RCity-CVE-2024-27198

RCity - CVE-2024-27198 RCE & Admin Account Creation & CVE-2024-27199 Auth Bypass Exploiting CVE-2024-27198 & CVE-2024-27199 RCity is a Python script that interacts with a vulnerable TeamCity server. The CVE facilitates for unauthorised admin account creation, bypassing 403's on the domain. Whilst...

CVE-2025-27636-Apache-Camel-PoC

Apache Camel CVE-2025–27636 & CVE-2025-29891 PoC CVE-2025–27636 and CVE-2025-29891 are vulnerabilities in Apache Camel that affect versions: 4.10.0-4.10.1, 4.8.0-4.8.4, 3.10.0-3.22.3. Exploitation of these vulnerabilities can enable attackers to execute internal Camel methods. The following is a...

CVE-2026-46726

CVE-2026-46726 — camel-vertx-websocket Header Injection SSRF + Secret Disclosure Runnable proof-of-concept reproducers for the same Apache Camel vulnerability, one per runtime: Runtime| Directory| Stack| WebSocket feed ---|---|---|--- Camel Spring Boot| camel-spring-boot/| Spring Boot 3.2.0 +...

CVE-2026-40453

Case-Variant Camel Header Injection Reproducer CVE-2026-40453 This project demonstrates CVE-2026-40453 — an incomplete fix for CVE-2025-27636. The 2025 fix added setLowerCasetrue to HttpHeaderFilterStrategy so that case-variant header names e.g. CAmelExecCommandExecutable are filtered alongside t...

Security Bulletin: Multiple Security Vulnerabilities in IBM Sterling Partner Engagement Manager.

Summary Multiple vulnerabilities were addressed in IBM Sterling Partner Engagement Manager. Vulnerability Details CVEID:CVE-2026-22740 DESCRIPTION: A WebFlux server application that processes multipart requests creates temp files for parts larger than 10 K. Under some circumstances, temp files ma...

CVE-2026-34197-PoC

CVE-2026-34197 — Apache ActiveMQ Jolokia addNetworkConnector RCE Proof-of-concept and technical notes for CVE-2026-34197 , a remote code execution vulnerability in Apache ActiveMQ Classic reachable through the Jolokia JMX-HTTP bridge. Affected: ActiveMQ Classic ⚠️ For authorized testing / research...

CVE-2026-41044

CVE-2026-41044 Note: Educational Purposes Only From Advisory to RCA in an Afternoon: How AI Collapses N-Day Analysis A short, honest walkthrough of CVE-2026-41044 in Apache ActiveMQ using the exact pre and post patch code. CVE-2026-41044 was disclosed on April 24, 2026. It's a remote code executi...

CVE-2026-65694-PoC

CVE-2026-65694 — Microweber CMS Unauthenticated Arbitrary File Read Proof-of-concept for CVE-2026-65694 , an unauthenticated path-traversal → arbitrary file read in Microweber CMS. An unauthenticated attacker can read any file the web-server user can access — the Laravel .env APPKEY, DB...

Security Bulletin: Multiple vulnerabilities in IBM watsonx Orchestrate Developer Edition

Summary Multiple vulnerabilities were addressed in IBM watsonx Orchestrate Developer Edition version 2.18.0 Vulnerability Details CVEID:CVE-2026-16221 DESCRIPTION: Impact: fast-uri versions from 2.3.1 through 4.1.0 including the 3.x line up to 3.1.3 and the 2.x line up to 2.4.2 do not treat a...

SolarWinds Web Help Desk < 2026.1 - Unauthenticated JNDI Injection RCE

SolarWinds Web Help Desk before version 2026.1 contains an insecure deserialization vulnerability in the jabsorb JSON-RPC library. When chained with a CSRF whitelist bypass CVE-2025-40536, remote unauthenticated attackers can exploit JNDI injection via the Apache Xalan JNDIConnectionPool class to...

CVE-2026-106033

A DOM-based Cross-Site Scripting XSS vulnerability exists in the Ansible Platform UI due to unvalidated input handling within the application's redirect route. Specifically, the application extracts a target destination from the next query parameter and directly assigns it to the browser's...

CVE-2026-106033

A DOM-based Cross-Site Scripting (XSS) vulnerability exists in the Ansible Platform UI due to unvalidated input handling in the redirect route . The application extracts a destination from the next query parameter and assigns it to location.href without proper format or scheme verification, bypas...

CVE-2026-106033 Ansible: ansible-ui: ansible ui dom xss in /redirect next parameter

A DOM-based Cross-Site Scripting XSS vulnerability exists in the Ansible Platform UI due to unvalidated input handling within the application's redirect route. Specifically, the application extracts a target destination from the next query parameter and directly assigns it to the browser's...

CVE-2026-106033 Ansible: ansible-ui: ansible ui dom xss in /redirect next parameter

A DOM-based Cross-Site Scripting XSS vulnerability exists in the Ansible Platform UI due to unvalidated input handling within the application's redirect route. Specifically, the application extracts a target destination from the next query parameter and directly assigns it to the browser's...

EUVD-2026-93781

A DOM-based Cross-Site Scripting XSS vulnerability exists in the Ansible Platform UI due to unvalidated input handling within the application's redirect route. Specifically, the application extracts a target destination from the next query parameter and directly assigns it to the browser's...

CVE-2026-106033

A DOM-based Cross-Site Scripting XSS vulnerability exists in the Ansible Platform UI due to unvalidated input handling within the application's redirect route. Specifically, the application extracts a target destination from the next query parameter and directly assigns it to the browser's...

CVE-2026-106033: Improper Neutralization of Input During Web Page Generation

A DOM-based Cross-Site Scripting XSS vulnerability exists in the Ansible Platform UI due to unvalidated input handling within the application's redirect route. Specifically, the application extracts a target destination from the next query parameter and directly assigns it to the browser's...

PT-2026-106853

A DOM-based Cross-Site Scripting XSS vulnerability exists in the Ansible Platform UI due to unvalidated input handling within the application's redirect route. Specifically, the application extracts a target destination from the next query parameter and directly assigns it to the browser's...

PT-2026-104184

Name of the Vulnerable Software and Affected Versions WP Statistics versions prior to 14.16.15 Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Reflected Cross-Site Scripting. This occurs via the REQUEST URI query-parameter key, enabling t...

Wordfence Intelligence Weekly WordPress Vulnerability Report (September 21, 2026 to September 27, 2026)

Last week, there were 318 vulnerabilities disclosed in 221 WordPress Plugins that have been added to the Wordfence Intelligence Vulnerability Database, and there were 156 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabilities in this report now to...