EUVD-2026-94810

An authorization vulnerability in Apache DolphinScheduler allows authenticated users to retrieve other users' account information through the /dolphinscheduler/users/list-all endpoint without the required permissions. The endpoint fails to enforce the necessary authorization checks before returni...

CVE-2026-12260 SQL injection in the NetBoard CRM demo platform

SQL injection in the NetBoard CRM demo platform; specifically, the vulnerable component is the ‘user-name’ POST parameter in the ‘/module/auth/recovery.php’ endpoint. The parameter is vulnerable to blind attacks based on Boolean, error, time-based and UNION techniques. Exploitation allows attacke...

CVE-2026-12260

The NetBoard CRM demo platform is vulnerable to a SQL injection flaw in the ‘user-name’ POST parameter of the ‘/module/auth/recovery.php’ endpoint. The vulnerability allows for blind attacks using Boolean, error, time-based, and UNION techniques. Successful exploitation enables an attacker to ext...

EUVD-2026-94803

SQL injection in the NetBoard CRM demo platform; specifically, the vulnerable component is the ‘user-name’ POST parameter in the ‘/module/auth/recovery.php’ endpoint. The parameter is vulnerable to blind attacks based on Boolean, error, time-based and UNION techniques. Exploitation allows attacke...

EUVD-2026-94798

In Brocade ASCG before 3.5.0, a local unauthorized user on the ASCG VM who can issue a request to the SANnav host network namespace can extract stored management credentials for onboarded SANnav instances and compromise connected Brocade SANnav servers or managed Brocade Fibre Channel switches...

EUVD-2026-94792

An authentication flaw exists in the Brocade ASCG administrative management service component. An unauthenticated network user can issue direct API requests to perform privileged actions, including accessing sensitive system configuration mapping data, modifying managed device inventories, and...

CVE-2026-85488

Brocade ASCG versions prior to 3.5.0 are susceptible to a hardcoded credential exposure. A well-known Brocade default password is embedded within a script distributed to every customer. A local authenticated user with read access to the installation path can discover these credentials. If default...

fortigate-cve-2022-40684-tool

Description このツールは、セキュリティ専門家が公開されたCMDB APIエンドポイントと対話することで、FortiGateデバイスにおけるCVE-2022-40684への曝露を特定・検証できるようにします。 管理ユーザーの列挙、ユーザーグループの列挙、および管理された環境での分析のための選択的な設定抽出をサポートします。 Features 脆弱性検出 管理者ユーザーの列挙 ローカルユーザーおよびグループの列挙 対象を絞った設定ダンプ ラボ環境向け安全なテストユーティリティ Vulnerability Details CVE: CVE-2022-40684 Type: 認証バイ...

CVE-2026-94245

The Wallet System for WooCommerce WordPress plugin before 2.8.0 does not verify that the user submitting a wallet transfer owns the wallet being debited, allowing any authenticated user, including one with only the Subscriber role, to move an arbitrary user's wallet balance, including an...

CVE-2026-94244

The Wallet System for WooCommerce WordPress plugin before 2.8.0 does not perform any capability check, and relies on a token any authenticated user can obtain from a front-end page, before generating a report containing every customer's wallet transaction history, allowing any authenticated user,...

CVE-2026-94258

The SMS Alert WordPress plugin versions 3.6.4 through 4.0.0 contains a vulnerability where it fails to verify if an acting administrator has permission to manage specific users before returning their stored billing phone numbers. This flaw allows an administrator of one site on a multisite networ...

sudowp-crowdsignal-forms

SudoWP Crowdsignal Forms 이것은 원본 Crowdsignal Forms 플러그인의 SudoWP 보안 포크입니다. !WARNING 보안 공지 : 원본 "Crowdsignal Forms" 플러그인버전 = 1.7.2에는 인증된 사용자가 소유하지 않은 설문을 수정할 수 있는 중대한 인증 누락 취약점CVE-2025-69015이 포함되어 있습니다. 이 SudoWP 에디션은 이 취약점을 패치했습니다. 설치 방법 1. 원본 Crowdsignal Forms 플러그인을 비활성화 합니다. 2. 충돌을 방지하기 위해 원본...

CVE-2024-1086

CVE-2024-1086 CVE-2024-1086에 대한 범용 로컬 권한 상승 개념 증명 익스플로잇. v5.14에서 v6.6 사이의 대부분의 Linux 커널에서 작동하며 Debian, Ubuntu 및 KernelCTF를 포함합니다. KernelCTF 이미지에서 성공률은 99.4%입니다. https://github.com/Notselwyn/CVE-2024-1086/assets/68616630/a3d43951-94ab-4c09-a14b-07b81f89b3de 블로그 포스트 / 분석 문서 익스플로잇에 대한 전체 분석 문서배경 정보 ...

CVE-2026-87673

An OS command injection vulnerability exists in maintenance command-line diagnostic utilities on Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. The binary fails to sanitize user-supplied input options when invoking underlying system commands through a shell interpreter. A...

CVE-2026-44595

CVE-2026-44595 — YAMCS IAM APIを介した未認可ユーザー列挙 概要 yamcs-coreのIAM APIエンドポイント（listUsers、getUser、listGroups、getGroup）は、必要なSystemPrivilege.ControlAccessチェックを実施していません。認証されたユーザーは誰でも（権限がなくても）すべてのユーザーアカウント、スーパーユーザーステータス、グループメンバーシップを列挙できます。 フィールド| 値 ---|--- CVE| CVE-2026-44595 深刻度| MEDIUM CVSS 4.3 CWE|...

CVE-2026-87660

An improper file permission and missing authorization vulnerability exists in the diagnostic kernel module subsystem of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. An unprivileged local user can invoke privileged hardware tests, force system error conditions, reset...

EUVD-2026-94697

An improper file permission and missing authorization vulnerability exists in the diagnostic kernel module subsystem of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. An unprivileged local user can invoke privileged hardware tests, force system error conditions, reset...

CVE-2026-94575

A logic vulnerability exists in the Brocade Fabric OS web management framework in versions before 10.0.1 . This flaw allows an authenticated, low-privileged user to bypass inner Role-Based Access Control (RBAC) checks under specific environmental conditions. Successful exploitation can lower the ...

Ray < 2.52.0 - Remote Code Execution

Ray versions prior to 2.52.0 allow unauthenticated remote code execution via the job submission API at /api/jobs/. A weak User-Agent heuristic rejecting Mozilla-prefixed headers can be bypassed by non-browser clients, enabling arbitrary command execution when the dashboard is network-reachable. i...

Citrix SD-WAN Center - Local File Inclusion

Citrix SD-WAN Center is susceptible to local file inclusion via the applianceSettingsFileTransfer function in ApplianceSettingsController. The function does not sufficiently validate or sanitize HTTP request parameter values used to construct a file system path. An attacker can trigger this...