sharesniffer

sharesniffer sharesniffer is a network analysis tool for finding open and closed file shares on your local network. It includes auto-network discovery and auto-mounting of any open cifs and nfs shares. How to use Example to find all hosts on any local network with open/closed nfs/smb shares: pyth...

CVE-2026-111628

10up Distributor before 2.3.2 contains a PHP object injection vulnerability that allows Contributor-level users to instantiate PHP objects by double unserializing distributed post meta. Attackers can store a serialized PHP string as meta, which setmeta in includes/utils.php unserializes on the...

CVE-2026-111628

10up Distributor versions before 2.3.2 are vulnerable to a PHP object injection flaw. The root cause is the double unsererialization of distributed post meta within the set_meta() function located in includes/utils.php. This allows users with Contributor-level privileges to store a serialized PHP...

EUVD-2026-103050

10up Distributor before 2.3.2 contains a PHP object injection vulnerability that allows Contributor-level users to instantiate PHP objects by double unserializing distributed post meta. Attackers can store a serialized PHP string as meta, which setmeta in includes/utils.php unserializes on the...

Comment2Shell

Comment2Shell Comment2Shell is an end-to-end proof-of-concept for CVE-2026-93485, a pre-authentication stored XSS in WordPress core wpautop that escalates to remote code execution inside an administrator session. An anonymous comment plants the payload; when an admin opens the post, the browser...

PT-2026-116027

10up Distributor before 2.3.2 contains a PHP object injection vulnerability that allows Contributor-level users to instantiate PHP objects by double unserializing distributed post meta. Attackers can store a serialized PHP string as meta, which set meta in includes/utils.php unserializes on the...

CVE-2026-104198

ZoneMinder is a free, open source closed-circuit television software application. In versions 1.34.0 through 1.36.38, the web interface mishandles failed token authentication in web/includes/auth.php. validateToken returns false when a token is malformed or has an invalid signature, but the calle...

CVE-2026-104198

ZoneMinder versions 1.34.0 through 1.36.38 are vulnerable to a web authentication bypass in web/includes/auth.php. The validateToken() function returns false for malformed or invalid tokens, but the system incorrectly assigns this boolean value to the global $user variable. Since web/index.php on...

EUVD-2026-102423

ZoneMinder is a free, open source closed-circuit television software application. In versions 1.34.0 through 1.36.38, the web interface mishandles failed token authentication in web/includes/auth.php. validateToken returns false when a token is malformed or has an invalid signature, but the calle...

CVE-2026-104198 ZoneMinder failed token handling bypasses web authentication

ZoneMinder is a free, open source closed-circuit television software application. In versions 1.34.0 through 1.36.38, the web interface mishandles failed token authentication in web/includes/auth.php. validateToken returns false when a token is malformed or has an invalid signature, but the calle...

CVE-2026-104198 ZoneMinder failed token handling bypasses web authentication

ZoneMinder is a free, open source closed-circuit television software application. In versions 1.34.0 through 1.36.38, the web interface mishandles failed token authentication in web/includes/auth.php. validateToken returns false when a token is malformed or has an invalid signature, but the calle...

CVE-2026-97205

NGINX Plus and NGINX Open Source have a vulnerability in the ngxhttpcoremodule module. When asynchronous file I/O AIO is enabled in certain configurations, processing a Server Side Includes SSI page containing “include virtual” commands may trigger a Use-After-Free UAF in the NGINX worker process...

CVE-2026-109352

LibreNMS versions prior to 26.9.0 are vulnerable to a stored cross-site scripting (XSS) vulnerability located in includes/html/pages/device/wireless.inc.php. The root cause is the lack of proper output escaping when the application echoes sensor_descr values, which are populated from SNMP Display...

CVE-2026-109352 LibreNMS before 26.9.0 Stored XSS via wireless sensor description

LibreNMS before 26.9.0 contains a stored cross-site scripting vulnerability in includes/html/pages/device/wireless.inc.php, which echoes wireless sensor sensordescr values, populated from SNMP DisplayString fields during discovery, into HTML without escaping. Attackers controlling a monitored...

CVE-2026-109352: Improper Neutralization of Input During Web Page Generation

LibreNMS before 26.9.0 contains a stored cross-site scripting vulnerability in includes/html/pages/device/wireless.inc.php, which echoes wireless sensor sensordescr values, populated from SNMP DisplayString fields during discovery, into HTML without escaping. Attackers controlling a monitored...

Debian dsa-6555 : gir1.2-rsvg-2.0 - security update

The remote Debian 13 host has packages installed that are affected by a vulnerability as referenced in the dsa-6555 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6555-1 [email protected] https://www.debian.org/security/ Moritz...

EUVD-2026-96989

LibreNMS through 26.9.1.1 contains an authorization bypass vulnerability in includes/html/graphs/smokeping/auth.inc.php that checks the src probe device instead of the rendered target device. Restricted users permitted on a probe device can request smokepingin or smokepingout graphs with arbitrar...

CVE-2026-108715: Authorization Bypass Through User-Controlled Key

LibreNMS through 26.9.1.1 contains an authorization bypass vulnerability in includes/html/graphs/smokeping/auth.inc.php that checks the src probe device instead of the rendered target device. Restricted users permitted on a probe device can request smokepingin or smokepingout graphs with arbitrar...

PT-2026-110118

Name of the Vulnerable Software and Affected Versions LibreNMS versions prior to 26.9.1.2 Description An authorization bypass exists in the file includes/html/graphs/smokeping/auth.inc.php. The system incorrectly validates the source probe device rather than the rendered target device. This allow...

NPM: simple-git allows command execution through unblocked Git configuration includes

NPM: simple-git allows command execution through unblocked Git configuration includes vulnerability discovered by ? in WordPress Npm simple-git versions = 3.36.0...