PT-2026-106607

In the Linux kernel, the following vulnerability has been resolved: net: remove WARN ON ONCE from the dev fill forward path loop check ipip fill forward path and ip6 tnl fill forward path look up the route to the tunnel's remote endpoint and set ctx-dev to its device, which is the tunnel itself...

Linux Distros Unpatched Vulnerability : CVE-2026-105263

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A security flaw has been discovered in Shaarli up to 0.16.3. The affected element is the function MetadataController of the file...

CVE-2026-8181

CVE-2026-8181 — Contournement d'authentification Burst Statistics menant à la prise de contrôle du compte administrateur 📋 Informations sur la vulnérabilité Élément| Détail ---|--- CVE ID| CVE-2026-8181 Plugin| Burst Statistics – Privacy-Friendly WordPress Analytics Versions concernées| 3.4.0 –...

CVE-2025-44108-SXSS

CVE-2025-44108 - ثغرات البرمجة النصية عبر المواقع المخزنة XSS في نظام إدارة المحتوى FlatPress الإصدار 1.3.1 الوصف توجد ثغرة برمجة نصية عبر المواقع مخزنة XSS في لوحة الإدارة لنظام Flatpress CMS الإصدار 1.3.1. يمكن للمهاجم الذي يتمتع بصلاحيات مسؤول حقن حمولة JavaScript ضارة في النظام، والتي يتم...

CVE-2026-48611-phpBB

CVE-2026-48611-phpBB Contournement d'authentification poc simple de contournement d'authentification ; si vous souhaitez y accéder via un navigateur, n'oubliez pas de modifier la variable USERAGENT dans le script en fonction de ce qui est affiché dans votre navigateur pour que cela fonctionne...

iTop-CVEs-exploit

iTop-CVEs-exploit Ce dépôt contient des exploits pour les CVE-2024-52002, 52000, 31998 et 31448 d'iTOP qui combinent CSRF+XSS pour obtenir des privilèges administrateur sur le logiciel. Mise en place 1. Téléchargez la version vulnérable d'iTOP depuis docker sudo docker run -d -p 8090:80...

CVE-2026-105468

A vulnerability was found in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. This affects the function mysqliquery of the file Admin/mlogin.php of the component Login Handler. Performing a manipulation of the argument uname/pass results in sql...

CVE-2026-105468

The girishsaraf Online-Appointment-Booking-System is vulnerable to a SQL injection flaw within the Login Handler component, specifically affecting the mysqli_query function in the Admin/mlogin.php file. An attacker can initiate a remote attack by manipulating the uname or pass arguments. While th...

CVE-2026-77226

Camunda 7.24.0 before 7.24.15 contains an incorrect authorization vulnerability in the Admin web application's first-run setup endpoint, where SetupResource incorrectly determines setup availability by counting only direct members of the camunda-admin group rather than recognizing all configured...

EUVD-2026-92791

Camunda 7.24.0 before 7.24.15 contains an incorrect authorization vulnerability in the Admin web application's first-run setup endpoint, where SetupResource incorrectly determines setup availability by counting only direct members of the camunda-admin group rather than recognizing all configured...

CVE-2026-77226 Camunda 7.24.0 < 7.24.15 Incorrect Authorization via SetupResource Endpoint

Camunda 7.24.0 before 7.24.15 contains an incorrect authorization vulnerability in the Admin web application's first-run setup endpoint, where SetupResource incorrectly determines setup availability by counting only direct members of the camunda-admin group rather than recognizing all configured...

CVE-2026-77226 Camunda 7.24.0 < 7.24.15 Incorrect Authorization via SetupResource Endpoint

Camunda 7.24.0 before 7.24.15 contains an incorrect authorization vulnerability in the Admin web application's first-run setup endpoint, where SetupResource incorrectly determines setup availability by counting only direct members of the camunda-admin group rather than recognizing all configured...

CVE-2026-77226

The Camunda engine, specifically versions 7.24.0 before 7.24.15 , is vulnerable to an incorrect authorization flaw in the Admin web application's first-run setup endpoint. The SetupResource component incorrectly determines setup availability by only counting direct members of the camunda-admin gr...

CVE-2026-105679

Ghost is a Node.js content management system. From 6.22.1 until 6.64.0, Ghost restricted the content type used to serve uploaded files to prevent browsers from executing them. On sites using the default local storage adapter, this restriction was not applied, so files uploaded by any staff user...

CVE-2026-105687 Penpot: A team admin (non-owner) can remove the team owner via ::delete-team-member — missing owner-protection

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the delete-team-member RPC allows a team administrator to remove any member other than themselves but does not protect the team owner. A non-owner administrator can delete the owner's team-profile-rel membership and lock t...

CVE-2023-37755---Hardcoded-Admin-Credential-in-i-doit-Pro-25-and-below

CVE-2023-37755 - Identifiants administrateur codés en dur dans i-doit Pro 25 et versions antérieures i-doit Pro 25 et versions antérieures sont vulnérables à une vulnérabilité d'identifiants administrateur codés en dur. Ces vulnérabilités permettent à quiconque de se connecter en tant...

CVE-2025-34077

CVE-2025-34077 اختطاف جلسة مدير غير مصادق - إضافة Pie Register ≤ 3.7.1.4 📌 الوصف يستهدف هذا الاستغلال ثغرة في إضافة Pie Register لووردبريس الإصدارات ≤ 3.7.1.4، مما يسمح باختطاف جلسة مدير غير مصادق. 🛡️ هذه الأداة مخصصة للاختبار المصرح به والبحث فقط. لا تستخدمها على أنظمة لا تملكها أو ليس لديك إذن...

CVE-2026-105679

Ghost is a Node.js content management system. From 6.22.1 until 6.64.0, Ghost restricted the content type used to serve uploaded files to prevent browsers from executing them. On sites using the default local storage adapter, this restriction was not applied, so files uploaded by any staff user...

CVE-2026-105679

The Ghost Node.js content management system is vulnerable to Stored XSS in versions 6.22.1 through 6.64.0 . The root cause is that the restriction on content types for uploaded files is not applied when using the default local storage adapter , allowing files to be served with content types deriv...

CVE-2026-105644

Ghost is a Node.js content management system. From 4.0.0 until 6.67.0, SVG images included in content imports were stored without sanitization. An attacker who convinced an Administrator to import a crafted file could host scripts on the site's domain, possibly resulting in compromise of staff...