Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS : OpenStack Aodh and Watcher vulnerability (USN-8870-1)

The remote Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-8870-1 advisory. Chen YuXiang discovered that OpenStack Aodh did not correctly enforce project scoping in its alarm list API and that the OpenStack Watcher...

The vulnerability of Visual Studio Code’s source editor, related to the use of a name with an incorrect reference, allows attackers to gain unauthorized access to protected information.

The vulnerability of Visual Studio Code’s source editor is related to the use of a name with an incorrect reference. Exploiting this vulnerability could allow an attacker, working remotely, to gain unauthorized access to protected information...

Authentication & Authorization Header Spoofing Bypasses Brocade Fabric OS SANnav-Internal REST API Gate

: An authorization logic vulnerability exists in the Brocade Fabric OS versions before 10.0.1 REST API gateway. The internal gate guarding restricted management endpoints relies exclusively on client-controlled HTTP headers. An authenticated user with any valid REST session can spoof these header...

PT-2026-107195

Name of the Vulnerable Software and Affected Versions ClearPass Policy Manager affected versions not specified Description An issue exists in the affected interface of ClearPass Policy Manager that may allow an unauthenticated remote attacker to bypass authentication controls. This could lead to...

cve-2020-25540

ThinkAdmin قائمة الدليل غير المصرح بها / قراءة ملف عشوائي cve-2020-25540 طريقة الاستخدام python3 cve-2020-25540.py url...

CVE-2021-43471

CVE-2021-43471 ثغرة حرمان من الخدمة بسبب الوصول غير المصرح به إلى طابعات Canon المنتج المتأثر: LBP223 الوقت: 2021.11.3 لا يتطلب تسجيل الدخول في وضع مدير النظام كلمة مرور حساب أو رقم تعريف شخصي. يمكن للمهاجم إيقاف تشغيل الجهاز عن بُعد بعد الدخول إلى الخلفية، مما يخلق ثغرة حرمان من الخدمة...

CVE-2023-43317

CVE-2023-43317 يمكن لمستخدم عادي رفع صلاحياته عبر معامل userPermissionsLIst في مكون Session Storage، للحصول على وصول غير مصرح به إلى الموارد والميزات الإدارية. قد يؤدي ذلك إلى وصول غير مصرح به للبيانات، وتعديل البيانات، وإجراءات أخرى تقتصر عادةً على المسؤولين. المنتج المعرض للخطر:- Coign Card...

CVE-2026-0461

Insufficient boundary validation in the USB boot mode implementation of AMD Zynq™ UltraScale+ MPSoC and RFSoC devices could allow unbounded Device Firmware Upgrade DFU download requests to overflow the DDR receive buffer into FSBL memory, potentially resulting in unauthorized code execution durin...

CVE-2025-36911-exploit

WhisperPair Python CLI أداة استغلال سريعة لثغرة CVE-2025-36911 مكتوبة بلغة Python لاختبار أجهزتنا المؤلف: Sébastien Dudek @FlUxIuS @ Penthertz الفضل: whisperpair.eu لاكتشاف الثغرة، وتطبيق APK الرائع من @ZalexDev الذي اختصر وقت التنفيذ wpair-app ⚠️ إخلاء مسؤولية لأغراض البحث الأمني المصرّح به فقط...

CVE-2026-0461

The AMD Zynq™ UltraScale+ MPSoC and RFSoC devices are vulnerable to a buffer overflow due to insufficient boundary validation in the USB boot mode implementation. An attacker could send unbounded Device Firmware Upgrade (DFU) download requests, causing the DDR receive buffer to overflow into FSBL...

CVE-2026-0461

Insufficient boundary validation in the USB boot mode implementation of AMD Zynq™ UltraScale+ MPSoC and RFSoC devices could allow unbounded Device Firmware Upgrade DFU download requests to overflow the DDR receive buffer into FSBL memory, potentially resulting in unauthorized code execution durin...

CVE-2026-71299

A flaw was found in Maestro. Its REST API write endpoints were registered without proper authentication middleware. This allows a remote attacker to perform unauthorized write operations, such as creating, modifying, or deleting consumers and resource bundles. This could lead to data integrity...

CVE-2026-105681

Ghost is a Node.js content management system. From 5.9.0 until 6.44.1, an input validation issue allowed members to access comments they were not authorized to access. This issue is fixed in version 6.44.1...

EUVD-2026-92711

A flaw was found in the maestro gRPC broker. This vulnerability allows a remote attacker, with a valid client certificate, to bypass authentication. This bypass enables the attacker to subscribe to other consumers' event streams, leading to unauthorized information disclosure, or to publish forge...

EUVD-2026-92710

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the delete-share-link RPC retrieves a caller-selected share-link ID and verifies only that the caller can edit the parent file. It does not verify that the caller created the share link or has owner or administrator...

CVE-2018-9995-rs

Aperçu Ce dépôt contient une preuve de concept PoC d'exploitation implémentée en Rust ciblant CVE-2018-9995. Le code est à but de recherche et d'éducation uniquement. Détails de la CVE Identifiant : CVE-2018-9995 Résumé : Preuve de concept d'exploitation démontrant la vulnérabilité voir les avis...

Flink_RCE

Apache Flink Web Dashboard: وصول غير مصرح به، رفع jar خبيث يؤدي إلى تنفيذ أوامر برمجية عن بُعد msf nc استخدام python: python 02-Flink.py http://10.10.20.100:8081 nc.jar...

CVE-2026-71299 Maestro: maestro: rest api write endpoints registered without authentication middleware

A flaw was found in Maestro. Its REST API write endpoints were registered without proper authentication middleware. This allows a remote attacker to perform unauthorized write operations, such as creating, modifying, or deleting consumers and resource bundles. This could lead to data integrity...

EUVD-2026-92758

A flaw was found in Maestro. Its REST API write endpoints were registered without proper authentication middleware. This allows a remote attacker to perform unauthorized write operations, such as creating, modifying, or deleting consumers and resource bundles. This could lead to data integrity...

CVE-2026-71299

A flaw was discovered in Maestro where its REST API write endpoints were registered without proper authentication middleware . This vulnerability allows a remote attacker to perform unauthorized write operations, specifically creating, modifying, or deleting consumers and resource bundles . Such ...