211446 matches found
glass-cage-i18-2025-24085-and-cve-2025-24201
Original Fork Network Left Glass Cage: Zero-Click PNG Exploit Chain for iOS 18.2.1 CVE-2025-24201 – WebKit Remote Code Execution CVE-2025-24085 – Core Media Privilege Escalation Reported to Apple: January 9, 2025 Patched: February–March 2025 Tested On: iPhone 14 Pro Max iOS 18.2.1 CVSS Base Score...
GraphQLer
The only dependency-aware GraphQL API testing tool! GraphQLer is a cutting-edge tool designed to dynamically test GraphQL APIs with a focus on adaptability. It offers a range of sophisticated features that streamline the testing process and ensure robust analysis of GraphQL APIs. GraphQLer...
CVE-2025-11203-PoC
CVE-2025-11203 — LiteLLM Health Endpoint APIKEY Information Disclosure LiteLLM versions 1.63.14 /health endpoint, when processing the apikey parameter, does not properly filter sensitive information , causing authenticated users to retrieve API Keys stored in other model configurations. The apike...
CVE-2026-51119
CVE-2026-51119 - Privilege Escalation in Invixium IXM WEB v2.3.85.25 Overview A privilege escalation vulnerability exists in Invixium IXM WEB v2.3.85.25 due to missing authorization checks on the POST /SystemUsers/CreateAppUser endpoint. An authenticated low-privileged user can abuse this endpoin...
CVE-2026-47102-PoC
CVE-2026-47102 — LiteLLM Privilege Escalation via /user/update LiteLLM v1.83.7 versions before v1.83.10 /user/update endpoint allows low-privileged users with access to this endpoint to modify their own userrole field to proxyadmin when updating their account, achieving unauthorized privilege...
CVE-2026-96535 Cross-Site Scripting in the YouMind web application
Cross-Site Scripting on the YouMind portal, specifically in the avatar update endpoint, when setting a profile picture via an arbitrary URL. This occurs due to a lack of sanitisation and validation of SVG content when setting an SVG image containing embedded JavaScript code as the avatar. The fil...
CVE-2026-96535 Cross-Site Scripting in the YouMind web application
Cross-Site Scripting on the YouMind portal, specifically in the avatar update endpoint, when setting a profile picture via an arbitrary URL. This occurs due to a lack of sanitisation and validation of SVG content when setting an SVG image containing embedded JavaScript code as the avatar. The fil...
EUVD-2026-98362
Cross-Site Scripting on the YouMind portal, specifically in the avatar update endpoint, when setting a profile picture via an arbitrary URL. This occurs due to a lack of sanitisation and validation of SVG content when setting an SVG image containing embedded JavaScript code as the avatar. The fil...
CVE-2026-96535
The YouMind portal is vulnerable to Cross-Site Scripting (XSS) within its avatar update endpoint . The flaw occurs because the application fails to sanitize or validate SVG content when a user sets a profile picture via an arbitrary URL. An attacker can upload an SVG file containing embedded Java...
CVE-2025-5777
CVE-2025-5777 - Citrix NetScaler Memory Leak PoC 📌 Description This script exploits a critical memory disclosure vulnerability in Citrix NetScaler ADC/Gateway appliances, identified as CVE-2025-5777 dubbed CitrixBleed 2. It triggers a memory leak through the /p/u/doAuthentication.do endpoint,...
CVE-2024-42009
CVE-2024-42009 – Reflected XSS in Roundcube Webmail 📌 Overview This repository contains a Nuclei template and supporting resources to safely demonstrate and validate CVE-2024-42009 , a critical reflected XSS vulnerability in Roundcube Webmail. The flaw resides in the messagebody function in...
douglas-042-HQ
Douglas-042 HEADQUARTERS Agent-based threat hunting and incident response, for estates that do not have an EDR. Sweep a fleet of Windows and Linux hosts for signs of compromise, decide what actually matters, and act on it — from one console, with one command per host. What it does A hunt is not a...
CVE-2026-102562
The AcyMailing plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the customField parameter of the public frontusers::subscribe endpoint in versions up to, and including, 11.1.0. This is due to insufficient input sanitization and output escaping in the acymcleanVar sanitizer,...
wp2shell-detect
wp2shell-detect Blackbox, non-intrusive detector for wp2shell — the pre-authentication RCE chain in WordPress core disclosed on 2026-07-17: CVE-2026-63030 — route confusion in the REST batch endpoint /wp-json/batch/v1: a sub-request whose path fails wpparseurl lands in the validation array but no...
CVE-2025-10681
CVE-2025-10681: Hardcoded Azure Blob Storage Account Key Advisory Field| Value ---|--- CVE| CVE-2025-10681 ICSA| ICSA-26-055-03 CVSS 3.1| 8.6 High Vector| CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L CWE| CWE-798 Use of Hard-coded Credentials Researcher| Michael Groberman — Gr0m Published|...
Security update for gcc48
This update for gcc48 fixes the following issue: CVE-2026-102010: UAF due to improper pointer update when an application calls the eraseif function on a binary heap priority queue in libstdc++ bsc1283123. Patch Instructions: To install this SUSE update use the SUSE recommended installation method...
SUSE-SU-2026:4637-1 Security update for gcc48
This update for gcc48 fixes the following issue: - CVE-2026-102010: UAF due to improper pointer update when an application calls the eraseif function on a binary heap priority queue in libstdc++ bsc1283123...
Vulnerability-scanner
With the increasing reliance of organizations on digital technologies to carry out communication, data storage, and business operations, the threats to cybersecurity have significantly increased. Given the critical role that endpoint security software plays in securing networks and systems, such...
