CVE-2022-22063

CVE-2022-22063 CVE-2022-22063 es un problema de seguridad en el firmware del hipervisor de algunos conjuntos de chips antiguos de Qualcomm. Un componente de hardware desprotegido el "boot remapper" puede ser abusado para obtener acceso completo de lectura/escritura al hipervisor desde un sistema...

Sync_Breeze_Enterprise_10_6_24_-DOS

SyncBreezeEnterprise10624-DOS root@kitploit: Exploit Title: Sync Breeze Enterprise 10.6.24 - Denial Of Service Vulnerability Date: 03-09-2018 Exploit Author: Ege Balcı Vendor Homepage: http://www.syncbreeze.com Software Link: http://www.syncbreeze.com/setups/syncbreezeentsetupv10.6.24.exe Version...

Unbreakable Enterprise kernel security update

6.12.0-206.104.3.3 - inet: frags: strip GSO state from fragments before reassembly Xinyang Ge Orabug: 39974840 CVE-2026-80590 6.12.0-206.104.3.2 - KVM: x86: Cancel delayed I/O APIC EOI handling before destroying vCPUs Weiming Shi Orabug: 39931938 CVE-2026-74517 - tcp: challenge ACK for non-exact...

EUVD-2026-70530

ColdFusion is affected by an Improper Authentication vulnerability that could result in privilege escalation. An attacker could leverage this vulnerability to gain limited read and write access. The vulnerable component is restricted to an administrative network zone by default. Exploitation of...

CVE-2021-25741

Acerca de Es un exploit para la vulnerabilidad CVE-2021-25741. Esta vulnerabilidad permite montar el sistema de archivos de Node dentro de un nuevo POD con privilegios de lectura y escritura. Puedes leer más sobre la vulnerabilidad aquí:...

CVE-2026-50181

CVE-2026-50181 Recorrido de directorios en las herramientas de archivo de Langroid permitía lectura/escritura fuera del directorio actual configurado. Aviso principal: GHSA-fg23-3346-88f5 Base de datos de avisos de GitHub: github.com/advisories/GHSA-fg23-3346-88f5 Crédito al investigador:...

CVE-2026-78599 Stored Path Traversal in Kibana Leading to Unauthorized Deletion of Internal Resources

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' CWE-22 in the Kibana Fleet feature can lead to the unauthorized deletion of internal resources via Path Traversal CAPEC-126. A low-privileged user holding Fleet write access could cause a subsequent administrative delete...

CVE-2026-78599

Kibana Fleet feature is affected by a stored path traversal (CWE-22) that allows a low-privileged user with Fleet write access to cause a subsequent administrative delete action to act on unintended internal resources, resulting in availability impact . Affected versions are 8.0.0–8.19.17 and 9.0...

EUVD-2026-70060

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' CWE-22 in the Kibana Fleet feature can lead to the unauthorized deletion of internal resources via Path Traversal CAPEC-126. A low-privileged user holding Fleet write access could cause a subsequent administrative delete...

CVE-2022-22948

CVE-2022-22948 Divulgación de información en VMWare vCenter El grupo de investigación de Pentera descubrió una vulnerabilidad en el programa vCenter Server de VMWare que afecta al software de VMWare instalado en 500 000 organizaciones en todo el mundo, responsable de gestionar sus sistemas más...

CVE-2017-7494_IT19115344

CVE-2017-7494IT19115344 Se encontró una falla de ejecución remota de código en Samba. Un cliente samba autenticado malicioso, con acceso de escritura al recurso compartido de samba, podría usar esta falla para ejecutar código arbitrario como root...

Kibana 8.19.18, 9.4.3 Security Update (ESA-2026-157)

Stored Path Traversal in Kibana Leading to Unauthorized Deletion of Internal Resources Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' CWE-22 in the Kibana Fleet feature can lead to the unauthorized deletion of internal resources via Path Traversal CAPEC-126. A...

CVE-2026-19118 Race condition vulnerability was identified in GitHub Enterprise Server that allowed remote code execution

A time-of-check time-of-use race condition vulnerability was identified in GitHub Enterprise Server that allowed remote code execution. Exploitation required an authenticated user with write access to a repository and precise timing of concurrent upload requests. This vulnerability affected all...

CVE-2026-12663

A security issue exists within ControlFLASH™, where the installer grants write permissions to the "Everyone" group on a product installation directory. This could allow arbitrary code execution, resulting in an attacker being given the ability to run any commands or code of the attacker's choice ...

CVE-2018-8065

خادم Flexense HTTP Server-Enable web server on port. تؤدي الوحدة إلى حدوث انتهاك وصول للكتابة في مساحة ذاكرة عملية syncbrs.exe. يتراوح عدد الطلبات التي تتسبب في تعطل الخادم بين 200-1000 حسب إصدار نظام التشغيل وذاكرة النظام. يُذكر أن الإصدار Sync Breeze Enterprise 10.6.24 معرّض للثغرة. الاستغلالات...

MongoSQL Transition Readiness Tool Improper Neutralization of Formula Elements in Generated Reports

The MongoSQL Transition Readiness Tool writes database and collection names into its generated CSV reports without neutralizing leading characters that spreadsheet applications treat as formulas. A user with write privileges on the cluster can choose a namespace name that is later evaluated as a...

GHSA-F27P-PW2P-9PR4 Vikunja has a project duplication bypasses write-permission check on the target parent project

Summary The project-duplication endpoint fails to enforce write access to the target parent project. Any authenticated non-link-share user can duplicate a project they can read into any parent project on the instance, regardless of whether they have write access to that parent — injecting an...

CVE-2026-19485

CVE-2026-19485 is a Predictable Resource Name (bucket squatting) vulnerability in BigQuery Import Staging within Google Cloud Vertex AI Search for Commerce on Google Cloud Platform, affecting versions prior to 2026-04-27 . An attacker knowing the victim's project number could derive the predictab...

EUVD-2026-66653

A Predictable Resource Name vulnerability in BigQuery Import Staging in Google Cloud Vertex AI Search for Commerce versions prior to 2026-04-27 on Google Cloud Platform allows an attacker knowing the victim's project number to obtain read/write access to staged data and error logs using predictab...

CVE-2026-15203

Danfoss iC7-Automation SP, iC7-Marine, and iC7-Hybrid GR3 suffer from improper access control in debug and engineering interfaces that are accessible by default. An unauthenticated, network-based attacker can read and write internal values , upload and execute unsigned applications , and upload u...