298339 matches found
EUVD-2026-92756
Ghost: Stored XSS via SVG Uploads Bypassing Sanitization...
Langflow has Authenticated Cross-Project File Disclosure via Unscoped MCP Resource Handlers
Summary Langflow's project-scoped MCP transport authenticates the caller for the projectid in the connection URL, but the subsequent resources/read operation does not authorize the resource URI being requested. An authenticated user can connect to their own project-scoped MCP endpoint and supply ...
Exploit for CVE-2026-97332
CVE-2026-97332 — WordPress User Private Files !NOTE This...
EUVD-2026-93510
@payloadcms/plugin-multi-tenant has a cross-tenant create issue...
Ghost: Stored XSS via Bookmark Card Images
Impact When creating a bookmark card, Ghost could store non-image files fetched from an external website as bookmark icons or thumbnails. This allowed any staff user, including Contributors, to host arbitrary HTML on the site's domain, possibly resulting in compromise of other staff users' admin...
CVE-2025-50565
CVE-2025-50565 Description Doubo ERP 1.0 has an SQL injection vulnerability due to a lack of filtering of user input, which can be remotely initiated by an attacker. Vulnerability Type SQL Injection Attack Type Remote Impact Information Disclosure true Has vendor confirmed true Discoverer...
Backstage has improper authorization in GitLab organizational user ingestion
Impact Deployments that enable GitLab organization event ingestion and rely on scoped catalog users as an access boundary may admit an unintended catalog identity. Depending on sign-in and permission configuration, this may allow unauthorized access with the permissions of a standard authenticate...
GHSA-GP6M-X9VW-5C5X Backstage has improper authorization in GitLab organizational user ingestion
Impact Deployments that enable GitLab organization event ingestion and rely on scoped catalog users as an access boundary may admit an unintended catalog identity. Depending on sign-in and permission configuration, this may allow unauthorized access with the permissions of a standard authenticate...
CVE-2026-93524
A flaw was found in xorg-x11-server. An authenticated local user can trigger an out-of-bounds heap memory read by sending specially crafted X Keyboard Extension XKB requests with inconsistent key range parameters. This flaw leads to information disclosure, allowing the user to read sensitive data...
CVE-2026-76437
A vulnerability in the web-based user interface of Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem SSM On-Prem, could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system. This vulnerability is due to improper validation of...
CVE-2026-20321
A vulnerability in the web-based management API for Cisco Application Policy Infrastructure Controller APIC could allow an authenticated, remote attacker to execute arbitrary commands as the root user. To exploit this vulnerability, the attacker must have valid administrative credentials. This...
CVE-2024-45337
Proof of Concept exploit per CVE-2024-45337 Questa repository contiene un exploit proof of concept per CVE-2024-45337. Può essere utilizzato per incapsulare ssh quando si interagisce con un server SSH implementato usando golang.org/x/crypto = v0.30.0, che memorizza le autorizzazioni in modo non...
DRUPAL-CONTRIB-2026-217
Advanced File System turns Drupal's file storage into a manageable, observable and maintainable subsystem. The Advanced Filesystem: Backup submodule does not sufficiently validate certain requests. This may allow an attacker to trick an authenticated user into performing unintended actions throug...
Exploit for CVE-2026-96451
CVE-2026-96451 WordPress Ultimate Member plugin = 2.13.1 -...
Exploit for Insecure Default Initialization of Resource in Raspberrypi Raspberry_Pi_Os_Lite
CVE-2021-38759 — Raspberry Pi OS Default Credentials Exploit...
EUVD-2026-93515
Payload: Field-level write access bypass in Payload on MongoDB...
qemu
QEMU LÉEME QEMU es un emulador y virtualizador de máquinas y espacio de usuario genérico y de código abierto. QEMU es capaz de emular una máquina completa mediante software sin necesidad de soporte de virtualización por hardware. Mediante el uso de traducción dinámica, alcanza un rendimiento muy...
ish
iSH Un proyecto para ejecutar un shell de Linux en iOS, utilizando emulación x86 en modo usuario y traducción de llamadas al sistema. Para el estado actual del proyecto, consulta la pestaña de issues y los registros de commits. Página de App Store Beta de TestFlight Servidor de Discord Wiki con...
Quasar Framework: Super-linear regex backtracking on User-Agent lets one request stall a Quasar SSR server
Summary One unauthenticated request with a crafted User-Agent stalls a Quasar SSR server for seconds. Quasar auto-installs its Platform plugin on every server-side render, and Platform.parseSSR feeds the raw, unbounded User-Agent request header into a chain of backtracking regular expressions in...