204677 matches found
CVE-2026-102478
In affected versions of Octopus Server, an authenticated user with permission to modify roles could bypass the protections preventing access abuse resulting in privilege escalation. It was possible for the built-in role to be weakened and the attacker's account added to a privileged team. This wa...
Microsoft Exchange - Pre-Auth SSRF / ACL Bypass (ProxyNotFound)
Microsoft Exchange Server contains a remote code execution caused by improper input validation in the server component, letting remote attackers execute arbitrary code, exploit requires network access to the server. id: CVE-2021-28480 info: name: Microsoft Exchange - Pre-Auth SSRF / ACL Bypass...
CyberPanel - Command Injection
CyberPanel contains a command injection vulnerability in the /ftp/getresetstatus and /dns/getresetstatus endpoints.The vulnerability exists due to improper validation of the 'statusfile' parameter, which is directly used in a shell command.The security middleware only validates POST requests,...
CVE-2026-106414
An improper input validation flaw was found in the Mobile component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/504223609...
CVE-2026-102478
In affected versions of Octopus Server, an authenticated user with permission to modify roles could bypass the protections preventing access abuse resulting in privilege escalation. It was possible for the built-in role to be weakened and the attacker's account added to a privileged team. This wa...
EUVD-2026-94154
In affected versions of Octopus Server, an authenticated user with permission to modify roles could bypass the protections preventing access abuse resulting in privilege escalation. It was possible for the built-in role to be weakened and the attacker's account added to a privileged team. This wa...
CVE-2026-102478
In affected versions of Octopus Server , an authenticated user with permissions to modify roles can achieve privilege escalation . The vulnerability is caused by the improper validation of unsafe equivalence in inputs , allowing an attacker to weaken built-in roles and add their account to a priv...
CVE-2026-102478
In affected versions of Octopus Server, an authenticated user with permission to modify roles could bypass the protections preventing access abuse resulting in privilege escalation. It was possible for the built-in role to be weakened and the attacker's account added to a privileged team. This wa...
CVE-2026-97679
IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command 'Code Injection' related to improper input validation...
CVE-2026-97673
IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper input validation...
CVE-2026-97678
IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper input validation...
CVE-2025-69822-Atomberg_Erica_SmatFan_Security_Assessment
CVE-2025-69822-AtombergEricaSmatFanSecurityAssessment 이 취약점은 Atomberg Erica Smart Fan펌웨어 버전 1.0.36의 장치 가용성과 안정적인 작동에 영향을 미칩니다. 문제는 위조된 연결 해제 프레임에 대한 보호 메커니즘 부재와 장치의 폴백 또는 재연결 검증 부족으로 인해 발생합니다. 이 취약점에 대한 개념 증명PoC은 첨부된 PDF에 문서화되어 있으며, 해당 조직의 내부 보안 검토를 위해 원래 제공된 것입니다. 발견자 - CipherX1802...
CVE-2025-56499
CVE-2025-56499 로컬 룰 제공자의 경로 검증 부재로 인한 임의 파일 읽기 업스트림 수정: https://github.com/MetaCubeX/mihomo/pull/2177 영향받는 버전: mihomo = v1.19.11 요약 rule-providers 설정을 파싱할 때 type = "file" 분기에서 제공된 경로를 검증하지 못합니다. schema.Path를 제어하는 인증된 공격자는 제공자가 읽을 수 있는 모든 로컬 파일을 가리키도록 할 수 있습니다. 대부분의 임의 파일은 예상되는 룰 형식을 따르지 않기 때문에, 파...
roundcube-cve-2025-49113-lab
"免責事項: 教育目的のみ" Roundcube Webmail RCE – CVE-2025-49113 ラボ このリポジトリは、管理されたラボ環境で Roundcube Webmail CVE-2025-49113 を段階的に悪用し、/secret.txt に保存された秘密情報を取得するまでの手順をまとめたものです。 ⚠️ 免責事項 すべての作業は、テスト実施の許可を得たラボ / トレーニング環境に対して行われました。 自分が所有または管理していないシステムに対しては、これらの手法を使用しないで ください。 チャレンジ Roundcube Webmail...
CVE-2026-97673 Langflow OSS is affected by multiple vulnerabilities
IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper input validation...
EUVD-2026-94121
IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper input validation...
CVE-2026-97673 Langflow OSS is affected by multiple vulnerabilities
IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper input validation...
CVE-2026-97673
The Langflow OSS software versions 1.0.0 through 1.12.2 are affected by CVE-2026-97673 , which allows a remote authenticated attacker to execute arbitrary code due to improper input validation (CWE-693 ). This vulnerability can lead to high impact on confidentiality, integrity, and availability. ...
PT-2026-107679
The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.16.0 until 3.0.14, ThreadSafeCookieStore incompletely validates cookie Domain attributes. Missing private-section and default public-suffix rules, absent...
