203045 matches found
CVE-2026-106602
The WordPress Jetpack plugin (versions
CVE-2026-106601
The Automattic Jetpack WordPress plugin, affecting versions
CVE-2026-64638
CVE-2026-64638 XSS riflesso sulla schermata di login che porta all'esecuzione di codice PHP — WordPress Core Software: WordPress Core ≤ 7.0.2 tutte le versioni precedenti alla 7.0.3 CVSS: 8.9 Alto CWE: CWE-79 — Neutralizzazione impropria dell'input durante la generazione di pagine web...
CVE-2026-64638-POC
CVE-2026-64638 — XSS2Shell XSS riflesso pre-autenticazione → Esecuzione remota di codice nel core di WordPress ⚠️ DISCLAIMER: Questo repository è destinato esclusivamente a ricerca di sicurezza autorizzata e scopi didattici. Non utilizzarlo contro sistemi di cui non si è proprietari o per i quali...
Security Bulletin: UPDATED security alert for multiple OpenSSL vulnerabilities impacting AIX. Updated On: Fri Oct 9 03:18:49 CDT 2026. Reason: Updated the iFix to include the previously missing OpenSSL 1.1 and 1.0.2 shared libraries.
Summary Vulnerabilities in OpenSSL could cause excessive memory consumption CVE-2026-54874, heap buffer overflow CVE-2026-63072, indefinite cache growth leading to denial of service CVE-2026-63074, invalid pointer dereference CVE-2026-63076, and authentication forgery CVE-2026-75803. OpenSSL is...
CVE-2024-28000
CVE-2024-28000 - PoC di Privilege Escalation su LiteSpeed Cache !WARNING Questo repository è destinato esclusivamente a scopi educativi e di ricerca. Utilizza il PoC fornito esclusivamente su sistemi di tua proprietà o per i quali hai esplicita autorizzazione a testare. Accesso non autorizzato ,...
CVE-2026-97468
Apache CXF's STSTokenValidator and Security Token Service STS cached validated security tokens under a non-cryptographic 32-bit hash of the token Java Arrays.hashCode/hashCode, and treated a cache hit as proof that the presented token had already been validated. An attacker could craft a token fo...
CVE-2026-97791
In Apache CXF, STSTokenValidator checks whether a SAML assertion is signed by a trusted certificate before deciding to send it to the STS. That result was stored in one object shared by all requests, so one request could read another's result. A remote, unauthenticated attacker could send a forge...
CVE-2026-71575
The maxage authentication-freshness check in OidcClientCodeRequestFilter was inoperative due to a milliseconds/seconds unit mismatch and an inverted comparison polarity. Any relying party using setMaxAgeOffset to enforce re-authentication would silently accept sessions of any age, bypassing step-...
BIT-GHOST-2026-103267 Ghost 0.5.0 before 6.62.0 Arbitrary Email Registration via Staff Invite
Ghost versions before 6.62.0 contain an authentication bypass vulnerability in staff invite acceptance that allows users to specify any email address when creating their account. Attackers can accept leaked invite tokens with attacker-controlled email addresses, or legitimate recipients can...
YellowKey-Bitlocker
🔑 YellowKey-Bitlocker - Gestisci la sicurezza BitLocker sui sistemi Windows 🛡️ Cos'è YellowKey-Bitlocker? YellowKey-Bitlocker è un programma per Windows 10 e Windows 11. Aiuta gli utenti a proteggere le unità dalla vulnerabilità CVE-2026-45585. Questo problema riguarda il modo in cui BitLocker...
CVE-2026-97468 Apache CXF: Authentication bypass via weak cache keys for validated STS tokens
Apache CXF's STSTokenValidator and Security Token Service STS cached validated security tokens under a non-cryptographic 32-bit hash of the token Java Arrays.hashCode/hashCode, and treated a cache hit as proof that the presented token had already been validated. An attacker could craft a token fo...
EUVD-2026-95699
Apache CXF's STSTokenValidator and Security Token Service STS cached validated security tokens under a non-cryptographic 32-bit hash of the token Java Arrays.hashCode/hashCode, and treated a cache hit as proof that the presented token had already been validated. An attacker could craft a token fo...
CVE-2026-97468
The Apache CXF framework contains an authentication bypass vulnerability in the STSTokenValidator and Security Token Service (STS) . The root cause is the use of a non-cryptographic 32-bit hash (Java Arrays.hashCode() ) to cache validated security tokens. An attacker can craft a token, such as a ...
EUVD-2026-95697
Apache CXF’s OIDC relying-party component could redirect users to an attacker-controlled URL after successful authentication. The issue occurs because attacker-controlled state parameters are preserved and later used as redirect targets without validating that the final decoded URI belongs to the...
EUVD-2026-95694
The maxage authentication-freshness check in OidcClientCodeRequestFilter was inoperative due to a milliseconds/seconds unit mismatch and an inverted comparison polarity. Any relying party using setMaxAgeOffset to enforce re-authentication would silently accept sessions of any age, bypassing step-...
CVE-2026-71575 Apache CXF: Inoperative max_age authentication-freshness check in OidcClientCodeRequestFilter
The maxage authentication-freshness check in OidcClientCodeRequestFilter was inoperative due to a milliseconds/seconds unit mismatch and an inverted comparison polarity. Any relying party using setMaxAgeOffset to enforce re-authentication would silently accept sessions of any age, bypassing step-...
CVE-2026-71575
The Apache CXF framework contains a vulnerability in the OidcClientCodeRequestFilter component. The max_age authentication-freshness check is inoperative because of an inverted comparison polarity and a unit mismatch between milliseconds and seconds. This flaw allows the system to silently accept...