WordPress WP Booking System plugin < 2.1.0.1 - Unauthenticated Stored XSS vulnerability

Unauthenticated Stored XSS vulnerability discovered by Eric Buntain in WordPress Plugin WP Booking System versions 2.1.0.1...

FLock.io Unveils Edge Decision Model, Built on Qwen, for Enhanced Data Privacy

Built on Qwen3.5-2B, the System One model executes sub-31ms local inference, allowing enterprises to run automated classifications quickly, at low cost and completely offline without transmitting sensitive data to third-party cloud servers...

CVE-2024-31317-Deployer

CVE-2024-31317 Deployer 🔒 Security Research Statement This project is intended solely for security research and educational purposes. Using this tool for unauthorized testing is illegal. The author is not responsible for any misuse or damage. 📋 Overview CVE-2024-31317 is a critical security...

CVE-2026-36214

CVE-2026-36214 - Stored Cross-Site Scripting XSS in osTicket via Vulnerable Bootstrap Tooltip Component Description Enhancesoft osTicket versions from 1.10 up to 1.17.7 and from 1.18.0 up to 1.18.3 ship with the known-vulnerable Bootstrap Tooltip 3.3.4 component CVE-2019-8331, which introduces a...

kernel: xfrm: input: hold netns during deferred transport reinjection

A flaw was found in the Linux kernel's xfrm input component. The transport-mode reinjection process, which handles network packet re-injection, stores a network namespace pointer that must remain valid until a deferred callback completes. However, a missing reference count for the network namespa...

CVE-2026-54161

CVE-2026-54161 PoC Summary upsmon interpolates the server-supplied, attacker-controllableups.alarm value, unsanitized, into a shell command that it runs via system. When a monitored device reports an ALARM state and the operator has configured NOTIFYCMD with EXEC on the ALARM event, an ups.alarm...

pulse-meter

Pulse Meter This is a work in progress for parsing the System Snapshot from an Ivanti Connect Secure applicance to identify possible IOCs related to CVE-2023-46805, CVE-2024-21887 and CVE-2025-0282. Caveat : False positives are possible so it's best to check manually to verify any results. Note...

CVE-2026-73790

A vulnerability in HPE NonStop iTP WebServer can cause memory corruption and system shutdown...

kernel: drm/dp/mst: fix buffer overflows in sideband chunk accumulation

A flaw was found in the Linux kernel's DisplayPort DP Multi-Stream Transport MST subsystem. This vulnerability involves multiple buffer overflows within the drmdpsidebandappendpayload function when handling data from connected devices. A physically connected, malicious DP MST device can exploit...

kernel: drm/amdgpu/vce: fix integer overflow in image size

A flaw was found in the drm/amdgpu/vce component of the Linux kernel. Malicious VCE Video Codec Engine command streams with oversized dimensions can cause a 32-bit integer overflow. This overflow bypasses validation, allowing the GPU firmware to perform out-of-bound memory access. This could lead...

CVE-2019-11707-from-an-IonMonkey-type-confusion-to-SYSTEM-

CVE-2019-11707 WINDOWS EXPLOIT POC Full research here: https://blog.grunt.ar/bin-exploitation/binary-gecko-academy/cve-2019-11707-firefox-ionmonkey-to-system-en/ Video POC https://youtu.be/5Q5SkR7qslg...

CVE-2026-73790

A memory corruption vulnerability exists in HPE NonStop iTP WebServer (specifically versions T8996 - T8996L01^AGY and earlier and T8997 - T8997L01^AGY and earlier ) which can lead to a system shutdown . The underlying cause is identified as Improper Input Validation (CWE-20). HPE has released fix...

EUVD-2026-100941

A vulnerability in HPE NonStop iTP WebServer can cause memory corruption and system shutdown...

CVE-2026-73790 HPE NonStop iTP WebServer - Memory corruption vulnerability

A vulnerability in HPE NonStop iTP WebServer can cause memory corruption and system shutdown...

BIT-GITEA-2026-86684 Gitea push mirror local path check uses the repository owner

The Gitea push mirror API checked whether the repository owner, instead of the requesting user, may use local file system paths. On instances with security IMPORTLOCALPATHS = true, a repository administrator who is not allowed to import local paths could add a push mirror to a local path on the...

CVE-2026-105106 Koha authenticated OS command injection in tools/scheduler.pl via the jobid parameter when deleting a scheduled task

Koha is vulnerable to OS command injection in the Task Scheduler deletion path. The tools/scheduler.pl handler accepts the jobid request parameter for op=cud-delete and passes it to C4::Scheduler::removeatjob without validating it. Schedule::At::remove substitutes the supplied job ID into an atrm...

CVE-2026-107126

The WP Booking System WordPress plugin before 2.1.0.1 does not sanitise and escape a client-controllable request value before storing it and later outputting it in an administration screen, allowing unauthenticated attackers to perform Stored Cross-Site Scripting attacks that execute in the sessi...

CVE-2023-27350

CVE-2023-27350 This vulnerability allows remote attackers to bypass authentication on affected installations of PaperCut NG 22.0.5 Build 63914. Authentication is not required to exploit this vulnerability. The specific flaw exists within the SetupCompleted class. The issue results from improper...

domestic-system

The Domestic System A beautiful, terminal-based Ethereum wallet and smart contract browser built for sovereignty, security, and style. ━━━━━━━━━━━━━━━━━━━━ domestic system ━━━━━━━━━━━━━━━━━━━━ Overview The Domestic System is a terminal user interface TUI designed for browsing Ethereum EVM account...

CVE-2025-14221

Description 1. CVE-2025-14221 2. Discoverer: Fatma Trabelsi 3. Vendor of Product: SourceCodester 4. Affected Product: Online Banking System 1.0 POC A Stored Cross-Site Scripting XSS vulnerability exists in the User Profile Update functionality of the application. The application fails to properly...