Directus < 11.9.0 - Version Disclosure

Directus versions from 9.0.0 before 11.9.0 expose the exact running version through the OpenAPI specification returned by the unauthenticated /server/specs/oas endpoint. The version is placed in the OpenAPI info.version field, letting an unauthenticated attacker fingerprint the precise Directus...

Dify <=1.14.1 - Unauthenticated Plugin Daemon Path Traversal

Dify version 1.14.1 and prior are affected by an unauthenticated path traversal in the Plugin Daemon icon proxy endpoint. The /console/api/workspaces/current/plugin/icon endpoint requires no authentication and passes the filename query parameter unsanitized into the internal Plugin Daemon REST AP...

CTF_CVE-2020-7471

DOBBYISFREE! CTF: 2020 Christmas CTF Категория: WEB Ключевое слово: DOBBYISFREE! Сложность: ★★★☆☆ Предыстория Обычно веб-хакеры изучают SQL-инъекции на MySQL, поэтому я решил создать задачу с использованием PostgreSQL, чтобы у них была возможность испытать атаки на разные СУБД. Решение...

CVE-2020-9483

CVE-2020-9483 PoC уязвимости SQL-инъекции CVE-2020-9483, Apache SkyWalking Использование:python3 CVE-2020-9483.py -ip 127.0.0.1 С помощью этого скрипта можно получить версию базы данных через SQL-инъекцию. Нажмите звездочку, если вам понравился этот скрипт. Если вы считаете, что этот PoC помог ва...

CVE-2025-47812

CVE-2025-47812 Как работает этот метод обнаружения? Этот шаблон Nuclei обнаруживает экземпляры Wing FTP Server, уязвимые для CVE-2025-47812, путем выявления версий старше 7.4.4, отображаемых в HTML-ответе веб-клиента. Как запустить этот скрипт? 1. Скачайте Nuclei отсюда 2. Скопируйте шаблон в ваш...

CVE-2023-35078

CVE-2023-35078 Этот скрипт этично проверяет наличие cve-2023-35078, запрашивая конечную точку /ping API Ivanti EPMM. /ping просто отвечает версией VSP, а не пытается извлечь данные об устройствах или администраторах. Использование: ./CVE-2023-35078 Этот скрипт предполагает соединения по https на...

PT-2026-88503

Impact The endpoint /rest/active-workflows returned every active workflow ID on the instance to any member, regardless of sharing, and workflow activation, deactivation and publication push events were broadcast to every connected client, carrying workflow IDs, version IDs and activation-error...

CVE-2026-79777 rclone before v1.75.0 Information Disclosure via RC API

rclone before v1.75.0 includes full Go stack traces in RC API error responses when panics occur. Attackers can trigger panics to leak internal file paths, module versions, goroutine states, and memory addresses...

CVE-2026-27463

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, the HTML title attribute of the logo in the login page contains the complete iTop version. This issue has been fixed in version 3.2.3...

CVE-2026-27463

Combodo iTop , a web-based IT service management tool, prior to version 3.2.3 , exposes the full application version in the HTML title attribute of the logo on the login page. This allows unauthenticated remote attackers to fingerprint the exact version, facilitating targeted exploitation of know...

EUVD-2026-64124

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, the HTML title attribute of the logo in the login page contains the complete iTop version. This issue has been fixed in version 3.2.3...

CVE-2026-27463 Combodo iTop: Version disclosure via login page logo

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, the HTML title attribute of the logo in the login page contains the complete iTop version. This issue has been fixed in version 3.2.3...

CVE-2026-27463 Combodo iTop: Version disclosure via login page logo

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, the HTML title attribute of the logo in the login page contains the complete iTop version. This issue has been fixed in version 3.2.3...

CVE-2026-73290

RustFS prior to 1.0.0-beta.12 contains an anonymous ListObjectVersions bypass where a ListBucket check is used if no bucket-policy grant exists, skipping the policy_allowed path (deny_anonymous_table_data_plane_if_needed and RestrictPublicBuckets). This allows buckets that permit anonymous listin...

CVE-2026-19325

A security vulnerability has been detected in IncomeStreamSurfer roo-code-memory-bank-mcp-server up to 9dcb2fb5e6b65a35ac1983885a6d4e5621a0081e. This affects the function readMemoryBankFile/appendMemoryBankEntry of the file src/index.ts of the component readmemorybankfile/appendmemorybankentry...

CVE-2026-56578

HCL MyCloud was affected by Server Version Disclosure. It may help attackers identify and exploit known vulnerabilities affecting the disclosed software versions...

EUVD-2026-46341

HCL MyCloud was affected by Server Version Disclosure. It may help attackers identify and exploit known vulnerabilities affecting the disclosed software versions...

CVE-2026-56578 HCL MyCloud was affected by Server Version Disclosure

HCL MyCloud was affected by Server Version Disclosure. It may help attackers identify and exploit known vulnerabilities affecting the disclosed software versions...

CVE-2026-56578

HCL MyCloud was affected by Server Version Disclosure. It may help attackers identify and exploit known vulnerabilities affecting the disclosed software versions...

CVE-2026-56578

Technical details about CVE-2026-56578 are not provided in the supplied documents; monitor for updates as information on affected versions, impact, and fixes is not publicly available here.