PDF CVE-2018-4993 GoToE NTLM Callback

Generate PDF PoCs for CVE-2018-4993: /GoToE action with UNC path NTLM and HTTPS URL variant. Phone-home validation for Adobe Reader. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.pdf.mixins import PdfCveMixin from lib.pdf.generators.actions import writegotoeunc,...

CVE-2026-40009

creationtimestamp| type| source ---|---|--- 2026-07-10 11:18:42+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqbznn7c7g26 2026-07-10 12:15:29+00:00| seen| https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-40009 2026-07-10 13:25:26+00:00| seen|...

CVE-2026-40006

creationtimestamp| type| source ---|---|--- 2026-07-10 10:57:24+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqbyhjhsfl2f 2026-07-10 12:15:37+00:00| seen| https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-40006 2026-07-10 13:18:20+00:00| seen|...

CVE-2026-12400

The FlowForms – Conversational Form Builder plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.1.1 via the updateform due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with...

CVE-2026-59721

creationtimestamp| type| source ---|---|--- 2026-07-10 09:14:21+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3mqbspbvraw27...

CVE-2026-21057

creationtimestamp| type| source ---|---|--- 2026-07-10 08:47:10+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqbr6mzc2h2x 2026-07-10 09:56:42+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqbv2z7uij2a 2026-07-10 09:56:43+00:00| seen|...

CVE-2026-21045

creationtimestamp| type| source ---|---|--- 2026-07-10 08:12:28+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqbpamuqba27 2026-07-10 09:54:30+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqbux2ewhl2e 2026-07-10 12:46:38+00:00| seen|...

CVE-2026-12685 EscortWP <= 3.6.2 - Content Deletion via Vendor-Authored Backdoor

The EscortWP escortwp WordPress theme through 3.6.2 was distributed with a vendor-authored, obfuscated backdoor that lets an unauthenticated attacker who supplies a hard-coded, per-build key permanently delete all of the site's content, and that covertly transmits the site URL, administrator emai...

CVE-2026-59226

creationtimestamp| type| source ---|---|--- 2026-07-10 05:40:42+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqbgr7qezc26...

CVE-2026-59225

creationtimestamp| type| source ---|---|--- 2026-07-10 05:40:20+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqbgqlpmwx2e 2026-07-24 22:35:49+00:00| seen| https://gist.github.com/alon710/dc8fbe1b073218955707634edeb9a32e...

CVE-2026-12123

The All-in-One Video Gallery plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 4.8.5 via the 'vdl' parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to make web requests to arbitrary locatio...

CVE-2026-59221

creationtimestamp| type| source ---|---|--- 2026-07-10 05:30:29+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqbg6yf7g42s...

CVE-2026-59227

creationtimestamp| type| source ---|---|--- 2026-07-10 05:30:09+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqbg6ejpes22 2026-07-24 18:35:17+00:00| published-proof-of-concept| https://github.com/open-webui/open-webui/security/advisories/GHSA-rqj7-6wrp-6g2g...

CVE-2026-15331

A vulnerability was identified in zhayujie CowAgent up to 2.1.0. The affected element is the function addurl/addpackage of the file agent/skills/service.py of the component Skill Installation Handler. The manipulation of the argument Name leads to path traversal. The attack may be initiated...

CVE-2026-15282

creationtimestamp| type| source ---|---|--- 2026-07-10 05:16:07+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqbffamohv2z 2026-07-11 00:00:32+00:00| seen| https://bsky.app/profile/pulse-wp.com/post/3mqde7qogx42j 2026-07-13 01:01:18+00:00| seen|...

CVE-2026-15284

The King Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'formpageid' parameter in versions up to, and including, 51.1.62 This is due to insufficient input sanitization in the addtosubmissions function, which applies sanitizetextfield which preserves...

CVE-2026-55616

creationtimestamp| type| source ---|---|--- 2026-07-10 04:07:20+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqbbkbvc622t...

SUSE CVE-2026-8926

When asking curl to use a .netrc file to find credentials and at the same time specifying a URL with a username without a password, like https://[email protected]/, curl could wrongly get and use the password for another user set in the .netrc file for that host if such a one exists and there is n...

SUSE CVE-2026-12064

When a user invokes curl using a schemeless URL combined with --proto-default sftp or scp, a disconnect occurs between the tool layer and libcurl. The tool layer incorrectly infers the URL scheme, which erroneously bypasses the initialization of critical SSH security options like...

SUSE CVE-2026-58501

Zeep is a Python SOAP client. From 4.0.0 before 4.3.3, Settings.forbidexternal is defined but not enforced when parsing WSDL or XSD documents, allowing transitive xsd:import, xsd:include, wsdl:import, and lxml entity or DTD references to fetch attacker-chosen HTTP or HTTPS URLs. This issue is fix...