Apache Solr <=8.8.1 - Server-Side Request Forgery

Apache Solr versions 8.8.1 and prior contain a server-side request forgery vulnerability. The ReplicationHandler normally registered at "/replication" under a Solr core in Apache Solr has a "masterUrl" also "leaderUrl" alias parameter that is used to designate another ReplicationHandler on anothe...

ASUS GT-AC2900 - Authentication Bypass

ASUS GT-AC2900 devices before 3.0.0.4.386.42643 allows authentication bypass when processing remote input from an unauthenticated user, leading to unauthorized access to the administrator application. This relates to handlerequest in router/httpd/httpd.c and authcheck in webhook.o. An...

Apache Cocoon 2.1.12 - XML Injection

Apache Cocoon 2.1.12 contains an XML injection caused by parsing user-provided XML with external system entities in StreamGenerator, letting attackers access arbitrary files on the server, exploit requires sending malicious XML. id: CVE-2020-11991 info: name: Apache Cocoon 2.1.12 - XML Injection...

PaperCut < 22.1.3 - Path Traversal

PaperCut NG and PaperCut MF before 22.1.3 are vulnerable to path traversal which enables attackers to read, delete, and upload arbitrary files. id: CVE-2023-39143 info: name: PaperCut 22.1.3 - Path Traversal author: pdteam severity: critical description: PaperCut NG and PaperCut MF before 22.1.3...

Joomla! <3.7.1 - SQL Injection

Joomla! before 3.7.1 contains a SQL injection vulnerability. An attacker can possibly obtain sensitive information from a database, modify data, and execute unauthorized administrative operations in the context of the affected site. id: CVE-2017-8917 info: name: Joomla! 3.7.1 - SQL Injection...

CVE-2026-106244

An incorrect authorization flaw was found in the Permissions component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/502475175...

CVE-2022-46463

CVE-2022-46463 CVE-2022-46463POC Harbor 未認証 脆弱性の詳細はStackコミュニティをご覧ください 使用方法 python3 cvve-2022-46463.py -u https://127.0.0.1:5003 オプション -u URL, --url URL Target URL e.g. http://example.com -h, --help Show help message and exit docker pull xxx コマンドを直接貼り出しています...

CVE-2026-106471

A flaw in Candlepin involves broken object-level authorization within the central authorization filter. The system incorrectly grants access if any one of multiple @Verify-annotated parameters is accessible, rather than requiring access to every verified entity. A low-privilege authenticated atta...

EUVD-2026-94155

A flaw was found in Candlepin. The central authorization filter incorrectly grants access when any one of multiple @Verify-annotated parameters is accessible, instead of requiring access to every verified entity. A low-privilege authenticated attacker who can access the first referenced object ca...

CVE-2026-106471 Candlepin: candlepin: broken object-level authorization via verifyauthorizationfilter multi-@verify hasaccess latching

A flaw was found in Candlepin. The central authorization filter incorrectly grants access when any one of multiple @Verify-annotated parameters is accessible, instead of requiring access to every verified entity. A low-privilege authenticated attacker who can access the first referenced object ca...

CVE-2026-106471 Candlepin: candlepin: broken object-level authorization via verifyauthorizationfilter multi-@verify hasaccess latching

A flaw was found in Candlepin. The central authorization filter incorrectly grants access when any one of multiple @Verify-annotated parameters is accessible, instead of requiring access to every verified entity. A low-privilege authenticated attacker who can access the first referenced object ca...

CVE-2026-106471

A flaw was found in Candlepin. The central authorization filter incorrectly grants access when any one of multiple @Verify-annotated parameters is accessible, instead of requiring access to every verified entity. A low-privilege authenticated attacker who can access the first referenced object ca...

proftpd-mod_copy-cve-2015-3306

ProFTPD 1.3.5 modcopy 脆弱性 CVE-2015-3306 このリポジトリには、Hackviser プラットフォーム上の脆弱な ProFTPD 1.3.5 サービスを悪用するラボレポートが含まれています。 このラボでは、modcopy 脆弱性 CVE-2015-3306 を利用して、機密ファイル secret.txt への不正アクセスを実証します。 詳細な悪用手順と緩和策の推奨事項は report.md に含まれています。...

CVE-2026-106323

Missing authorization in Chrome for iOS in Google Chrome on on iOS pri...

PT-2026-107673

In OpenStack Zaqar before 23.0.1, the WebSocket transport fails to bind the project identifier in subsequent requests to the project authenticated by the Keystone token. An authenticated user with a valid token for one project may substitute another project's UUID to enumerate, inspect, create, o...

CVE-2026-106312

Missing authorization in SignIn in Google Chrome prior to 155.0.8059.3...

The vulnerability of Atlassian Data Center software products lies in the use of files and directories accessible from external parties, which allows attackers to gain unauthorized access to protected information.

The vulnerability of Atlassian Data Center software lies in the use of files and directories accessible from external parties. Exploiting this vulnerability could allow a malicious actor to gain unauthorized access to protected information...

Linux Distros Unpatched Vulnerability : CVE-2026-104048

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in SSSD. In trust-enabled identity management environments, SSSD evaluates Host-Based Access Control HBAC rules by stripping domain qualifiers...

PT-2026-107587

Name of the Vulnerable Software and Affected Versions Cisco License On-Prem affected versions not specified Description An issue in the web-based management interface of Cisco License On-Prem, previously known as Cisco Smart Software Manager On-Prem, allows an unauthenticated remote attacker to...

PT-2026-107691

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.4.3 Splunk Enterprise versions prior to 10.2.7 Splunk Enterprise versions prior to 10.0.10 Splunk Enterprise versions prior to 9.4.15 Description An improper access control issue exists in the REST API,...