aiosend: Deserialization of request body before signature verification (Pre-auth DoS) in webhook handler

SummaryWebhookHandler.feedupdate deserializes the entire request body before verifying the HMAC signature. This allows an unauthenticated attacker to force expensive parsing of arbitrary JSON payloads that will ultimately be rejected, leading to unnecessary CPU and memory consumption. SeverityHig...

PYSEC-2026-3626 aiosend: Deserialization of request body before signature verification (Pre-auth DoS) in webhook handler

Summary WebhookHandler.feedupdate deserializes the entire request body before verifying the HMAC signature. This allows an unauthenticated attacker to force expensive parsing of arbitrary JSON payloads that will ultimately be rejected, leading to unnecessary CPU and memory consumption. Severity...

Security Bulletin:Vulnerability in pyarrow affects IBM Netezza Appliance

Summary The pyarrow package is used by IBM Netezza Appliance. IBM Netezza Appliance has addressed the applicable CVEsCVE-2026-25087 Vulnerability Details CVEID:CVE-2026-25087 DESCRIPTION: Use After Free vulnerability in Apache Arrow C++. This issue affects Apache Arrow C++ from 15.0.0 through...

xss2shell

XSS2Shell — WordPress Pre-Auth XSS → RCE Chain PoC CVE-2026...

EUVD-2026-55105

Cleartext storage of sensitive information in Smart Switch prior to version 3.7.72.6 allows adjacent attackers to access sensitive data...

CVE-2026-18960

The Block User Account WordPress plugin before 2.0.1 does not enforce its account block on every authentication path, allowing a blocked user who holds an application password created before the block to retain their full role-level read and write access through the REST API...

CVE-2026-18934

The RSS Aggregator by Feedzy WordPress plugin (versions before 5.2.6 ) is vulnerable to an incorrect authorization issue. The plugin fails to verify if a requesting user owns or is permitted to modify a specific import job. Consequently, users with author-level access and above can permanently de...

Linux Distros Unpatched Vulnerability : CVE-2026-68160

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ceph: fix pre-auth out-of-bounds read on snaptrace in cephhandlecaps cephhandlecaps reads snaptracelen from the wire-format cephmdscaps header and uses it...

PT-2026-69560

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A pre-authentication out-of-bounds read exists in the ceph handle caps function. The issue occurs because the function reads the snap trace len variable from the ceph mds caps header and...

CVE-2026-68160: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ceph: fix pre-auth out-of-bounds read on snaptrace in cephhandlecaps cephhandlecaps reads snaptracelen from the wire-format cephmdscaps header and uses it unconditionally to build a fake end pointer snaptrace + snaptracelen that ...

Exploit for Argument Injection in Gnu Inetutils

CVE-2026-24061 — GNU Inetutils telnetd Auth Bypass → Root Shel...

Exploit for CVE-2026-64638

🔥 XSS2Shell — CVE-2026-64638 Scanner & PoC Toolkit Behav...

Exploit for CVE-2026-64638

CVE-2026-64638 — XSS2Shell Proof of Concept A proof-of-concep...

CVE-2026-16965

The Solace Extra WordPress plugin before 1.6.1 does not perform capability or nonce checks in one of its AJAX actions, allowing any authenticated user such as a subscriber and, via CSRF, any logged-in user to update post meta on arbitrary posts and to deactivate the site's active templates...

JLSEC-2026-1232

libexpat before 2.8.2 has an integer overflow in copyString...

Exploit for CVE-2026-64638

CVE-2026-64638 — XSS2Shell WordPress Pre-Auth Reflected XSS...

CVE-2026-71946

D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5C1202607071108 contain a command injection vulnerability in the /boafrm/formPingDiagnosticRun interface. A remote attacker can inject arbitrary malicious commands into the host field, resulting in command execution...

Exploit for CVE-2026-64638

CVE-2026-64638 Reflected XSS on Login Screen Leading to PH...

LiteLLM CVE-2026-42208 Blind SQLi Detect

Detects CVE-2026-42208 in BerriAI LiteLLM 1.81.16 = version 1.83.7: failed-auth logging passes the raw Authorization bearer into a virtual-key SQL lookup. Probes POST /v1/chat/completions with x'-prefixed pgsleep payloads never sk- and requires delay scaling plus a fast sk- control to rule out...

LiteLLM Pre-Auth Blind SQLi (CVE-2026-42208)

CVE-2026-42208 in BerriAI LiteLLM 1.81.16 = version 1.83.7: the proxy virtual-key lookup builds SQL with WHERE v.token = 'token' and interpolates the raw bearer from failed auth logging. Inject via Authorization on LLM routes must NOT start with sk-. Calibrates timing, confirms pgsleep scales, th...