CVE-2026-109412

An exposed dangerous endpoint in Ivanti Neurons Patch for Intune allows a remote authenticated attacker to leak sensitive authentication information . The vulnerability is associated with CWE-749 (Exposed Dangerous Method or Function) and carries a CRITICAL CVSS 3.1 score of 9.9. While the impact...

CVE-2026-41179

CVE-2026-41179 — rclone RC API Unauthenticated RCE ⚠️ EDUCATIONAL PURPOSES ONLY This repository is intended strictly for security research, education, and authorized lab environments. PSSec and the contributors of this repository do not condone, support, or take any responsibility for any...

aapanel-ws-bypass

aaPanel: Vendors Don't Always Fix Things Properly An incomplete fix for CVE-2021-37840 still exposes 3.6M servers to root RCE, 5 years later Discovered by: EON Security CVE: Pending assignment CVSS: 8.8 High — AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Affected: aaPanel versions 6.8.12 through 7.65.0...

CVE-2021-26084

CVE-2021-26084 CVE-2021-26084, Atlassian Confluence OGNL Injection Vulnerability Atlassian Confluence is a widely used wiki system in enterprises, and some versions contain an OGNL expression injection vulnerability. Attackers can exploit this vulnerability to execute arbitrary code on the target...

GitHub Tightens npm Publishing After Flaw Left 1,500+ Packages Vulnerable to Hijacking

GitHub has taken the step of expiring unvalidated npm trusted publishing configurations 48 hours after creation after researchers found that it was possible for an attacker to push new versions of a different user's package without having to steal their credentials. "Your configuration becomes...

AZL-108045 CVE-2026-49265 affecting package python-oauthlib 3.2.2-3

OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. From 3.0.0 until 4.0.0, OAuthLib's PKCE checks in oauthlib/oauth2/rfc6749/granttypes/authorizationcode.py compare attacker-supplied codeverifier values with stored challenges using ordinary string equality in...

DEBIAN-CVE-2026-49265

OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. From 3.0.0 until 4.0.0, OAuthLib's PKCE checks in oauthlib/oauth2/rfc6749/granttypes/authorizationcode.py compare attacker-supplied codeverifier values with stored challenges using ordinary string equality in...

CVE-2026-49265

OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. From 3.0.0 until 4.0.0, OAuthLib's PKCE checks in oauthlib/oauth2/rfc6749/granttypes/authorizationcode.py compare attacker-supplied codeverifier values with stored challenges using ordinary string equality in...

CVE-2026-109526

A vulnerability has been found in HBAI-Ltd Toonflow-app up to 1.1.8. This affects an unknown function of the component exportData Endpoint. Such manipulation leads to information disclosure. An attack has to be approached locally. The exploit has been disclosed to the public and may be used...

CVE-2026-102981

Plane is an open-source project management tool. Prior to 1.4.0, self-hosted Plane deployments allow unauthenticated GET requests to api/workspaces/slug/invitations/pk/join/ through WorkspaceJoinEndpoint, whose WorkSpaceMemberInviteSerializer exposes the secret invitation token directly and throu...

CVE-2024-34326

ProPhoenix Law RMS v2022.2403.3.101 was discovered to contain a reflected cross-site scripting XSS vulnerability via the PageTitle/Alert/MsgType parameter in the errorHandler.aspx endpoint...

CVE-2024-34321

ProPhoenix Law RMS v2022.2403.3.101 was discovered to contain a reflected cross-site scripting XSS vulnerability via the PageTitle/Notes parameter in the Notes.aspx endpoint...

CVE-2026-49265

OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. From 3.0.0 until 4.0.0, OAuthLib's PKCE checks in oauthlib/oauth2/rfc6749/granttypes/authorizationcode.py compare attacker-supplied codeverifier values with stored challenges using ordinary string equality in...

UBUNTU-CVE-2026-49265

OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. From 3.0.0 until 4.0.0, OAuthLib's PKCE checks in oauthlib/oauth2/rfc6749/granttypes/authorizationcode.py compare attacker-supplied codeverifier values with stored challenges using ordinary string equality in...

CVE-2025-28073

CVE-2025-28073 Suggested description phpList 3.6.3 is vulnerable to Reflected Cross-Site Scripting XSS via the /lists/dl.php endpoint. An attacker can inject arbitrary JavaScript code by manipulating the id parameter, which is improperly sanitized. Vulnerability Type Cross Site Scripting XSS Vend...

Exploit for CVE-2026-82957

SSRF in Hyperledger FireFly Webhook Subscriptions CVE-2026-82...

EUVD-2026-98851

A flaw has been found in SourceCodester Online Exam System 1.0. Affected is an unknown function of the file adminpanel/admin/query/loginExe.php of the component Login Endpoint. This manipulation of the argument username/pass causes sql injection. It is possible to initiate the attack remotely. Th...

CVE-2026-109607 SourceCodester Online Exam System Login Endpoint loginExe.php sql injection

A flaw has been found in SourceCodester Online Exam System 1.0. Affected is an unknown function of the file adminpanel/admin/query/loginExe.php of the component Login Endpoint. This manipulation of the argument username/pass causes sql injection. It is possible to initiate the attack remotely. Th...

CVE-2026-109607

A SQL injection vulnerability exists in SourceCodester Online Exam System 1.0 within the Login Endpoint component. Specifically, an unknown function in the file adminpanel/admin/query/loginExe.php fails to properly neutralize inputs for the username/pass arguments. This flaw allows for remote att...

CVE-2020-8163

CVE-2020-8163 CVE-2020-8163 - Remote code execution of user-provided local names in Rails Remote code execution of user-provided local names in Rails 5.0.1 There was a vulnerability in versions of Rails prior to 5.0.1 that would allow an attacker who controlled the locals argument of a render cal...