Reg1c1de

Reg1c1de: Windows Registry Privesc Scanner Summary from help output: Reg1c1de is a tool that scans specified registry hives and reports on any keys where the user has write permissions In addition, if any registry values are found that contain file paths with certain file extensions and they are...

CVE-2023-33829

CVE-2023-33829: Stored-XSS-on-SCM-Manager-1.60 Summary A vulnerability is discovered in the SCM Manager 1.2 = 1.60 version that allows an attackers previously authenticated with write permissions execute javascript code in specific fields. This Proof of Concept is maded in a local environment...

enum_shares

enumshares Shared folders enumeration tool EnumShares enumerates shared folders across the network and under a custom user account. It can check if the shared folder is writable for the current user. It can save you a lot of time when you need to discover directories allowing "write" to everyone ...

CVE-2026-112072

A flaw was found in vault-java-driver. The driver's internal JSON parser does not enforce a limit on nesting depth when processing server responses. An authenticated user with write permissions to a Vault path can store deeply nested data, which triggers a stack overflow during parsing and...

PT-2026-132397

Monkeytype is a minimalistic and customizable typing test. Prior to 26.43.0, the .github/workflows/fix-formatting.yml workflow runs on pull request target with repository write permissions, checks out a fork pull request, installs dependencies from the fork's package.json, and invokes the...

EUVD-2026-110501

A confused deputy attack exists in the StatefulSet controller that allows a user with namespace-scoped write permissions on StatefulSet and ControllerRevision objects to create a cross-namespace pod. An attacker exploiting this vulnerability would have full control over the resulting pod’s metada...

Nextcloud Whiteboard server request forgery vulnerability

Versions prior to Nextcloud Whiteboard 1.0.0 contain a server-side request forgery vulnerability. This vulnerability arises from the ability to access the internal Chrome DevTools Protocol API, which can be used to expose another user’s JWT authentication token. Low-privilege attackers can exploi...

Psono Server authorization issue vulnerability

Versions 4.0.33 through 7.2.3 of Psono Server contain an authorization issue vulnerability. This vulnerability stems from improper comparison between the request path for bulk-secret-read endpoints and a hard-coded, unprefixed path; in deployments where URLPREFIX is configured, this comparison...

CVE-2026-2270

A confused deputy attack exists in the StatefulSet controller that allows a user with namespace-scoped write permissions on StatefulSet and ControllerRevision objects to create a cross-namespace pod. An attacker exploiting this vulnerability would have full control over the resulting pod’s metada...

CVE-2026-2270

A confused deputy attack exists in the StatefulSet controller that allows a user with namespace-scoped write permissions on StatefulSet and ControllerRevision objects to create a cross-namespace pod. An attacker exploiting this vulnerability would have full control over the resulting pod’s metada...

CVE-2026-2270

A confused deputy attack exists in the StatefulSet controller that allows a user with namespace-scoped write permissions on StatefulSet and ControllerRevision objects to create a cross-namespace pod. An attacker exploiting this vulnerability would have full control over the resulting pod’s metada...

Python Packaging Authority virtualenv post-link vulnerability

The Python Packaging Authority’s virtualenv versions prior to 21.14.9 have a post-release vulnerability. This vulnerability stems from the handling of errors during the safedelete function’s deletion operations. When deletion fails, the error handling code uses os.lstatpath to read the file mode...

go-vikunja Vikunja permission granting and access control issues

The go-vikunja Vikunja 2.6.0 version has vulnerabilities related to permission management and access control. These vulnerabilities stem from improper access control in the getProjectAccessForUser function pkg/models/projectaccess.go. This function parses user project permissions as the maximum...

go-vikunja Vikunja Authorization Issue Vulnerability

Go-Vikunja: Versions prior to Vikunja 2.7.0 and 0.13.0 have an authorization issue vulnerability. This vulnerability stems from the deletion permission check reading unloaded shared objects, allowing members with Write permissions to delete administrator-level link shares. Attackers can revoke...

EUVD-2026-100484

The Okta RADIUS Agent Windows installer assigns write permissions to the NT SERVICE\ALL SERVICES and CREATOR OWNER security principals on the directories containing the agent configuration, AES encryption key, and logs. These permissions allow any local service account on the host to read the AES...

PT-2026-113386

The Okta RADIUS Agent Windows installer assigns write permissions to the NT SERVICEALL SERVICES and CREATOR OWNER security principals on the directories containing the agent configuration, AES encryption key, and logs. These permissions allow any local service account on the host to read the AES...

SUSE CVE-2026-2270

A confused deputy attack exists in the StatefulSet controller that allows a user with namespace-scoped write permissions on StatefulSet and ControllerRevision objects to create a cross-namespace pod. An attacker exploiting this vulnerability would have full control over the resulting pod's metada...

rabbitmq-server: rabbitmq-server: Unauthorized message routing via missing alternate-exchange permission check

A flaw was found in rabbitmq-server. This vulnerability allows an authenticated user to bypass access controls and perform unauthorized message routing. When an exchange is declared via the Advanced Message Queuing Protocol AMQP 1.0 management interface, the application fails to verify write...

CVE-2026-77827

Maono Link version 3.8.13 contains a local privilege escalation vulnerability in its MaonoAiServices Windows service. The root cause is improper write permissions on C:\ProgramData\Maono, allowing a standard user to modify service files and escalate privileges. The CVSS 3.1 score is 7.1 (HIGH) an...

CVE-2026-84942 Stored Cross-Site Scripting via Vega Expression Function Bypass in OpenSearch Dashboards

Improper input validation in the Vega expression function implementation in OpenSearch Dashboards allows a remote authenticated actor with dashboard write permissions to execute arbitrary JavaScript in the context of other users' browser sessions by saving a crafted Vega visualization. The...