Critical Atlassian Flaw Lets Unauthenticated Attackers Read Known Files Across 8 Products

A critical flaw in 8 Atlassian Data Center products, which customers host themselves, allows an attacker with no login access to read specific files in each product's web application root directory. The attacker must already know a file's exact name and path and cannot list what the directory...

EUVD-2026-92985

An unauthenticated remote attacker can modify Asset Administration Shell submodel data via PATCH requests and can read all data exposed by the GET endpoints...

CVE-2026-94293

The aas-edge-client REST API is vulnerable to a missing authentication flaw for critical functions. An unauthenticated remote attacker can perform PATCH requests to modify Asset Administration Shell submodel data and use GET endpoints to read all exposed data. No specific exploit details or remed...

CVE-2026-94293 Missing authentication for critical function in the aas-edge-client REST API

An unauthenticated remote attacker can modify Asset Administration Shell submodel data via PATCH requests and can read all data exposed by the GET endpoints...

CVE-2026-57554

A Use After Free vulnerability exists in the DSP Service due to a memory corruption issue. This occurs when asynchronous threads simultaneously access shared performance counter data during FastRPC invocations . The vulnerability has a High base severity (CVSS 3.1 score of 7.8) and can impact con...

CVE-2026-57537 Use After Free in DSP Service

Memory Corruption when accessing and modifying geographic mapping data concurrently without proper synchronization...

CVE-2026-57537

A Use After Free vulnerability exists in the DSP Service due to a lack of proper synchronization when concurrently accessing and modifying geographic mapping data . This memory corruption flaw can result in high impact across confidentiality, integrity, and availability . No specific affected ver...

EUVD-2026-92979

Memory Corruption when accessing and modifying geographic mapping data concurrently without proper synchronization...

CVE-2026-41563

Unauthenticated Sensitive Data Exposure in Sitemovr = 1.0.1 versions...

CVE-2020-11108-PoC

CVE-2020-11108-PoC В этом репозитории находятся два PoC. cve-2020-11108-rce.py даст вам шелл от имени пользователя www-data. root-cve-2020-11108-rce.py даст вам шелл и повысит привилегии до root. Примечание: это деструктивно, так как мы должны перезаписать teleporter.php. Полное объяснение/отчёт...

EUVD-2026-92968

The File Media Renamer WordPress plugin through 1.3 does not verify that the requesting user is authorised to modify a given media attachment, allowing any user with file-upload privileges to rename attachments belonging to other users, including administrators, and to corrupt unrelated stored si...

CVE-2026-89289

The Fast Courier WordPress plugin (versions

CVE-2026-86786 Slider Pro <= 1.0.0 - Unauthenticated Sensitive Data Disclosure via sliderpro_multiple_images

The Slider Pro WordPress plugin through 1.0.0 does not perform any capability or authorisation check on one of its AJAX actions, allowing unauthenticated users to retrieve the title, excerpt and permalink of non-public posts, including drafts, pending, scheduled, private and trashed posts, as wel...

CVE-2026-94278 File Media Renamer <= 1.3 - Author+ Arbitrary File Rename via save-attachment-compat

The File Media Renamer WordPress plugin through 1.3 does not verify that the requesting user is authorised to modify a given media attachment, allowing any user with file-upload privileges to rename attachments belonging to other users, including administrators, and to corrupt unrelated stored si...

CVE-2026-86786

The Slider Pro WordPress plugin (versions through 1.0.0 ) is vulnerable to an Unauthenticated Sensitive Data Disclosure due to a lack of capability or authorization checks on one of its AJAX actions. An unauthenticated attacker can exploit this to retrieve the title, excerpt, and permalink of non...

WordPress Slider Pro plugin <= 1.0.0 - Unauthenticated Sensitive Data Disclosure vulnerability

Unauthenticated Sensitive Data Disclosure vulnerability discovered by Seongwon Lee in WordPress Plugin Slider Pro versions = 1.0.0...

CVE-2026-89289 Fast Courier <= 5.2.3 - Unauthenticated Order Fulfillment Update via order-status-update REST Endpoint

The Fast Courier WordPress plugin through 5.2.3 does not restrict an unauthenticated REST route that writes order fulfillment data, allowing unauthenticated attackers to overwrite the courier status and customer-facing tracking details of any WooCommerce order by supplying its id...

Advanced-SQL-Injection-Cheatsheet

Шпаргалка по SQL-инъекциям на основе ошибок MySQL Это, вероятно, самая простая уязвимость среди атак типа SQL Injection. Атакующий может перечислить и выгрузить базу данных MySQL, используя сообщения об ошибках SQL в своих интересах. Обнаружение уязвимостиhttp://domain.com/index.php?id=1 Website...

Icedid-file-decryptor

IcedID Decryptor Скрипт для статической расшифровки файлов license.dat, связанных с заражениями IcedID. Скрипт также расшифрует секцию .data из распакованных образцов IcedID. Примечания: Скрипт автоматически определяет, передан ли PE-файл или файл license.dat. Если указан PE, скрипт предполагает,...

CVE-2025-4517-tarfile-PATH_MAX-bypass

CVE-2025-4517 / CVE-2025-4330 — Contournement du filtre de données tarfile de Python via dépassement de PATHMAX Auteur : 0xDTC CVE : CVE-2025-4517 / CVE-2025-4330 Avis de sécurité : GHSA-6r6c-684h-9j7p Correctif CPython : PR 135037 Aperçu La fonction tarfile.extractallfilter="data" de Python est...