298337 matches found
Langflow has Authenticated Cross-Project File Disclosure via Unscoped MCP Resource Handlers
Summary Langflow's project-scoped MCP transport authenticates the caller for the projectid in the connection URL, but the subsequent resources/read operation does not authorize the resource URI being requested. An authenticated user can connect to their own project-scoped MCP endpoint and supply ...
Exploit for CVE-2026-97332
CVE-2026-97332 — WordPress User Private Files !NOTE This...
EUVD-2026-93510
@payloadcms/plugin-multi-tenant has a cross-tenant create issue...
Ghost: Stored XSS via Bookmark Card Images
Impact When creating a bookmark card, Ghost could store non-image files fetched from an external website as bookmark icons or thumbnails. This allowed any staff user, including Contributors, to host arbitrary HTML on the site's domain, possibly resulting in compromise of other staff users' admin...
CVE-2025-50565
CVE-2025-50565 Beschreibung Doubo ERP 1.0 weist eine SQL-Injection-Schwachstelle auf, die auf einer fehlenden Filterung von Benutzereingaben beruht und von einem Angreifer remote ausgelöst werden kann. Schwachstellentyp SQL Injection Angriffstyp Remote Auswirkung: Informationsoffenlegung true Vom...
Backstage has improper authorization in GitLab organizational user ingestion
Impact Deployments that enable GitLab organization event ingestion and rely on scoped catalog users as an access boundary may admit an unintended catalog identity. Depending on sign-in and permission configuration, this may allow unauthorized access with the permissions of a standard authenticate...
GHSA-GP6M-X9VW-5C5X Backstage has improper authorization in GitLab organizational user ingestion
Impact Deployments that enable GitLab organization event ingestion and rely on scoped catalog users as an access boundary may admit an unintended catalog identity. Depending on sign-in and permission configuration, this may allow unauthorized access with the permissions of a standard authenticate...
CVE-2026-93524
A flaw was found in xorg-x11-server. An authenticated local user can trigger an out-of-bounds heap memory read by sending specially crafted X Keyboard Extension XKB requests with inconsistent key range parameters. This flaw leads to information disclosure, allowing the user to read sensitive data...
CVE-2026-76437
A vulnerability in the web-based user interface of Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem SSM On-Prem, could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system. This vulnerability is due to improper validation of...
CVE-2026-20321
A vulnerability in the web-based management API for Cisco Application Policy Infrastructure Controller APIC could allow an authenticated, remote attacker to execute arbitrary commands as the root user. To exploit this vulnerability, the attacker must have valid administrative credentials. This...
CVE-2024-45337
Proof of Concept exploit per CVE-2024-45337 Questa repository contiene un exploit proof of concept per CVE-2024-45337. Può essere utilizzato per incapsulare ssh quando si interagisce con un server SSH implementato usando golang.org/x/crypto = v0.30.0, che memorizza le autorizzazioni in modo non...
DRUPAL-CONTRIB-2026-217
Advanced File System turns Drupal's file storage into a manageable, observable and maintainable subsystem. The Advanced Filesystem: Backup submodule does not sufficiently validate certain requests. This may allow an attacker to trick an authenticated user into performing unintended actions throug...
Exploit for CVE-2026-96451
CVE-2026-96451 WordPress Ultimate Member plugin = 2.13.1 -...
Exploit for Insecure Default Initialization of Resource in Raspberrypi Raspberry_Pi_Os_Lite
CVE-2021-38759 — Raspberry Pi OS Default Credentials Exploit...
EUVD-2026-93515
Payload: Field-level write access bypass in Payload on MongoDB...
qemu
QEMU README QEMU è un emulatore e virtualizzatore generico e open source per macchine e spazio utente. QEMU è in grado di emulare una macchina completa via software senza alcuna necessità di supporto hardware per la virtualizzazione. Tramite la traduzione dinamica, raggiunge prestazioni molto...
ish
iSH Un progetto per ottenere una shell Linux in esecuzione su iOS, utilizzando l'emulazione x86 in spazio utente e la traduzione delle system call. Per lo stato attuale del progetto, controlla la scheda "issues" e i log dei commit. Pagina App Store Beta di TestFlight Server Discord Wiki con aiuto...
GHSA-68JQ-FHCH-4XQ4 Quasar Framework: Super-linear regex backtracking on User-Agent lets one request stall a Quasar SSR server
Summary One unauthenticated request with a crafted User-Agent stalls a Quasar SSR server for seconds. Quasar auto-installs its Platform plugin on every server-side render, and Platform.parseSSR feeds the raw, unbounded User-Agent request header into a chain of backtracking regular expressions in...
Quasar Framework: Super-linear regex backtracking on User-Agent lets one request stall a Quasar SSR server
Summary One unauthenticated request with a crafted User-Agent stalls a Quasar SSR server for seconds. Quasar auto-installs its Platform plugin on every server-side render, and Platform.parseSSR feeds the raw, unbounded User-Agent request header into a chain of backtracking regular expressions in...