CVE-2026-106345

Use of released resource in Session in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to spoof UI elements via a crafted HTML page. Chromium security severity: Low...

CVE-2026-106345

Use of released resource in Session in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to spoof UI elements via a crafted HTML page. Chromium security severity: Low...

CVE-2026-106345

Google Chrome versions prior to 155.0.8059.39 are vulnerable to a use of released resource flaw within the Session component . This vulnerability allows a remote attacker, who has already compromised the renderer process , to spoof UI elements by serving a crafted HTML page. The impact is categor...

EUVD-2026-93779

Authentication bypass in the Azure AD external login flow in Devolutions Server 2026.3.7.0 and earlier allows a remote attacker to take over a user's account via replay of a captured login-session token exposed in a redirect URL...

CVE-2026-106119

The LangChain framework is vulnerable to a query injection flaw in the MongoDBChatMessageHistory component prior to version 1.3.1 . The root cause is a failure to enforce the documented string type for untrusted structured session identifiers at runtime, which allows these identifiers to be inter...

CVE-2026-106119 LangChain: MongoDBChatMessageHistory query injection can allow cross-session access

LangChain is a framework for building LLM-powered applications. Prior to 1.3.1, MongoDBChatMessageHistory does not enforce the documented string type for an untrusted structured session identifier at runtime, allowing the identifier to be interpreted as a MongoDB query condition rather than as a...

CVE-2026-106119 LangChain: MongoDBChatMessageHistory query injection can allow cross-session access

LangChain is a framework for building LLM-powered applications. Prior to 1.3.1, MongoDBChatMessageHistory does not enforce the documented string type for an untrusted structured session identifier at runtime, allowing the identifier to be interpreted as a MongoDB query condition rather than as a...

CVE-2026-106119 LangChain: MongoDBChatMessageHistory query injection can allow cross-session access

LangChain is a framework for building LLM-powered applications. Prior to 1.3.1, MongoDBChatMessageHistory does not enforce the documented string type for an untrusted structured session identifier at runtime, allowing the identifier to be interpreted as a MongoDB query condition rather than as a...

CVE-2026-100725

A flaw was found in http4k-core. The client-side cookie storage mechanism fails to enforce standard scoping rules for domain, path, and secure transmission attributes. When an application communicates with multiple destinations using a single cookie store, cookies intended for one server can be...

CVE-2015-9251

CVE-2015-9251 [email protected] PoC pour CVE-2015-9251 jQuery inférieur à 3.0.0. CVE-2015-9251 - PoC Exploit Ce dépôt contient une Preuve de concept PoC pour la vulnérabilité CVE-2015-9251 dans la bibliothèque jQuery. La vulnérabilité permet une attaque de Cross-Site Scripting XSS via des...

CVE-2026-105861

Payload is a free and open source headless content management system. In versions after 3.0.0 and before 3.90.0, authenticated external URL-based upload retrieval can forward authentication data to a redirected destination that was not verified as trusted, potentially exposing a valid session to ...

CVE-2026-105861 Payload external upload trust validation issue

Payload is a free and open source headless content management system. In versions after 3.0.0 and before 3.90.0, authenticated external URL-based upload retrieval can forward authentication data to a redirected destination that was not verified as trusted, potentially exposing a valid session to ...

CVE-2026-105861

The headless content management system Payload is vulnerable in versions after 3.0.0 and before 3.90.0 . The flaw resides in the authenticated external URL-based upload retrieval feature, where the system fails to verify the trustworthiness of a redirected destination. This origin validation erro...

CVE-2026-105861 Payload external upload trust validation issue

Payload is a free and open source headless content management system. In versions after 3.0.0 and before 3.90.0, authenticated external URL-based upload retrieval can forward authentication data to a redirected destination that was not verified as trusted, potentially exposing a valid session to ...

poc-cribl-rce

إخلاء المسؤولية هذا للأغراض المعلوماتية/التعليمية فقط. تم تجميع هذا لإظهار نقطة ضعف في الأداة، وذلك للتحقق من الإصلاح من قبل البائع. معلومات تم الاختبار على Cribl الإصدار 1.5.0 - الإصدارات السابقة لم يتم اختبارها ولكنها على الأرجح معرضة للخطر. يمكن نقل رمز JWT صالح من وحقنه في جلسة مثيل Cribl آخر...

CVE-2026-79551-Tenda

CVE-2026-79551 Clé privée TLS codée en dur Tenda ID CNVD : CNVD-2026-25884 Fournisseur : Tenda Technology Co., Ltd. Produit : Enregistreur vidéo réseau NVR4H version matérielle CH3V2.1 Micrologiciel : V27.5.58.6 Classe : CWE-321 — Utilisation d'une clé cryptographique codée en dur Aperçu Le...

MAL-2026-17363 Malicious code in @kxa/xbails (npm)

This package is part of a large family 100+ identified as of September 2026 of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated w:mex FOLLOW query queryid...

CVE-2024-42009-roundcube-xss

CVE-2024-42009 — Roundcube Webmail 1.6.6 Stored XSS PoC Только для авторизованного тестирования безопасности, CTF-сред и образовательных исследований. Использование этого инструмента против систем, которыми вы не владеете или на тестирование которых у вас нет письменного разрешения, незаконно в...

CVE-2019-9193

EN GenPostgresRCEExploit is a PoC tool designed to exploit an authenticated Remote Code Execution RCE vulnerability in certain versions of PostgreSQL 9.3 - 11.7. It allows authenticated users to execute system commands on a PostgreSQL database server vulnerable to CVE-2019-9193. Features...

CVE-2025-5777

CVE-2025-5777 — Citrix NetScaler « CitrixBleed 2 » Divulgation de mémoire Article de recherche par Sentinel AI Defense. Analyse défensive uniquement — aucun exploit fonctionnel ou PoC n'est publié ici. La suite du CitrixBleed original : une lecture hors limites sur les points de terminaison...