CVE-2026-50181

CVE-2026-50181 Langroid 파일 도구의 경로 탐색으로 인해 설정된 현재 디렉토리 외부에서 읽기/쓰기가 허용되었습니다. 기본 권고: GHSA-fg23-3346-88f5 GitHub 권고 데이터베이스: github.com/advisories/GHSA-fg23-3346-88f5 연구자 크레딧: @chaitanyagarware 한눈에 보기...

CVE-2026-78599 Stored Path Traversal in Kibana Leading to Unauthorized Deletion of Internal Resources

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' CWE-22 in the Kibana Fleet feature can lead to the unauthorized deletion of internal resources via Path Traversal CAPEC-126. A low-privileged user holding Fleet write access could cause a subsequent administrative delete...

CVE-2026-78599

Kibana Fleet feature is affected by a stored path traversal (CWE-22) that allows a low-privileged user with Fleet write access to cause a subsequent administrative delete action to act on unintended internal resources, resulting in availability impact . Affected versions are 8.0.0–8.19.17 and 9.0...

EUVD-2026-70060

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' CWE-22 in the Kibana Fleet feature can lead to the unauthorized deletion of internal resources via Path Traversal CAPEC-126. A low-privileged user holding Fleet write access could cause a subsequent administrative delete...

CVE-2022-22948

CVE-2022-22948 VMWare vCenter의 정보 노출Information Disclosure Pentera의 연구 그룹은 전 세계 500,000개 조직에서 가장 중요한 시스템을 관리하는 데 사용되는 VMWare 소프트웨어에 영향을 미치는 VMWare vCenter Server 프로그램의 취약점을 발견했습니다. 당사의 발견은 VMWare에 사전에 보고되었으며 CVE-2022-22948로 공개되었습니다. 패치 및 추가 정보는 VMWare 자문 사이트에서 확인할 수 있습니다. 스캐너 이 스캐너는 해당 파일이 "cis"...

CVE-2017-7494_IT19115344

CVE-2017-7494IT19115344 Samba にリモートコード実行の脆弱性が発見されました。Samba 共有に対して書き込みアクセス権を持つ悪意のある認証済み Samba クライアントは、この脆弱性を利用して root として任意のコードを実行できる可能性があります。...

CVE-2022-22063

CVE-2022-22063 CVE-2022-22063는 일부 구형 퀄컴 칩셋의 하이퍼바이저 펌웨어에서 발견된 보안 문제입니다. 보호되지 않은 하드웨어 구성 요소"부트 리매퍼"를 악용하여 수정된 운영 체제에서 하이퍼바이저에 대한 전체 읽기/쓰기 액세스 권한을 얻을 수 있습니다권한 상승. 특정 펌웨어 버전예: 주소 또는 변수에 대한 지식이 필요하지 않기 때문에 영향을 받는 플랫폼에서 이 문제를 악용하는 것은 간단합니다. 참고: 퀄컴이 고객에게 수정 사항을 제공했지만업데이트를 출시할 충분한 시간 포함 영향을 받는 많은 장치가 이미...

Kibana 8.19.18, 9.4.3 Security Update (ESA-2026-157)

Stored Path Traversal in Kibana Leading to Unauthorized Deletion of Internal Resources Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' CWE-22 in the Kibana Fleet feature can lead to the unauthorized deletion of internal resources via Path Traversal CAPEC-126. A...

CVE-2026-19118 Race condition vulnerability was identified in GitHub Enterprise Server that allowed remote code execution

A time-of-check time-of-use race condition vulnerability was identified in GitHub Enterprise Server that allowed remote code execution. Exploitation required an authenticated user with write access to a repository and precise timing of concurrent upload requests. This vulnerability affected all...

CVE-2026-12663

A security issue exists within ControlFLASH™, where the installer grants write permissions to the "Everyone" group on a product installation directory. This could allow arbitrary code execution, resulting in an attacker being given the ability to run any commands or code of the attacker's choice ...

CVE-2018-8065

Flexense HTTP Server Server-Enable web server on port. El módulo provoca una violación de acceso de escritura en el espacio de usuario en la región de memoria de syncbrs.exe. El número de peticiones que harán fallar el servidor varía entre 200 y 1000 dependiendo de la versión del sistema operativ...

Sync_Breeze_Enterprise_10_6_24_-DOS

SyncBreezeEnterprise10624-DOS root@kitploit: Exploit Title: Sync Breeze Enterprise 10.6.24 - Denial Of Service Vulnerability Date: 03-09-2018 Exploit Author: Ege Balcı Vendor Homepage: http://www.syncbreeze.com Software Link: http://www.syncbreeze.com/setups/syncbreezeentsetupv10.6.24.exe Version...

MongoSQL Transition Readiness Tool Improper Neutralization of Formula Elements in Generated Reports

The MongoSQL Transition Readiness Tool writes database and collection names into its generated CSV reports without neutralizing leading characters that spreadsheet applications treat as formulas. A user with write privileges on the cluster can choose a namespace name that is later evaluated as a...

GHSA-F27P-PW2P-9PR4 Vikunja has a project duplication bypasses write-permission check on the target parent project

Summary The project-duplication endpoint fails to enforce write access to the target parent project. Any authenticated non-link-share user can duplicate a project they can read into any parent project on the instance, regardless of whether they have write access to that parent — injecting an...

CVE-2021-25741

Informazioni È un exploit per la vulnerabilità CVE-2021-25741. Questa vulnerabilità consente di montare il filesystem di Node all'interno di un nuovo POD con privilegi di lettura-scrittura. Puoi leggere ulteriori informazioni sulla vulnerabilità qui:...

CVE-2026-19485

CVE-2026-19485 is a Predictable Resource Name (bucket squatting) vulnerability in BigQuery Import Staging within Google Cloud Vertex AI Search for Commerce on Google Cloud Platform, affecting versions prior to 2026-04-27 . An attacker knowing the victim's project number could derive the predictab...

EUVD-2026-66653

A Predictable Resource Name vulnerability in BigQuery Import Staging in Google Cloud Vertex AI Search for Commerce versions prior to 2026-04-27 on Google Cloud Platform allows an attacker knowing the victim's project number to obtain read/write access to staged data and error logs using predictab...

CVE-2026-15203

Danfoss iC7-Automation SP, iC7-Marine, and iC7-Hybrid GR3 suffer from improper access control in debug and engineering interfaces that are accessible by default. An unauthenticated, network-based attacker can read and write internal values , upload and execute unsigned applications , and upload u...

Gitea Code Injection Vulnerability

Gitea contains a code injection vulnerability that allows an attacker with repository write access to send a malicious patch to the diffpatch API endpoint to plant an executable Git hook and run shell commands as the Gitea service account...

Astra Linux – Vulnerability in Qemu

A flaw was discovered in qemu. A host privilege escalation issue was identified in the virtio-fs shared file system daemon, where a privileged guest user is able to create a device-specific special file in the shared directory and use it to gain read/write access to host devices...