CVE-2026-104073 NetBox 2.9.5 < 4.7.0 Session Hijacking via Custom Links

NetBox versions 2.9.5 before 4.7.0 contain a server-side template injection vulnerability that allows a low-privileged user with the "Can add custom links" permission to steal session cookies and API tokens of other users by exposing the raw Django HttpRequest object to the Jinja2 template contex...

CVE-2026-104073 NetBox 2.9.5 < 4.7.0 Session Hijacking via Custom Links

NetBox versions 2.9.5 before 4.7.0 contain a server-side template injection vulnerability that allows a low-privileged user with the "Can add custom links" permission to steal session cookies and API tokens of other users by exposing the raw Django HttpRequest object to the Jinja2 template contex...

CVE-2026-104073 NetBox 2.9.5 < 4.7.0 Session Hijacking via Custom Links

NetBox versions 2.9.5 before 4.7.0 contain a server-side template injection vulnerability that allows a low-privileged user with the "Can add custom links" permission to steal session cookies and API tokens of other users by exposing the raw Django HttpRequest object to the Jinja2 template contex...

Elasticsearch 8.19.23, 9.4.8, 9.5.5 Security Update (ESA-2026-195)

Memory Allocation with Excessive Size Value in Elasticsearch Leading to Denial of Service Memory Allocation with Excessive Size Value CWE-789 in Elasticsearch can lead to denial of service via Excessive Allocation CAPEC-130. An authenticated user with connector management privileges could cause t...

EUVD-2026-93611

Incorrect authorization in API in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to bypass web origin policy via a crafted HTML page. Chromium security severity: Low...

CVE-2026-106422

An incorrect authorization flaw exists in the API component of the Chromium browser , affecting Google Chrome versions prior to 155.0.8059.39 . A remote attacker can exploit this vulnerability by using a crafted HTML page to bypass web origin policy . The security severity is rated as Low by Chro...

CVE-2026-106422

Incorrect authorization in API in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to bypass web origin policy via a crafted HTML page. Chromium security severity: Low...

CVE-2026-106422

Incorrect authorization in API in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to bypass web origin policy via a crafted HTML page. Chromium security severity: Low...

CVE-2026-106420

Incorrect calculation in API in Google Chrome on on Windows prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted Chrome extension. Chromium security severity: Medium...

CVE-2026-106208

Missing authorization in API in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to leak sensitive information via a crafted Chrome extension. Chromium security severity: Medium...

CVE-2026-106420

Incorrect calculation in API in Google Chrome on on Windows prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted Chrome extension. Chromium security severity: Medium...

CVE-2026-106208

Missing authorization in API in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to leak sensitive information via a crafted Chrome extension. Chromium security severity: Medium...

CVE-2026-106208

Google Chrome versions prior to 155.0.8059.39 are vulnerable to a missing authorization flaw in an API. A remote attacker can leverage social engineering to leak sensitive information by utilizing a crafted Chrome extension . This issue was addressed in the stable channel update, and specific rem...

Elasticsearch 8.19.19, 9.3.8, 9.4.4 Security Update (ESA-2026-188)

Incorrect Authorization in Elasticsearch Leading to Unauthorized Data Stream Modification Incorrect Authorization CWE-863 in Elasticsearch can lead to unauthorized data stream modification via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. An authenticated user with sufficient...

AuroraStore

Aurora Store Aurora Store enables you to search and download apps from the official Google Play store. You can check app descriptions, screenshots, updates, reviews, and download the APK directly from Google Play to your device. To use Aurora Store, log in using Google Play account, when you firs...

CVE-2017-5487

PoC - CVE-2017-5487 - Enumeración de Usuarios de WordPress vía REST Configuración git clone https://github.com/ndr-repo/CVE-2017-5487.git powershell -noexit -ExecutionPolicy Bypass -File .ps1 Uso .\Enumerate-WordPressOrgMembersREST.ps1 Ruta Alternativa 1 para Evadir WAF...

CVE-2020-12593

CVE-2020-12593 CVE-2020-12593 POC Symantec EDR on-prem version prior to "4.5" is prone to an information disclosure vulnerability via the following URL : https://@IPEDR/atpapi/v2/policies/blacklist Reference...

POC_CVE-2026-46716

CVE-2026-46716 — Nezha Monitoring Cross-Tenant RCE via Cron API Authorization Bypass A lab environment for reproducing and detecting CVE-2026-46716 , a critical vulnerability in Nezha Monitoring where the POST /api/v1/cron endpoint lacks admin privilege checks, allowing RoleMember users to achiev...

WordPress Core <= 7.1.2 - Author+ Broken Access Control to Sticky Posts via REST API vulnerability

Author+ Broken Access Control to Sticky Posts via REST API vulnerability discovered by Anthropic in WordPress core versions = 7.1.2...

CVE-2026-105849

Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.90.0 and canary versions before 4.0.0-canary.34, users with ordinary read access to other authentication documents in a collection with useAPIKey enabled can obtain active API keys and exercise t...