CVE-2026-39902

Vulnerability Report: Authenticated RCE Data Input Researcher: K | Product: Cacti ≤ 1.2.30 01 Vulnerability Summary Field| Value ---|--- Product| Cacti — Complete RRDtool-based Graphing Solution Affected Versions| ≤ 1.2.30 Vulnerability Type| OS Command Injection CWE-78 Attack Vector| Network...

CVE-2026-36358

CVE-2026-36358 PoC - Juzaweb CMS v.5.0.0 （XSS） First, set up the platform normally and register an account. Here, the administrator account I registered is [email protected] / 123456. After setting up the platform, you can see the website homepage. Access /admin and log in. After logging in,...

CVE-2026-106430

The MongoDB C++ Driver discards content after an embedded NUL byte in certain field and collection names accepted by the collection API. This can cause the driver and the calling application to interpret the same name differently. An authenticated actor who can influence a name passed by an...

CVE-2026-84274

The IBM Guardium Data Protection 12.2.2 version is affected by a sensitive information exposure vulnerability (CWE-200 ). During SECRET and API_KEY rotation processing, the edge-controller and edge-manager components log sensitive credential material at the INFO level. An authenticated attacker w...

EUVD-2026-95166

IBM Guardium Data Protection 12.2 is affected by a command injection vulnerability in the SUID-root sshconfigwrapper component. An authenticated high-privileged user can inject arbitrary commands through attacker-controlled arguments, resulting in command execution with root privileges...

CVE-2026-106433 Heap corruption via duplicate masterKey fields in MongoDB libmongocrypt

Improper state management in MongoDB libmongocrypt can cause provider-specific data to be treated as an incompatible type when cleaning up a key document containing duplicate masterKey fields. An authenticated actor who can modify key vault documents, or a server that returns such a key document,...

CVE-2026-106433 Heap corruption via duplicate masterKey fields in MongoDB libmongocrypt

Improper state management in MongoDB libmongocrypt can cause provider-specific data to be treated as an incompatible type when cleaning up a key document containing duplicate masterKey fields. An authenticated actor who can modify key vault documents, or a server that returns such a key document,...

CVE-2026-106433

Improper state management in MongoDB libmongocrypt can cause provider-specific data to be treated as an incompatible type when cleaning up a key document containing duplicate masterKey fields. An authenticated actor who can modify key vault documents, or a server that returns such a key document,...

CVE-2026-106433

Improper state management in MongoDB libmongocrypt allows for heap corruption when cleaning up a key document that contains duplicate masterKey fields. This flaw causes provider-specific data to be treated as an incompatible type, leading to invalid memory access and invalid frees in the client p...

CVE-2026-106429 Application denial of service via malformed KMS endpoint in MongoDB libmongocrypt

An integer underflow in the KMS endpoint-parsing logic of MongoDB libmongocrypt can cause an allocation failure that terminates the application process. This can occur when an authenticated user modifies a key document in the key vault collection, or when an application accepts a KMS endpoint...

CVE-2026-106430 Query and rename target confusion via embedded NUL truncation in MongoDB C++ Driver

The MongoDB C++ Driver discards content after an embedded NUL byte in certain field and collection names accepted by the collection API. This can cause the driver and the calling application to interpret the same name differently. An authenticated actor who can influence a name passed by an...

EUVD-2026-95155

The MongoDB C++ Driver discards content after an embedded NUL byte in certain field and collection names accepted by the collection API. This can cause the driver and the calling application to interpret the same name differently. An authenticated actor who can influence a name passed by an...

CVE-2026-106430

The MongoDB C++ Driver is vulnerable to query and rename target confusion due to embedded NUL truncation . The driver discards content following a NUL byte in specific field and collection names accepted by the collection API , leading to a discrepancy between how the driver and the calling appli...

Query and rename target confusion via embedded NUL truncation in MongoDB C++ Driver

The MongoDB C++ Driver discards content after an embedded NUL byte in certain field and collection names accepted by the collection API. This can cause the driver and the calling application to interpret the same name differently. An authenticated actor who can influence a name passed by an...

CVE-2025-54897-LAB

Lab: CVE-2025-54897 - Deserialization Vulnerability in Microsoft Office SharePoint 🚀 Overview This lab demonstrates a deserialization vulnerability in Microsoft Office SharePoint that enables remote code execution RCE. The issue arises from improper handling of untrusted serialized data within...

CVE-2024-27115-Exploit

SOPlanning 1.52.01 - Remote Code Execution RCE Authenticated Exploit Details Exploit Title : SOPlanning 1.52.01 Simple Online Planning Tool - Remote Code Execution RCE Authenticated Date : 6th October, 2024 Exploit Author : Ardayfio Samuel Nii Aryee Version : 1.52.01 Tested on : Ubuntu Descriptio...

CVE-2026-31281

CVE-2026-31281 Description Totara LMS is vulnerable to HTLM Injection. An attacker can inject malicious HTLM code in a message and send it to all the users in the application, resulting in executing the code and may lead to session hijacking and executing commands on the victim's browser CVSS 3...

CVE-2025-56219

CVE-2025-56219 Lack of Rate Limiting – Add User API Description An attacker can automate the creation of a large number of Users in a short period of time to cause a DoS. CVSS Score: 7.1 High Attack Type Remote Authenticated Affected Versions Versions before 8.6.8 Discovered By: Yazan Abu-Nadi...

CVE-2026-34975

CVE-2026-34975 — CRLF Email Header Injection in Plunk via raw MIME construction Severity : High CVSS 8.5 CWE : CWE-93 — Improper Neutralization of CRLF Sequences 'CRLF Injection' Affected : useplunk/plunk = 0.7.1 Fixed in : 0.8.0 Advisory : GHSA-2mvm-rg5v-7hfq NVD :...

cve-2024-21683-rce

cve-2024-21683-rce CVE-2024-21683 is a critical remote code execution RCE vulnerability affecting Atlassian's Confluence Server and Data Center. This vulnerability has a CVSS score of 8.3, placing it in the high-severity category. Attackers can exploit this vulnerability to execute remote code by...