sparrow-wifi

Sparrow-WiFi Sparrow-WiFi is a 2.4 GHz and 5 GHz WiFi and Bluetooth spectral awareness tool for Linux. It integrates WiFi scanning, Bluetooth Low Energy and Classic discovery, software-defined radio spectrum analysis HackRF, Ubertooth, GPS tracking, FAA RemoteID drone detection, drone/rover-mount...

EEF-CVE-2026-120286 Missing authorization in device and deployment group page events allows view-role members to change devices and deployment groups

Summary Missing Authorization vulnerability in the device and deployment group pages in nerves-hub nerveshubweb allows an authenticated organization member with the view role to change devices and deployment groups via LiveView events reserved for the manage role. The event handlers that add and...

CVE-2026-120286

A Missing Authorization vulnerability in nerves_hub_web (versions 1.0.0 before 2.5.3) allows authenticated members with the view role to perform actions reserved for the manage role. The root cause is that specific LiveView event handlers—including those for certificate management, tag manipulati...

CVE-2026-120295

An Incorrect Authorization vulnerability in nerves_hub nerves_hub_web (versions 1.0.0 before 2.5.3) allows an authenticated user with a manage role in one organization and only a view role in another to move their own devices into a product belonging to the second organization. The flaw exists be...

Brave Desktop 1.81.131 Security Fixes

Added clickjacking protection on DDNS interstitials as reported on HackerOne by newfunction. - Fixed inactive split view tab displaying a permission prompt as reported on HackerOne by frozzipies. Upgraded Chromium to 139.0.7258.66 — refer to Google Chrome advisories for inherited CVEs...

Brave Desktop 1.83.108 Security Fixes

Updated split view to respect SameSite attribute as reported on HackerOne by mingijung. - Removed incorrectly elided URL from shields panel as reported on HackerOne by apapedulimu. Upgraded Chromium to 141.0.7390.55 — refer to Google Chrome advisories for inherited CVEs...

Netryx-Astra-V2-Geolocation-Tool

Netryx Astra V2 State-of-the-art AI geolocation from a single image. The Idea • How It Works • Getting Started • Community Hub • Installation The Idea You have a photograph. Maybe it's a screenshot from a video. Maybe it's a cropped, blurry phone photo someone posted online. Maybe it shows just a...

ServiceNow AI Platform - Pre-Auth JavaScript Sandbox Escape RCE

ServiceNow AI Platform Brazil, Australia, Zurich, and Yokohama releases before patching contains a pre-authentication remote code execution vulnerability. The /assessmentthanks.do endpoint passes the sysparmassessabletype parameter into GlideRecord's addQuery, which evaluates "javascript:" prefix...

YesWiki Archived Revision - Cross-Site Scripting

YesWiki's archived-revision view reflects the time GET parameter into a hidden HTML input in handlers/page/show.php without escaping. Because MySQL coerces malformed DATETIME strings, an attacker can append an XSS payload after a valid revision timestamp. id: CVE-2026-52773 info: name: YesWiki...

WPBot <= 8.4.9 - Cross-Site Scripting

WPBot = 8.4.9 is vulnerable to stored cross-site scripting via the conversation parameter in the qcldwbchatbotconversationsave AJAX action. The AJAX nonce qcsecretbotnonceval123qc is publicly emitted on every frontend page via wplocalizescript under the ajaxnonce key, making it freely obtainable ...

Dashy <= 4.3.6 - Reflected XSS via Workspace

Dashy versions up to 4.3.6 contain a reflected cross-site scripting vulnerability in the workspace view. The url query parameter is passed directly to an iframe src attribute without scheme validation, allowing an attacker to inject javascript: URIs that execute arbitrary JavaScript in the contex...

CVE-2026-125392 Webmin through 2.670 Stored XSS via BIND8 edit_recs.cgi ALL View

Webmin through 2.670 contains a stored cross-site scripting vulnerability in bind8/editrecs.cgi that outputs raw DNS record values without HTML escaping in ALL view mode. Delegated zone users such as Virtualmin domain owners can store record values containing script that executes in an...

CVE-2026-121842

Privilege escalation in the Reader View component in Firefox for iOS. This vulnerability was fixed in Firefox for iOS 160.0...

CVE-2026-121842 Privilege escalation in the Reader View component in Firefox for iOS

Privilege escalation in the Reader View component in Firefox for iOS. This vulnerability was fixed in Firefox for iOS 160.0...

CVE-2026-121842 Privilege escalation in the Reader View component in Firefox for iOS

Privilege escalation in the Reader View component in Firefox for iOS. This vulnerability was fixed in Firefox for iOS 160.0...

CVE-2026-121842

A privilege escalation vulnerability exists in the Reader View component of Firefox for iOS . This flaw allows an attacker to gain elevated privileges, resulting in a high impact on confidentiality, integrity, and availability. The vulnerability was addressed and fixed in Firefox for iOS version ...

EUVD-2026-120058

Privilege escalation in the Reader View component in Firefox for iOS. This vulnerability was fixed in Firefox for iOS 160.0...

CVE-2026-124621

A vulnerability was determined in kongxin-github JavaLibraryManagementSystem up to 70a6eb6b96fe64575d8051f1a59055bfc5dc5885. This affects the function...

CVE-2026-124621

A vulnerability was determined in kongxin-github JavaLibraryManagementSystem up to 70a6eb6b96fe64575d8051f1a59055bfc5dc5885. This affects the function...

CVE-2026-124621

A vulnerability exists in the kongxin-github Java_Library_Management_System (up to commit 70a6eb6b96fe64575d8051f1a59055bfc5dc5885 ) within the Swing UI Layer component. Specifically, the file src/view/MainInterface.java contains functions—including UpdateAdmin.deleteuser, UpdateAdmin.updateadmin...