neko

n.eko Bienvenido a Neko, un navegador virtual autogestionado que se ejecuta en Docker y utiliza tecnología WebRTC. Neko es una herramienta potente que te permite ejecutar un navegador completamente funcional en un entorno virtual , brindándote la capacidad de acceder a Internet de forma segura y...

WordPress Restrict User Access <= 2.5 - Cross-Site Scripting

WordPress Restrict User Access – Membership Plugin with Force versions before 2.6 is vulnerable to Reflected Cross-Site Scripting via the 'ruasection' parameter in the admin level edit page. id: CVE-2024-29138 info: name: WordPress Restrict User Access = 2.5 - Cross-Site Scripting author: Shivam...

rakkess

rakkess Review Access - kubectl plugin to show an access matrix for server resources Intro Have you ever wondered what access rights you have on a provided kubernetes cluster? For single resources you can use kubectl auth can-i list deployments, but maybe you are looking for a complete overview?...

Cacti 1.2.24 - SQL Injection

Cacti is an open source operational monitoring and fault management framework. Affected versions are subject to a SQL injection discovered in graphview.php. Since guest users can access graphview.php without authentication by default, if guest users are being utilized in an enabled state, there...

CVE-2025-46818

CVE-2025-46818 – Redis Lua Sandbox Cross-User Escape Sandbox escape via deprecated Lua APIs and mutable metatables on Redis 8.2.1. Overview Redis 8.2.1 keeps deprecated Lua builtins getfenv, setfenv, newproxy exposed to scripts and fails to lock metatables for basic types. An attacker can inject...

CVE-2026-54519

CVE-2026-54519 ai-agent-automation missing ownership checks in memory APIs allowed cross-user memory read and deletion. Primary advisory: GHSA-qv97-83w4-ff86 Researcher credit: @chaitanyagarware At a Glance Field| Value ---|--- CVE| CVE-2026-54519 GHSA| GHSA-qv97-83w4-ff86 Project|...

WordPress User Access Manager plugin <= 2.3.18 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin User Access Manager versions = 2.3.18...

CVE-2026-19797

The User Access Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tabgroupsection' parameter in all versions up to, and including, 2.3.18 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

CVE-2026-19797

User Access Manager is a WordPress plugin vulnerable to Reflected Cross-Site Scripting (XSS) via the tab_group_section parameter in all versions up to and including 2.3.18 . The root cause is insufficient input sanitization and output escaping . An unauthenticated attacker who can trick a victim ...

CVE-2026-19797 User Access Manager <= 2.3.18 - Reflected Cross-Site Scripting via 'tab_group_section' Parameter

The User Access Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tabgroupsection' parameter in all versions up to, and including, 2.3.18 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

EUVD-2026-74605

The User Access Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tabgroupsection' parameter in all versions up to, and including, 2.3.18 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

CVE-2026-86994 n8n: Cross-User Active Workflow ID and Lifecycle Event Disclosure via Missing userId Filter

n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the /rest/active-workflows endpoint returned every active workflow ID on the instance to any member regardless of sharing. Workflow activation, deactivation, and publication push events were also broadcast ...

CVE-2026-86994

n8n , an open-source workflow automation platform, contained a missing userId filter that allowed cross-user information disclosure. The /rest/active-workflows endpoint returned every active workflow ID on the instance to any authenticated member regardless of sharing permissions, and lifecycle p...

EUVD-2026-74176

The Okta Hyperdrive Integration installer does not mask the OAuth client secret when passed as an MSI property. The credential is recorded in plaintext in the installer log, the Application Event Log, and the process command line, all of which are readable by an authenticated local user on the...

CVE-2026-78627

Okta Hyperdrive Integration installer exposes the OAuth client secret in plaintext when it is passed as an MSI property. The credential is recorded in three locations readable by an authenticated local user: the installer log , the Application Event Log , and the process command line . The CVSS 3...

CVE-2026-77654

Horizon Security Analyzer (formerly AlgoSec Firewall Analyzer) on Linux 64-bit contains an Improper Privilege Management flaw affecting versions A33.10, A33.20, and A33.30 . The root cause is a misconfigured entry in the sudoers file : a local user with command-line access can escalate privileges...

CVE-2026-61688 SolidInvoice allows cross-user access to API token request history via writable DataGrid LiveComponent props

SolidInvoice is an open-source invoicing platform. Prior to version 3.0.1, an authenticated user can view the API request history of any other user's API tokens within the same company by manipulating two writable Symfony UX LiveComponent props on the DataGrid component. Version 3.0.1 fixes the...

CVE-2026-61688

SolidInvoice , an open-source invoicing platform, is affected by a cross-user information disclosure vulnerability prior to version 3.0.1 . An authenticated user can view the API request history of any other user's API tokens within the same company by manipulating two writable Symfony UX LiveCom...

CVE-2026-61688 SolidInvoice allows cross-user access to API token request history via writable DataGrid LiveComponent props

SolidInvoice is an open-source invoicing platform. Prior to version 3.0.1, an authenticated user can view the API request history of any other user's API tokens within the same company by manipulating two writable Symfony UX LiveComponent props on the DataGrid component. Version 3.0.1 fixes the...

CVE-2026-85624

Blinko 1.8.7 is vulnerable to a cross-user private note disclosure in the noteReferenceList procedure, which performs no ownership verification on supplied note identifiers. An authenticated attacker can enumerate sequential note IDs to retrieve the complete content of other users' private notes ...