EUVD-2026-85036

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.5 does not verify that the target user of a REST route matches the authenticated caller before reading and modifying that user's saved favorites, allowing any authenticated user with...

THM---CVE-2024-21413-Moniker-Link-Microsoft-Outlook-

THM---CVE-2024-21413-Moniker-Link-Microsoft-Outlook- On February 13, 2024, Microsoft published a critical security vulnerability in Microsoft Outlook, identified as CVE-2024-21413, known as the Moniker Link Vulnerability. The vulnerability allows an attacker to bypass Outlook's Protected View...

CVE-2024-21413-Outlook-Assessment

title: "CVE-2024-21413 Enlace Moniker: Evaluación de ejecución remota de código en Microsoft Outlook" date: 2026-06-28 author: Lindon Mitchell YoguiCR role: Investigador de Seguridad / Analista de Exploits status: Completado classification: Público / Portafolio environment: TryHackMe - Laboratori...

CVE-2026-17618

IBM Financial Transaction Manager (FTM) for RedHat OpenShift is impacted by multiple vulnerabilities stemming from improper authorization . This flaw could allow a remote unauthenticated attacker to view and modify sensitive information or cause a denial of service . No specific patch versions or...

EUVD-2026-84038

Graylog: Manager-to-Owner privilege escalation on saved searches and dashboards...

CVE-2026-95683

CVE-2026-95683 affects the Overmind event view in MISP , where the enrichment logic fetched the most recent attached report using only the event ID as a lookup condition, without enforcing the report's own independent distribution/ACL constraints. Because MISP reports can carry a more restrictive...

Blind-Trust-CVE-2024-21413-Research

BLIND TRUST - Moniker Link Phishing Engagement Framework Un marco de herramientas de seguridad para simular campañas de phishing dirigidas utilizando la vulnerabilidad CVE-2024-21413 Moniker Link. Diseñado para operaciones de equipo rojo autorizadas, pruebas de penetración y concienciación en...

CVE-2026-95661

MISP contains a reflected cross-site scripting XSS vulnerability in the attribute histogram view. The $selectedTypes variable, which is derived from the URL path segment , was interpolated directly into a JavaScript array literal inside an onClick HTML attribute without any encoding or escaping. ...

EUVD-2026-84374

MISP contains a reflected cross-site scripting XSS vulnerability in the attribute histogram view. The $selectedTypes variable, which is derived from the URL path segment , was interpolated directly into a JavaScript array literal inside an onClick HTML attribute without any encoding or escaping. ...

thm-Moniker-Link-cve-2024-21413-writeup

TryHackMe: Moniker Link CVE-2024-21413 Path: Cyber Security 101 → Exploitation Basics → Moniker Link CVE-2024-21413 Difficulty: Premium room Focus: Outlook Protected View bypass, NTLM hash leaking, and credential capture with Responder CVE-2024-21413 is a critical Microsoft Outlook vulnerability...

CVE-2026-61744 InvenTree: Barcode-scan API (`POST /api/barcode/`) returns full serialized object data without enforcing the model's view role

InvenTree is an Open Source Inventory Management System. Prior to 1.4.0, POST /api/barcode/ accepts an attacker-synthesized internal JSON barcode containing a lowercase model label and integer primary key, while BarcodeView uses IsAuthenticatedOrReadScope and requires only authentication or a...

CVE-2026-69190

Graylog is a free and open log management platform. From 6.3.0 until 6.3.14, 7.0.9, and 7.1.4, the view update API for saved searches and dashboards permits a user with edit permission but without entity ownership to include a shareRequest that grants owner permissions to an arbitrary account. Th...

CVE-2026-69190 Graylog: Manager-to-Owner privilege escalation on saved searches and dashboards

Graylog is a free and open log management platform. From 6.3.0 until 6.3.14, 7.0.9, and 7.1.4, the view update API for saved searches and dashboards permits a user with edit permission but without entity ownership to include a shareRequest that grants owner permissions to an arbitrary account. Th...

CVE-2026-69190

Graylog is an open-source log management platform. In versions 6.3.0 through 6.3.14, 7.0.9, and 7.1.4, the view update API for saved searches and dashboards permits a user with edit permission but without entity ownership to include a shareRequest that grants owner permissions to an arbitrary acc...

CVE-2026-69190 Graylog: Manager-to-Owner privilege escalation on saved searches and dashboards

Graylog is a free and open log management platform. From 6.3.0 until 6.3.14, 7.0.9, and 7.1.4, the view update API for saved searches and dashboards permits a user with edit permission but without entity ownership to include a shareRequest that grants owner permissions to an arbitrary account. Th...

CVE-2026-69190 Graylog: Manager-to-Owner privilege escalation on saved searches and dashboards

Graylog is a free and open log management platform. From 6.3.0 until 6.3.14, 7.0.9, and 7.1.4, the view update API for saved searches and dashboards permits a user with edit permission but without entity ownership to include a shareRequest that grants owner permissions to an arbitrary account. Th...

CVE-2026-52740 GoCD is vulnerable to pipeline template view API authorization bypass

GoCD is a continuous deliver server. From 18.7.0 until 26.1.0, the Get Template Config API compares HTTP method names case-sensitively when selecting authorization filters. A lower-privileged authenticated user can send a request with nonstandard HTTP method capitalization to retrieve a pipeline...

CVE-2026-94291

A flaw was found in Epiphany GNOME Web. The ephy-reader and view-source URI schemes are not registered as display-isolated, allowing a remote attacker to frame them from web content via iframes. This can be exploited to exfiltrate local files when a user visits a malicious website...

CVE-2026-94150

A security flaw has been discovered in Omega Solution HRM OS up to 20260717. The impacted element is an unknown function of the file /media/view/ of the component SVG File Upload. Performing a manipulation results in cross site scripting. The attack may be initiated remotely. The exploit has been...

CVE-2026-94150 Omega Solution HRM OS SVG File Upload view cross site scripting

A security flaw has been discovered in Omega Solution HRM OS up to 20260717. The impacted element is an unknown function of the file /media/view/ of the component SVG File Upload. Performing a manipulation results in cross site scripting. The attack may be initiated remotely. The exploit has been...