CVE-2026-73319

XenForo before 2.3.13 contains a cross-site scripting vulnerability in the dynamic redirect handler that allows unauthenticated attackers to execute arbitrary JavaScript in the board origin by crafting a malicious javascript: URI that bypasses host validation. Attackers can embed the board hostna...

CVE-2026-33389

An improper certificate/host key validation vulnerability was discovered in the Smart Polling functionality, which established encrypted connections to target devices without validating the remote host's identity, and no option was provided to enable it. A man-in-the-middle attacker positioned...

Windows Host Guardian Service Elevation of Privilege Vulnerability

Use after free in Windows Host Guardian Service allows an authorized attacker to elevate privileges locally...

CVE-2026-53360-POC

CVE-2026-53360: KVM SEV-SNP PSC ヒープ領域外アクセス KVMのSEV-SNP Page State Change（PSC）処理におけるヒープ領域外読み取りおよび書き込みの概念実証です。悪意のあるSEV-SNPゲストがホストカーネルにPSCエントリ配列をスラブ割り当ての末尾まで走査させます。これにより、隣接する kmalloc-cg-32 オブジェクトのレイアウトが漏洩し、制御された小さな値がそれらに書き込まれます。ゲストはこれを好きなだけ繰り返すことができます。 Full writeup:...

CVE-2026-39949

CVE-2026-39949：通过主机变量注入在Cacti中实现认证远程代码执行 摘要 Cacti ≤ 1.2.30 中存在一个操作系统命令注入漏洞，允许任何拥有设备和图形模板创建权限的认证用户在底层服务器上执行任意命令。该漏洞的存在是因为用户可控的主机元数据字段（具体是设备备注字段）通过 Cacti 的变量替换引擎被直接插入到 RRDtool 命令行参数中，而没有任何清洗或转义。攻击者可以在备注字段中注入 shell 元字符，构造一个引用 |hostnotes| 变量的图形模板，并触发图形渲染，从而以 Web 服务器用户的身份实现完全远程代码执行。 使用方法： root@kitploi...

EUVD-2026-72756

XenForo before 2.3.13 contains a cross-site scripting vulnerability in the dynamic redirect handler that allows unauthenticated attackers to execute arbitrary JavaScript in the board origin by crafting a malicious javascript: URI that bypasses host validation. Attackers can embed the board hostna...

CVE-2026-73319

XenForo versions prior to 2.3.13 are affected by a cross-site scripting (XSS) vulnerability in the dynamic redirect handler . The root cause is that unauthenticated attackers can craft a malicious javascript: URI that embeds the board hostname in the authority component and uses percent-encoded n...

CVE-2026-50093

A vulnerability has been identified in Siveillance Control Pro V3.0 All versions V3.0.12.2173, Siveillance Control Pro V4.0 All versions V4.0.9.2178, Siveillance Control V3.0 All versions V3.0.22.2177, Siveillance Control V4.0 All versions V4.0.11.2177. A vulnerability in the OIS web module allow...

Malicious code in i18nexus-tools (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 558344f06c374c5eff9c870250d63a5e9f784ffe23f91182154d9c66c441ee0b The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

CVE-2026-19397

Missing authentication for a critical function in ASUS Control Center Express Agent allows an unauthenticated nearby user to control the host via a direct connection to the agent when the host has an active login session. Refer to the ' Security Update for ASUS Control Center Express Agent '...

EUVD-2026-72612

Missing authentication for a critical function in ASUS Control Center Express Agent allows an unauthenticated nearby user to control the host via a direct connection to the agent when the host has an active login session. Refer to the ' Security Update for ASUS Control Center Express Agent '...

CVE-2026-19397

Missing authentication for a critical function in ASUS Control Center Express Agent allows an unauthenticated nearby user to control the host via a direct connection to the agent when the host has an active login session. Refer to the ' Security Update for ASUS Control Center Express Agent '...

cve-2019-5736-poc

CVE-2019-5736 概念実証 これはホストのruncバイナリに文字列を追加します。自身のペイロードを持ち込んでください（stage2.cを参照）。 実行方法: docker build -t cve . docker run cve strings /usr/bin/docker-runc | tail -n 2...

CVE-2026-49468-LiteLLM-Auth-Bypass

CVE-2026-49468 — LiteLLM 通过Host头路由混淆实现未认证的身份验证绕过 在 LiteLLM 代理（BerriAI）中存在的预认证身份验证/授权绕过。一个精心构造的 Host 头使得代理针对一个公共健康路由评估其身份验证决策，而 FastAPI 仍然执行受保护的管理处理程序——从而无需 API 密钥 即可处理请求。...

VulnCheck KEV: CVE-2026-84869

A condition in the ScreenConnect client may allow files to be transferred and executed through an active remote session without authorization or Host confirmation in certain circumstances. ScreenConnect servers are not impacted...

PT-2026-86974

Missing authentication for a critical function in ASUS Control Center Express Agent allows an unauthenticated nearby user to control the host via a direct connection to the agent when the host has an active login session. Refer to the ' Security Update for ASUS Control Center Express Agent '...

EulerOS 2.0 SP12 : spice-vdagent (EulerOS-SA-2026-3312)

According to the versions of the spice-vdagent packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A path traversal vulnerability was found in spice-vdagent. This flaw allows a malicious or compromised SPICE host to write arbitrary files ...

PT-2026-87183

New security alarm: Fortinet’s Agentless ZTNA has a certificate‐validation flaw CVE-2026-84393 letting attackers perform MITM on FortiOS and FortiProxy. Versions 7.6.1-7.6.6 are vulnerable; upgrade to 7.6.7 or later. This unauthenticated risk puts exposed portals at serious risk—patch now if you...

PT-2026-87187

Four critical CVEs all stemming from the same fundamental flaw: implicit trust in software components. The OX research team disclosed these vulnerabilities, which share a root cause of insufficient validation of third-party or AI-generated code, leading to sandbox escapes and arbitrary code...

EulerOS 2.0 SP12 : spice-vdagent (EulerOS-SA-2026-3387)

According to the versions of the spice-vdagent packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A path traversal vulnerability was found in spice-vdagent. This flaw allows a malicious or compromised SPICE host to write arbitrary files ...