point of Sale POS hasta la 15.0.0.1656 son vulnerables al almacenamiento en texto claro de información sensible en...