CVE-2026-105696

The Penpot design and prototyping platform is vulnerable to a page-scope escalation in versions prior to 2.18.0 . The get-page and get-file-fragment RPC commands fail to verify if a requested page-id or fragment belongs to the authorized set of a provided share-link permission object. An authenti...

CVE-2026-55280

In multiple locations, there is a possible out-of-bounds write due to uninitialized data. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-71299

A flaw was discovered in Maestro where its REST API write endpoints were registered without proper authentication middleware . This vulnerability allows a remote attacker to perform unauthorized write operations, specifically creating, modifying, or deleting consumers and resource bundles . Such ...

CVE-2026-71298

A SQL injection vulnerability exists in maestro within the orderBy query parameter of its REST API list endpoints. This flaw allows a remote attacker to perform read-only blind extraction of data from the database without authentication. To mitigate this risk, users should restrict network access...

CVE-2026-100506

Deserialization of Untrusted Data vulnerability in WP Spell Check WP Spell Check wp-spell-check allows Object Injection.This issue affects WP Spell Check: from n/a through 12.1...

CVE-2026-100511

Deserialization of Untrusted Data vulnerability in Vektor Inc. VK Google Job Posting Manager vk-google-job-posting-manager allows Object Injection.This issue affects VK Google Job Posting Manager: from n/a through 1.3.1...

CVE-2026-97257

Deserialization of Untrusted Data vulnerability in PressTigers Simple Event Planner simple-event-planner allows Object Injection.This issue affects Simple Event Planner: from n/a through 1.5.7...

CVE-2026-93617

Deserialization of Untrusted Data vulnerability in WP Sunshine Sunshine Photo Cart sunshine-photo-cart allows Object Injection.This issue affects Sunshine Photo Cart: from n/a through 3.7.1...

CVE-2026-103348

Deserialization of Untrusted Data vulnerability in Smackcoders Inc. WP Ultimate Exporter wp-ultimate-exporter allows Object Injection.This issue affects WP Ultimate Exporter: from n/a through 3.0...

EUVD-2026-92609

In multiple locations, there is a possible out-of-bounds write due to uninitialized data. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-55280

In multiple locations, there is a possible out-of-bounds write due to uninitialized data. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-55280

In multiple locations, there is a possible out-of-bounds write due to uninitialized data. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-93319

A malicious external BuildKit frontend can send requests using the internal API that can create conditions for a data race that can cause the BuildKit daemon to panic...

swap_digger

swapdigger swapdigger is a bash script used to automate Linux swap analysis for post-exploitation or forensics purpose. It automates swap extraction and searches for Linux user credentials, Web form credentials, Web form emails, HTTP basic authentication, WiFi SSID and keys, etc. Download and run...

external_c2_framework

Framework externalc2 Framework en Python para construir y utilizar interfaces que transfieran datos entre frameworks, con un enfoque específico en servir como extensión para frameworks de Comando y Control. Actualmente, esto solo está pensado como una implementación de la especificación External ...

CVE-2025-55182-React2Shell-Async-Scanner

⚡ React2Shell CVE-2025-55182 / CVE-2025-66478 - Async RCE Scanner Prototype-pollution → Remote Code Execution via React Server Actions Async, version-first, output-based canary detection - no blind guessing !WARNING For authorised security research and penetration testing only. Scanning systems...

GitMonitor

GitMonitor GitMonitor Una forma de monitorear continuamente información sensible que podría estar expuesta en Github Resumen Sé que hay muchas otras herramientas disponibles para encontrar información sensible actualmente filtrada en Github, yo mismo todavía uso algunas de ellas. Sin embargo, cre...

CVE-2025-7783-poc

form-data boundary randomness vulnerability CVE-2025-7783 Largely based on https://hackerone.com/reports/2913312 by https://hackerone.com/parrot409?type=user Installing: npm install Make sure you have python3 installed with the z3 module pip3 install -r requirements.txt -- the exploit code shells...

CVE-2026-103349

The Product Feed PRO for WooCommerce plugin (versions ≤ 13.5.7 ) by Rymera Web Co is vulnerable to PHP Object Injection due to the Deserialization of Untrusted Data (CWE-502). This flaw allows an attacker to inject objects into the application. While the CVSS 3.1 score is 7.2 (High) , the attack ...

CVE-2026-97283 WordPress Advanced Post Manager plugin <= 4.5.5 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in Liquid Web / StellarWP Advanced Post Manager advanced-post-manager allows Object Injection.This issue affects Advanced Post Manager: from n/a through 4.5.5...