CVE-2026-83391

The Oracle E-Business Suite product Oracle HRMS (US) , specifically within the US Payroll Year End component, is affected by a vulnerability in versions 12.2.3-12.2.15 . A low-privileged attacker with network access via HTTP can exploit this flaw to compromise the system, though it requires human...

CVE-2026-101814

A vulnerability exists in the Oracle Engineering product of Oracle E-Business Suite (component: Change Management ) affecting versions 12.2.3-12.2.15 . An unauthenticated attacker with network access via HTTP can exploit this vulnerability to compromise Oracle Engineering, potentially resulting i...

CVE-2026-101813

A vulnerability exists in the Change Management component of the Oracle Engineering product within Oracle E-Business Suite . Affected versions include 12.2.3-12.2.15 . A low privileged attacker with network access via HTTP can easily exploit this flaw to compromise Oracle Engineering, potentially...

CVE-2026-101407

Oracle PeopleSoft PeopleTools product (component: Updates Change Assistant ) is affected by CVE-2026-101407 in versions 8.61-8.63 . A high-privileged attacker with network access via HTTP can exploit this vulnerability to gain unauthorized access to critical data or all accessible data within the...

seccubus

About Seccubus Seccubus automates regular vulnerability scans with various tools and aids security people in the fast analysis of its output, both on the first scan and on repeated scans. On repeated scan delta reporting ensures that findings only need to be judged when they first appear in the...

ApostropheCMS: No Attempt Throttling on Authenticated Password-Change Endpoint Enables Unlimited Current-Password Guessing

Summary The self-service password-change endpoint verifies the current password but does not use the login module’s failed-attempt counter, throttle, delay, or lockout mechanism. An attacker with a valid authenticated session can submit repeated guesses for the current password without receiving ...

NPM: ApostropheCMS: No Attempt Throttling on Authenticated Password-Change Endpoint Enables Unlimited Current-Password Guessing

NPM: ApostropheCMS: No Attempt Throttling on Authenticated Password-Change Endpoint Enables Unlimited Current-Password Guessing vulnerability discovered by ? in WordPress Npm apostrophe versions 4.33.0...

CVE-2026-113710

ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, the self-service password-change endpoint verifies the current password but does not use the login module’s failed-attempt counter, throttle, delay, or lockout mechanism. An attacker with a valid authenticated...

CVE-2025-58434-PoC

CVE-2025-58434-PoC This repository contains a Proof of Concept PoC Python script for CVE-2025-58434, which enables attackers to change passwords of other users without authentication process in flowise version 3.0.5 and lower due to token leakage. Usage To run the exploit, use the...

CVE-2026-80786

A flaw was found in the fbdev subsystem of the Linux kernel. This vulnerability occurs because certain user-invoked display mode changes, specifically those not using the FBIOPUTVSCREENINFO ioctl, fail to properly update the fbcon state. A local user could potentially exploit this by triggering a...

EUVD-2026-105221

ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, the self-service password-change endpoint verifies the current password but does not use the login module’s failed-attempt counter, throttle, delay, or lockout mechanism. An attacker with a valid authenticated...

CVE-2026-113710

The ApostropheCMS Node.js content management system is vulnerable to unlimited current-password guessing on the self-service password-change endpoint in versions prior to 4.33.0 . The root cause is the absence of the login module’s failed-attempt counter, throttling, delay, or lockout mechanisms ...

CVE-2026-113710 ApostropheCMS: No Attempt Throttling on Authenticated Password-Change Endpoint Enables Unlimited Current-Password Guessing

ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, the self-service password-change endpoint verifies the current password but does not use the login module’s failed-attempt counter, throttle, delay, or lockout mechanism. An attacker with a valid authenticated...

CVE-2026-112909

filelock is a platform-independent file lock for Python. Prior to 4.2.1, UnixFileLock can truncate a regular file renamed onto the lock path when another local user has actual rename permission, or hard-linked there under a permissive hard-link policy; when an explicit mode is requested, affected...

CVE-2025-3604

🚨 Flynax Bridge CVE : CVE-2025-3604 CVSS : 9.8 Critical Published : April 23, 2025 Last Updated : April 24, 2025 ⚙️ Script Output Example Detected plugin version: 2.2.0 Version is vulnerable. Attempting exploit... Exploit succeeded! Email changed to: [email protected] Exploit By Nxploited...

EUVD-2026-105017

filelock is a platform-independent file lock for Python. Prior to 4.2.1, UnixFileLock can truncate a regular file renamed onto the lock path when another local user has actual rename permission, or hard-linked there under a permissive hard-link policy; when an explicit mode is requested, affected...

CVE-2026-53360-POC

CVE-2026-53360: KVM SEV-SNP PSC heap out-of-bounds Proof of concept for a heap out-of-bounds read and write in KVM's SEV-SNP Page State Change PSC handling. A malicious SEV-SNP guest makes the host kernel walk a PSC entry array off the end of its slab allocation. That leaks the layout of...

CVE-2026-41940

CVE-2026-41940 – cPanel/WHM Auth Bypass + Root Password Changer This script exploits an authentication bypass vulnerability in cPanel/WHM CVE-2026-41940 using a CRLF injection technique to forge an administrator session. Once successful, the script can change the root user's password in WHM and...

Zerologon-Attack-CVE-2020-1472-POC

CVE-2020-1472 POC Requires the latest impacket from GitHub with added netlogon structures. Do note that by default this changes the password of the domain controller account. Yes this allows you to DCSync, but it also breaks communication with other domain controllers, so be careful with this! Mo...

RLSA-2026:84595 Moderate: cockpit-files security update

A filesystem browser for Cockpit Security Fixes: cockpit-files: cockpit-files: Arbitrary file ownership change via symlink following in privileged paste CVE-2026-91202 cockpit-files: cockpit-files: Local attacker can hijack file ownership via symlink race CVE-2026-91205 For more details about the...