GO-2026-6604 vulnerabilities

Vulnerabilities for packages: ingress-nginx-controller, aactl, kubernetes, k8s-device-plugin, flux, karpenter, spire-server, cert-manager, external-dns, falco-no-driver, loki...

CVE-2026-56857 vulnerabilities

Vulnerabilities for packages: ingress-nginx-controller, aactl, kubernetes, k8s-device-plugin, flux, karpenter, spire-server, cert-manager, external-dns, falco-no-driver, loki...

react2shellpoc

Questo repository contiene una prova di concetto che dimostra come una specifica classe di vulnerabilità dei React Server Component si comporta all'interno di un ambiente di formazione controllato e legale. Manuale ┌──kali㉿kali-/Documents/tools/2025-55182 └─$ python exploit.py -h /\ /\ /\ /\ /\ /...

CVE-2026-104021

The Fastcache by Host.it plugin for WordPress is vulnerable to Code Injection in all versions up to, and including, 1.7.4 via the fastcachesettingscachecookieexclude parameter. This is due to the plugin registering the cachecookieexclude setting via registersetting without a sanitizecallback, whi...

EUVD-2026-96068

The Fastcache by Host.it plugin for WordPress is vulnerable to Code Injection in all versions up to, and including, 1.7.4 via the fastcachesettingscachecookieexclude parameter. This is due to the plugin registering the cachecookieexclude setting via registersetting without a sanitizecallback, whi...

Security Bulletin: Due to the use of WebSphere Application Server Liberty, IBM Tivoli Application Dependency Discovery Manager is affected by multiple vulnerabilities

Summary IBM Tivoli Application Dependency Discovery Manager bundles WebSphere Application Server Liberty, vulnerabilities has been remediated in an e-fix CVE-2026-65432, CVE-2026-66142, CVE-2026-66143, CVE-2026-66144, CVE-2026-14532, CVE-2026-14909, CVE-2026-79715,CVE-2026-77816, CVE-2026-11713,...

fix-react2shell-next

fix-react2shell-next Un comando per risolvere CVE-2025-66478 React 2 Shell RCE nella tua app Next.js / React RSC. npx fix-react2shell-next Aggiornamenti di versione deterministici secondo gli advisory ufficiali. Cosa fa 1. Scansiona ricorsivamente tutti i file package.json gestisce monorepo 2...

tivoli-poc

tivoli-poc Código PoC de CVE-2017-1635 CVEID: CVE-2017-1635 Puntuación base CVSS: 8 Productos y versiones afectados: componente KDH de IBM Tivoli Monitoring Basic Services KGL,KAX para las versiones 6.2.2.0 a 6.2.2.9 Existe una vulnerabilidad en el servidor web interno proporcionado por los...

darknet-mcp-server

English | 简体中文 | 繁體中文 | 한국어 | Deutsch | Español | Français | Italiano | Dansk | 日本語 | Polski | Русский | Bosanski | العربية | Norsk | Português Brasil | ไทย | Türkçe | Українська | বাংলা | Ελληνικά | Tiếng Việt | हिन्दी Dark web e threat intelligence per agenti AI. HIBP, ThreatFox, tracciamento...

SUSE CVE-2026-78663

The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream refunding data for any sent-but-unread portion of the stream, and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configur...

CVE-2026-108161: Improper Neutralization of Special Elements used in an OS Command

FusionPBX through 5.6.5 contains an OS command injection vulnerability in callrecordings::download that allows unauthenticated attackers to execute commands by placing calls with malicious caller ID values. When the recordname filename template is enabled, attackers can embed shell metacharacters...

PT-2026-109673

Name of the Vulnerable Software and Affected Versions GenOffice versions prior to 0.11.506 Description An incorrect permissions issue exists in the HTTP MCP server file store. Local unprivileged users can access the world-readable genoffice-mcp-http directory located within the system temporary...

PT-2026-109674

Name of the Vulnerable Software and Affected Versions zotero-mcp versions 0.10.0 through 0.14.1 Description A server-side request forgery SSRF issue exists where the fetch embedded metadata function fetches URLs without validating the destination. Attackers can use prompt injection to force the...

PT-2026-109932

Name of the Vulnerable Software and Affected Versions JeecgBoot versions prior to 3.9.6 Description An authorization flaw exists where the permission check in the queryById function is commented out in the source code. This allows any authenticated user to access the '/airag/app/queryById' endpoi...

Linux Distros Unpatched Vulnerability : CVE-2026-106428

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An out-of-bounds read in SCRAM authentication response parsing in the MongoDB C Driver can read one byte beyond a fixed-size buffer when processing a malformed...

Linux Distros Unpatched Vulnerability : CVE-2026-107817

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the mysqljson plugin...

CVE-2026-27350: Server-Side Request Forgery (SSRF)

Server-Side Request Forgery SSRF vulnerability in Builderius.io Builderius allows Server Side Request Forgery. This issue affects Builderius: from 1.4 through 1.4-beta...

PT-2026-109675

Name of the Vulnerable Software and Affected Versions argocd-mcp Argo CD MCP Server versions prior to 0.9.1 Description A path traversal issue exists in the delete application tool. This occurs when the applicationName variable is not properly validated, allowing MCP clients or prompt-injected...

CVE-2026-108671: Missing Authorization

JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any authenticated user to read MCP server configurations because the queryById permission check is commented out. Attackers can obtain record ids from the unguarded /airag/app/queryById endpoint and retrieve MCP...

PT-2026-114460

Уязвимость пользовательского интерфейса Nginx UI сервера nginx связана с неверным управлением генерацией кода. Эксплуатация уязвимости может позволить нарушителю, действующему удалённо, выполнить произвольный код...