Exploit for CVE-2026-14378

CVE-2026-14378 — DevKit Pro authentication bypass PoC Proof-o...

CVE-2026-104480

Discord libdave before 1.2.0 did not reject an MLS Welcome message when the resulting group roster contained an unrecognized participant. An attacker in control of the DAVE signaling path the voice gateway, or an equivalent position able to add, alter, or withhold signaling messages to a client...

Kaseya VSA < 9.5.7 - Credential Disclosure via Windows Agent

Kaseya VSA before 9.5.7 allows credential disclosure, as exploited in the wild in July 2021. By default Kaseya VSA on premise offers a download page where the clients for the installation can be downloaded. The default URL for this page is https://x.x.x.x/dl.asp When an attacker download a client...

Zoho manageengine - Cross-Site Scripting

Zoho manageengine is vulnerable to reflected cross-site scripting. This impacts Zoho ManageEngine Netflow Analyzer before build 123137, Network Configuration Manager before build 123128, OpManager before build 123148, OpUtils before build 123161, and Firewall Analyzer before build 123147 via the...

EUVD-2026-91114

infiniflow ragflow 0.25.3 contains improper access control in resume api/apps/connectorapp.py. Depending on the exposed entry, an attacker can perform unauthorized cross-session or privilege-crossing operations...

EUVD-2026-91115

Ragflow 0.24.0 and prior contains improper access control in updatemetadatasetting api/apps/kbapp.py. Depending on the exposed entry, an attacker can perform unauthorized cross-session or privilege-crossing operations...

EUVD-2026-91127

deeptutor 1.4.0 contains an authorization bypass through a user-controlled object identifier in TurnRuntimeManager.regeneratelastturn. A remote caller can enumerate or obtain a sessionid and trigger regenerate on another user's session...

PT-2026-104396

MISP contains a cross-site scripting XSS vulnerability in the remote event preview page. When a linked remote MISP server is configured, the event preview renders tag identifiers inside an inline JavaScript onclick attribute. The tag ID value was HTML-escaped but not sanitized for the JavaScript...

PT-2026-104359

MISP contains a stored cross-site scripting XSS vulnerability in the index table rendering of the remote event preview. The count field template escaped the associated link URL but rendered the field value without HTML encoding. An attacker with the ability to create or modify events on a linked...

CVE-2026-104907: Improper Neutralization of Input During Web Page Generation

MISP contains a cross-site scripting XSS vulnerability in the remote event preview page. When a linked remote MISP server is configured, the event preview renders tag identifiers inside an inline JavaScript onclick attribute. The tag ID value was HTML-escaped but not sanitized for the JavaScript...

CVE-2026-104901: Improper Neutralization of Input During Web Page Generation

MISP contains a cross-site scripting XSS vulnerability in the ID Translator feature. When a user views the ID Translator page, the application queries linked remote MISP servers for corresponding event identifiers. The event ID returned by the remote server was rendered in the HTML output without...

CVE-2026-97212: Insufficient Session Expiration

The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows multiple endpoints to connect using the same session identifier. This implementation results in predictable session identifiers. This vulnerability may allow unauthorized users to authenticate as oth...

PT-2026-104152

Name of the Vulnerable Software and Affected Versions JSON API Auth plugin for WordPress versions prior to 3.1.3 Description An authentication bypass exists due to cached session cookie disclosure. The PI-Media/json-api parent plugin caches controller dispatch results in transients based only on...

PT-2026-106089

🚨 CVE-2026-97062 Aureus ERP through 1.6.0, fixed in commit 53ad76d, stores uploaded SVG files on its public disk and serves them from the application origin, allowing authenticated users to upload malicious SVG files containing JavaScript. Attackers can craft SVG files with script elements that...

PT-2026-104360

MISP contains a cross-site scripting XSS vulnerability in the ID Translator feature. When a user views the ID Translator page, the application queries linked remote MISP servers for corresponding event identifiers. The event ID returned by the remote server was rendered in the HTML output without...

ROS-20261002-73-0115

The vulnerability of the PostgreSQL database management system is related to incorrect session duration. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to read and modify data...

ROS-20261002-73-0062

The vulnerability of the data selection evaluator in PostgreSQL database management systems is related to incorrect session duration. Exploiting this vulnerability can allow an attacker to disclose sensitive information...

ROS-20261002-73-0064

The vulnerability of the data selection evaluator in PostgreSQL database management systems is related to incorrect session duration. Exploiting this vulnerability can allow an attacker to disclose sensitive information...

ROS-20261002-73-0116

The vulnerability of the PostgreSQL database management system is related to incorrect session duration. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to read and modify data...

ROS-20261002-73-0112

The vulnerability of the PostgreSQL database management system is related to incorrect session duration. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to read and modify data...