xss2shell

XSS2Shell — WordPress Pre-Auth XSS → RCE Chain PoC CVE-2026...

EUVD-2026-55041

The File Manager WordPress plugin before 6.9.1 does not properly authorise its file management commands, allowing any authenticated user, such as a subscriber, to read and delete arbitrary files under the WordPress installation directory, which could lead to the disclosure of the site's...

CVE-2026-19383

A security vulnerability has been detected in saithink/saigroup SaiAdmin up to 5.0.1. This impacts the function shellexec of the file /app/saipackage/install/upload of the component Plugin Upload Endpoint. The manipulation leads to unrestricted upload. Remote exploitation of the attack is possibl...

PT-2026-69384

Name of the Vulnerable Software and Affected Versions Samsung Contacts versions prior to SMR Aug-2026 Release 1 Description Improper input validation allows local attackers to delete files using the privileges of Samsung Contacts. Recommendations Update Samsung Contacts to SMR Aug-2026 Release 1...

CVE-2026-19376

Uasoft Badaso 3.0.0-alpha is affected. The vulnerability targets the ApiRequest::class in the file src/Routes/api.php of the File API, causing permission issues. It can be exploited remotely, and the exploit has been disclosed publicly. The project was informed via an issue report but has not res...

CVE-2026-71988 MSI Radix AXE6600 v781521 Command Injection via portFw function

MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the portFw function that allows remote attackers to execute arbitrary commands on the affected device. Attackers can exploit this vulnerability through the alg function to execute malicious commands an...

CVE-2026-54338

JupyterHub is software that allows users to create a multi-user server for Jupyter notebooks. Prior to 5.5.0, invalid input to form-based login authenticators can place an unbounded attacker-controlled username in failed-login logs, allowing an unauthenticated attacker to consume logging and...

EUVD-2026-54610

Consul Community Edition and Consul Enterprise 1.18.21 through 2.0.2 are vulnerable to a partial arbitrary file read when configured to use the Vault Connect CA provider with JWT or AppRole authentication. A privileged attacker with operator:write permission may direct Consul to read and forward...

CVE-2026-44964

Summary: CVE-2026-44964 affects the Datadog Android app, where OnCallNotificationActivity is declared with android:exported="true" and no permission guard. This allows any co-installed app to launch the activity with attacker-controlled Intent extras (on_call_page_content, page_id, on_call_page_i...

CVE-2026-62996

Smarty is vulnerable in versions 5.0.0 through 5.8.3 due to improper restriction of stream: resource-name handling, allowing a php://filter-wrapped resource to read arbitrary local files accessible to the PHP process. An attacker who can influence a template’s resource reference could disclose se...

EUVD-2026-54437

Tobit Laboratories AG TeamDavid's Webbox 's sending email, fax, SMS, etc. functionality accepts a @@INCLUDE command, which can be set to network locations using UNC paths e.g., “\Server\Share”. The server processes these paths without validation, resulting in outbound connection attempts to...

CVE-2026-54204

Tobit Laboratories AG TeamDavid's Webbox 's search functionality accepts a “pathnameroot” parameter, which can be set to network locations using UNC paths e.g., “\Server\Share”. The server processes these paths without validation, resulting in outbound connection attempts to attacker-controlled...

CVE-2026-54204

CVE-2026-54204 affects Tobit Laboratories AG TeamDavid’s Webbox. The search function accepts a pathnameroot parameter that can be set to UNC network locations; the server processes these values without validation, causing outbound connections to attacker-controlled SMB endpoints. This enables una...

CVE-2026-15239 Simple CAPTCHA with Cloudflare Turnstile < 1.42.0 - Unauthenticated Turnstile Protection Bypass via Reusable Forminator Cache Key

The Simple CAPTCHA with Cloudflare Turnstile WordPress plugin before 1.42.0 does not bind its Turnstile validation cache to the single-use challenge token in its Forminator integration, instead keying it to an attacker-controlled, reusable request value, allowing unauthenticated attackers to solv...

EUVD-2026-54401

The Simple CAPTCHA with Cloudflare Turnstile WordPress plugin before 1.42.0 does not bind its Turnstile validation cache to the single-use challenge token in its Forminator integration, instead keying it to an attacker-controlled, reusable request value, allowing unauthenticated attackers to solv...

OESA-2026-3279 python-aiohttp security update

Async http client/server framework asyncio. Security Fixes: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.2, the WebSocket client accepts and decompresses frames with the RSV1 bit set even when the permessage-deflate extension was not negotiated,...

OESA-2026-3233 tomcat security update

Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process. Security Fixes: Uncontrolled Resource Consumpti...

CVE-2026-62857

Fedify is a TypeScript library for building federated server apps powered by ActivityPub. From version 1.2.0 through the affected 1.9, 1.10, 2.0, 2.1, 2.2, and 2.3 maintenance lines, getNodeInfo follows an attacker-controlled links.href value from /.well-known/nodeinfo without scheme, redirect, o...

CVE-2026-71488

league/commonmark is a PHP library for parsing and rendering CommonMark Markdown. From 0.6.0 until 2.9.0, specially crafted Markdown lines can cause the parser to have quadratic time complexity when converting, because several parsing paths repeatedly rescan growing portions of a line to translat...

CVE-2026-48083

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.2, the /api/log endpoint accepts unauthenticated POST requests, applies no schema validation to the message body, writes attacker-controlled content directly into the...