Exploit for CVE-2026-64560

plz110-6.12.69-cve-2026-64560-ksu On the OnePlus 15T PLZ110...

Security Bulletin: Multiple Vulnerabilities in IBM Tivoli Netcool/OMNIbus WebGUI

Summary IBM Tivoli Netcool/OMNIbus WebGUI has addressed multiple vulnerabilities in version 8.1.0 Fix Pack 42. Vulnerability Details CVEID:CVE-2026-84939 DESCRIPTION: Path traversal vulnerability in Apache FreeMarker template loading mechanism, if the attacker can specify an arbitrary malformed...

CVE-2019-8942

CVE-2019-8942 and CVE-2019-8943: WordPress RCE author privilege Overview CVE-2019-8942 is a vulnerability that exploits an LFI flaw combined with the File Upload feature to achieve RCE on a WordPress web server with author privileges. Affected WordPress versions include those before 4.9.9 and 5.x...

Security Bulletin: IBM SPSS Analytic Server is affected by multiple vulnerabilities in Netty

Summary IBM SPSS Analytic Server is affected by multiple vulnerabilities in Netty. This has been addressed in the remediation section. Vulnerability Details CVEID:CVE-2024-29025 DESCRIPTION: Netty is an asynchronous event-driven network application framework for rapid development of maintainable...

Security Bulletin: Multiple vulnerabilities in IBM MQ Operator and Queue manager container images

Summary Multiple vulnerabilities were addressed in IBM MQ Operator and Queue manager container images Vulnerability Details CVEID:CVE-2026-40553 DESCRIPTION: Buffer overflow vulnerability has been found in "extension/readdir.c" program file of gawk ftype routine. This issue could be used to crash...

CVE-2025-29017

CVE-2025-29017 - Internet Banking System 2.0.0 Remote Code Execution via Profile Picture Upload Description A Remote Code Execution RCE vulnerability exists in Code Astro Internet Banking System 2.0.0 due to improper file upload validation in the profilepic parameter within pagesviewclient.php...

CVE-2025-5947

CVE-2025-5947 CVE-2025-5947 WordPress Service Finder Bookings ≤ 6.0 Exploit CVE-2025-5947 Exploit - Service Finder Bookings Exploit tool for authentication bypass vulnerability in WordPress Service Finder Bookings ≤ 6.0 plugin 📋 Table of Contents About the Vulnerability Technical Details...

litespeed-cache-xss-poc

LiteSpeed Cache XSS PoC PoC for XSS vulnerability in the LiteSpeed Cache WordPress plugin allowing elevated privileges. This vulnerability was fixed in version 5.7.0.1 of the plugin, and was assigned CVE-2023-40000. According to the plugin's advanced view page, about 35% of users are still using ...

PYSEC-2026-4268 PraisonAI: FastContext path resolution permits absolute and traversal reads outside the workspace

FastContext path resolution permits absolute and traversal reads outside the workspace Summary PraisonAI's praisonaiagents.context.fast FastContext feature treats workspacepath as the root directory for code search, but its model-facing search tools and high-level readcontext helper accept absolu...

PraisonAI: FastContext path resolution permits absolute and traversal reads outside the workspace

FastContext path resolution permits absolute and traversal reads outside the workspace SummaryPraisonAI's praisonaiagents.context.fast FastContext feature treats workspacepath as the root directory for code search, but its model-facing search tools and high-level readcontext helper accept absolut...

PYSEC-2026-4232 Langflow: Prompt injection in Langflow Smart Transform can lead to code execution

Summary Langflow versions 1.3.0 through 1.10.2 contain a code-injection vulnerability in the Smart Transform LambdaFilterComponent component. Smart Transform places flow-author instructions and a preview of its input data into a prompt asking an LLM to generate a Python lambda. It then extracts a...

PYSEC-2026-4236 Langflow: Title Authenticated Remote Code Execution in validate_code via Malicious Decorators Description

Summary: A critical Authenticated Remote Code Execution RCE vulnerability exists in the validatecode function of Langflow. The /api/v1/validate/code endpoint, meant to validate user-supplied code, leverages Python's exec function. While it attempts to restrict execution to function definitions, i...

Langflow: Title Authenticated Remote Code Execution in validate_code via Malicious Decorators Description

Summary:A critical Authenticated Remote Code Execution RCE vulnerability exists in the validatecode function of Langflow. The /api/v1/validate/code endpoint, meant to validate user-supplied code, leverages Python's exec function. While it attempts to restrict execution to function definitions, it...

Langflow: Prompt injection in Langflow Smart Transform can lead to code execution

SummaryLangflow versions 1.3.0 through 1.10.2 contain a code-injection vulnerability in the Smart Transform LambdaFilterComponent component.Smart Transform places flow-author instructions and a preview of its input data into a prompt asking an LLM to generate a Python lambda. It then extracts a...

DeepTutor missing MCP tool authorization allows non-admin users to invoke unrestricted tools

DeepTutor before version 1.4.10 contains an authorization bypass vulnerability that allows low-privilege users to invoke unrestricted MCP tools due to the allowedmcptools function returning None instead of a denied result when mcptools is omitted from a user's grant in...

PYSEC-2026-4206 DeepTutor missing MCP tool authorization allows non-admin users to invoke unrestricted tools

DeepTutor before version 1.4.10 contains an authorization bypass vulnerability that allows low-privilege users to invoke unrestricted MCP tools due to the allowedmcptools function returning None instead of a denied result when mcptools is omitted from a user's grant in...

Security Bulletin: Multiple Vulnerabilities in IBM watsonx Code Assistant On Prem

Summary Multiple vulnerabilities were addressed in IBM watsonx Code Assistant On Prem V5.3.1 Patch 15 Vulnerability Details CVEID:CVE-2026-64847 DESCRIPTION: AnyIO is a high level asynchronous concurrency and networking framework that works on top of either Trio or asyncio. Prior to 4.14.2, AnyIO...

Security Bulletin: IBM App Connect Enterprise Certified Container UBI updates

Summary IBM App Connect Enterprise Certified Container ACEcc is built on the Red Hat Universal Base Images. ACEcc operator versions 12.0.28 and 13.6.0 contain fixes to the listed CVEs found in the base images. This bulletin provides patch information to address the reported vulnerabilities...

Security Bulletin: IBM App Connect Enterprise Certified Container operator and operands are vulnerable to loss of confidentiality and denial of service due to multiple CVEs

Summary IBM App Connect Enterprise Certified Container operator and operands are vulnerable to loss of confidentiality and denial of service due to multiple CVEs. This bulletin provides patch information to address the vulnerabilities Vulnerability Details CVEID:CVE-2026-84003 DESCRIPTION:...

Security Bulletin: Vulnerabilities found in Watson Data Intelligence

Summary Multiple Vulnerabilities were addressed in Watson Data Intelligence version 5.3.1 Patch15 Vulnerability Details CVEID:CVE-2026-69153 DESCRIPTION: PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to...