ownCloud Guests - User Enumeration

ownCloud Guests before 0.12.5 contains an unauthenticated user enumeration vulnerability caused by insufficient validation of the token in showPasswordForm at /apps/guests/register/email/token, letting unauthenticated attackers enumerate valid guest users, exploit requires no authentication. id:...

ResetNightmare

ResetNightmare Proof-of-concept POC tool for ResetNightmare CVE-2026-27912. ResetNightmare is a validation flaw in the Kerberos Change Password protocol that allows for resetting the password of any target user/computer account, without knowing the current one. The attack requires an unpatched...

cve-2025-53779-kerberos_bypass_reproduction

CVE-2025-53779: Microsoft Windows Kerberos Authentication Bypass CVSS Score: 9.8 Critical Status: Active exploitation in the wild Disclosure: Microsoft August 2025 Patch Tuesday Zero-Day Overview CVE-2025-53779 is a critical authentication bypass vulnerability in Microsoft Windows Kerberos protoc...

Microsoft Exchange - Pre-Auth SSRF / ACL Bypass (ProxyNotFound)

Microsoft Exchange Server contains a remote code execution caused by improper input validation in the server component, letting remote attackers execute arbitrary code, exploit requires network access to the server. id: CVE-2021-28480 info: name: Microsoft Exchange - Pre-Auth SSRF / ACL Bypass...

AAMVA-PDF417-Vulnerability-Research

PDF417 ID Validation Vulnerability Research Overview This repository contains comprehensive security research documenting critical vulnerabilities in AAMVA-standard PDF417 barcode validation systems affecting government IDs, enterprise solutions, and consumer applications. The research includes a...

EUVD-2026-111874

In the Linux kernel, the following vulnerability has been resolved: vsock/vmci: validate packet source for connected sockets vmcitransportrecvstreamcb looks up sockets first by the full source and destination tuple, then by destination only in the bound table. The fallback can select a...

CVE-2026-114646

A data-validation flaw exists in the BSON handling and binary serialization path of the MongoDB C Driver. When an application constructs a raw or lazy BSON document object from externally supplied binary data, the driver does not verify that the size quantity declared inside that data matches the...

CVE-2026-114646

A data-validation flaw exists in the BSON handling and binary serialization path of the MongoDB C Driver. When an application constructs a raw or lazy BSON document object from externally supplied binary data, the driver does not verify that the size quantity declared inside that data matches the...

EUVD-2026-108310

A data-validation flaw exists in the BSON handling and binary serialization path of the MongoDB C Driver. When an application constructs a raw or lazy BSON document object from externally supplied binary data, the driver does not verify that the size quantity declared inside that data matches the...

Unity Linux 20.1070a Security Update: kernel (UTSA-2026-143122)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-143122 advisory. In the Linux kernel, the following vulnerability has been resolved: i40e: add validation for ringlen param The ringlen parameter provided by the virtual function VF ...

PT-2026-121517

A data-validation flaw exists in the BSON handling and binary serialization path of the MongoDB C Driver. When an application constructs a raw or lazy BSON document object from externally supplied binary data, the driver does not verify that the size quantity declared inside that data matches the...

EUVD-2026-107145

The LatePoint WordPress plugin before 5.7.5 does not validate the client-supplied value that determines how much is charged for a booking against the amounts the service and site actually allow, allowing an unauthenticated visitor to make the amount due resolve to zero and obtain a confirmed...

CVE-2025-7043

The ForgeRock client is vulnerable to a validation flaw where refresh tokens are incorrectly treated as valid access tokens . This allows an attacker with a stolen or exposed refresh token to bypass the required client credential exchange flow and directly consume protected resources. This vulner...

CVE-2025-7043 Refresh Token Misuse via Validation Flaw in Multiple WSO2 Products Enables Unauthorized Resource Consumption

The ForgeRock client fails to correctly validate refresh tokens. This allows a refresh token to be treated as a valid access token, enabling its use for consuming protected resources. This bypasses the intended security control that requires valid client credentials in addition to a refresh token...

CVE-2026-112003

ProjectSend 2.0.0 before 2.7.0 contains a path validation flaw in OrphanFileScanner::isOrphan that allows staff with importorphans permission to treat tracked files as orphans. Attackers can submit ./ path aliases to the orphans import or delete endpoints, deleting or adopting other owners' files...

CVE-2026-112003

ProjectSend 2.0.0 before 2.7.0 contains a path validation flaw in OrphanFileScanner::isOrphan that allows staff with importorphans permission to treat tracked files as orphans. Attackers can submit ./ path aliases to the orphans import or delete endpoints, deleting or adopting other owners' files...

EUVD-2026-103456

ProjectSend 2.0.0 before 2.7.0 contains a path validation flaw in OrphanFileScanner::isOrphan that allows staff with importorphans permission to treat tracked files as orphans. Attackers can submit ./ path aliases to the orphans import or delete endpoints, deleting or adopting other owners' files...

CVE-2026-112003: Incorrect Behavior Order: Validate Before Canonicalize

ProjectSend 2.0.0 before 2.7.0 contains a path validation flaw in OrphanFileScanner::isOrphan that allows staff with importorphans permission to treat tracked files as orphans. Attackers can submit ./ path aliases to the orphans import or delete endpoints, deleting or adopting other owners' files...

PT-2026-116607

ProjectSend 2.0.0 before 2.7.0 contains a path validation flaw in OrphanFileScanner::isOrphan that allows staff with import orphans permission to treat tracked files as orphans. Attackers can submit ./ path aliases to the orphans import or delete endpoints, deleting or adopting other owners' file...

ProjectSend processing logic error vulnerability

Versions of ProjectSend from 2.0.0 to 2.7.0 have a processing logic vulnerability. This vulnerability stems from a path validation flaw in OrphanFileScanner::isOrphan. Employees with the importorphans permission can treat tracked files as isolated files. An attacker can import or delete endpoints...