CVE-2026-58200: Improper Verification of Cryptographic Signature

Payload Plugins is a collection of plugins designed to enhance Payload CMS. From 0.3.0 until 0.4.0, @jhb.software/payload-cloudinary-plugin deployments with clientUploads enabled expose POST /api/cloudinary-generate-signature, whose handler in cloudinary/src/getGenerateSignature.ts passes...

CVE-2026-84794: Missing Authorization

Craft CMS versions before 5.10.11 lack authorization checks in the assets/move-asset endpoint when force=1 is supplied. Authenticated users without peer asset permissions can move their own assets into other users' folders and force deletion of conflicting files, allowing unauthorized asset...

EUVD-2026-42984

Snipe-IT vulnerable to cross-company asset maintenance re-parenting via API update...

CVE-2026-32639 Winter: Broken access control in `Cms\Controllers\Index` allows cross-template actions and unauthorized asset uploads

Winter CMS is a content management system built on the Laravel PHP framework. In versions up to and including 1.2.12, the CMS section's Theme Editor AJAX handlers did not enforce per-template-type permission checks, allowing a backend user with any single CMS permission to act on template types...

CVE-2026-45260

Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.17 LTS and 12.3.7, Pimcore's WebDAV asset endpoint exposes a MOVE operation through /asset/webdavpath without an authentication plugin in bundles/CoreBundle/src/Controller/WebDavController.php, and...

CVE-2026-45260

Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.17 LTS and 12.3.7, Pimcore's WebDAV asset endpoint exposes a MOVE operation through /asset/webdavpath without an authentication plugin in bundles/CoreBundle/src/Controller/WebDavController.php, and...

CVE-2026-45260: Missing Authorization

Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.17 LTS and 12.3.7, Pimcore's WebDAV asset endpoint exposes a MOVE operation through /asset/webdavpath without an authentication plugin in bundles/CoreBundle/src/Controller/WebDavController.php, and...

CVE-2026-25633 Statamic's missing authorization allows access to assets

Statamic is a, Laravel + Git powered CMS designed for building websites. Prior to 5.73.6 and 6.2.5, users without permission to view assets are able are able to download them and view their metadata. Logged-out users and users without permission to access the control panel are unable to take...

Statamic 安全漏洞

Statamic is a powerful flat-file CMS built using Laravel by Statamic Inc. It allows for storing all content, templates, assets, and settings in files rather than in a database. There were security vulnerabilities in versions of Statamic 5.73.6 and 6.2.5, which stemmed from improper access control...

EUVD-2018-3024

Malware in sbrugna...

EUVD-2018-3707

Malware in sbrugna...

EUVD-2018-2449

Malware in sbrugna...

Hexagon Number Error Vulnerability

Hexagon HXG is an Ether-based ERC20 token. An integer overflow vulnerability exists in the 'transfer' function of the smart system implementation in HXG. An attacker can exploit this vulnerability to unauthorized increase of data assets by providing the 'to' and 'value' parameters...

PT-2018-10748

Name of the Vulnerable Software and Affected Versions Bitcoin Red BTCR affected versions not specified Description The issue is related to an integer overflow in the distributeBTR function of a smart contract implementation. This allows the owner to increase digital assets unauthorized by providi...

PT-2018-10669

Name of the Vulnerable Software and Affected Versions EETHER affected versions not specified Description An integer overflow in the distributeToken function of a smart contract implementation will lead to an unauthorized increase of an attacker's digital assets. Recommendations At the moment, the...

Hexagon '_transfer' function integer overflow vulnerability

Hexagon HXG is an Ether-based ERC20 token. An integer overflow vulnerability exists in the Hexagon 'transfer' function. An attacker can exploit this vulnerability to unauthorized increase of data assets by providing the 'to' and 'value' parameters...

Integer overflow

An integer overflow in the transfer function of a smart contract implementation for Hexagon HXG, an Ethereum ERC20 token, allows attackers to accomplish an unauthorized increase of digital assets by providing a to argument in conjunction with a large value argument, as exploited in the wild in Ma...

PT-2018-10417

Name of the Vulnerable Software and Affected Versions Hexagon HXG affected versions not specified Description The issue is related to an integer overflow in the transfer function of a smart contract implementation, which allows attackers to increase digital assets unauthorized by providing a to...

VulnCheck KEV: CVE-2018-11239

An integer overflow in the transfer function of a smart contract implementation for Hexagon HXG, an Ethereum ERC20 token, allows attackers to accomplish an unauthorized increase of digital assets by providing a to argument in conjunction with a large value argument, as exploited in the wild in Ma...

PT-2018-10057

Name of the Vulnerable Software and Affected Versions Social Chain SCA affected versions not specified Description The issue is related to an integer overflow in the transferMulti function of a smart contract implementation, allowing attackers to increase digital assets without authorization...