CVE-2026-32560 WordPress MagicAI for WordPress - AI Text, Image, Chat, Code, and Voice Generator plugin <= 1.4 - Local File Inclusion vulnerability

Subscriber Local File Inclusion in MagicAI for WordPress - AI Text, Image, Chat, Code, and Voice Generator = 1.4 versions...

CVE-2026-32560

MagicAI for WordPress (AI Text, Image, Chat, Code, and Voice Generator) plugin versions ≤ 1.4 are affected by a Local File Inclusion (LFI) vulnerability accessible to authenticated users with the Subscriber role. The vulnerability is rated CVSS 8.8 (HIGH) by Patchstack, with a network attack vect...

CVE-2026-32559 WordPress UltimateAI plugin <= 3.1.0 - Arbitrary File Upload vulnerability

Subscriber Arbitrary File Upload in UltimateAI = 3.1.0 versions...

CVE-2026-27364

Broken Access Control vulnerability in the WordPress Style Kits plugin (AnalogWP) versions ≤ 2.6.5 . A Subscriber -level authenticated user can exploit insufficient access controls, resulting in a high impact on integrity (CVSS 3.1: 6.5 MEDIUM, vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N). No conf...

CVE-2026-27364 WordPress Style Kits plugin <= 2.6.5 - Broken Access Control vulnerability

Subscriber Broken Access Control in Style Kits = 2.6.5 versions...

CVE-2026-45404

OpenTelemetry-Go versions 0.11.0 through 1.44.0 contain an unsynchronized extraBaggageItems map in the OpenTracing bridge's bridgeSpan. Because Go maps are not safe for concurrent read/write access, concurrent SetBaggageItem and correlation.MapFromContext calls on the same hooked bridgeSpan can t...

whatfiles

whatfiles Whatfiles is a Linux utility that logs what files another program reads/writes/creates/deletes on your system. It traces any new processes and threads that are created by the targeted process as well. Rationale: I've long been frustrated at the lack of a simple utility to see which file...

CVE-2026-75542

Incorrect Authorization vulnerability in the OAuth token endpoint in hexpm hexpm allows an API key holding the repositories permission to read another organization's private packages. When an API key is exchanged for a token through the OAuth clientcredentials grant, validatescopesagainstkey/2 in...

CVE-2026-5006

A vulnerability was identified in HashiCorp Vault and Vault Enterprise “Vault” such that an authenticated attacker may manipulate an identity value referenced by a templated policy path to gain unintended access to Vault paths. An attacker who can control the referenced identity value may include...

CVE-2026-55468

Wagtail is an open source content management system built on Django. Prior to versions 7.0.9, 7.3.4, 7.4.3, and 8.0rc2 on their respective release lines, the internal Pages admin API returns page fields declared in apifields without sufficient access control, allowing a user with Wagtail admin...

CVE-2023-27163

Proof Of Concept von SSRF auf Request-Baskets CVE-2023-27163 Dieses Repository enthält einen Proof-of-Concept PoC für CVE-2023-27163, eine Server-Side Request Forgery SSRF Schwachstelle, die in request-baskets bis Version 1.2.1 entdeckt wurde. Diese Schwachstelle ermöglicht es Angreifern, auf...

process_overwriting

Process Overwriting Process Overwriting is a PE injection technique, closely related to Process Hollowing and Module Overloading. With its help, you can replace the main executable not a DLL of the target process. It works only for a newly created process - injection to existing processes is not...

cypheroth

Cypheroth Automated, extensible toolset that runs cypher queries against Bloodhound's Neo4j backend and saves output to spreadsheets. Description This is a bash script that automates running cypher queries against Bloodhound data stored in a Neo4j database. I found myself re-running the same...

CVE-2025-22828

CVE-2025-22828 📜 Beschreibung Apache CloudStack 4.16.0 und spätere Versionen weisen ein Problem mit einer fehlerhaften Zugriffskontrolle auf, das es Benutzern mit Kenntnis der Ressourcen-UUIDs ermöglicht, Kommentare Annotationen zu Ressourcen zu lesen oder hinzuzufügen, auf die sie nicht zugreife...

EUVD-2026-39432

3X-UI Vulnerable to Authenticated Arbitrary File Write via Database Import and Xray Log Path Manipulation...

WordPress-RCE-CVE-2019-8942

WordPress Crop Image RCE — CVE-2019-8942 / CVE-2019-8943 प्रमाणित WordPress क्रॉप-इमेज शोषण श्रृंखला का Python3 कार्यान्वयन। यह रिपॉजिटरी दो स्वतंत्र कार्यप्रवाहों के आसपास आयोजित की गई है: एक मैन्युअल OSCP-शैली स्क्रिप्ट और एक पूरी तरह से स्वचालित स्क्रिप्ट जिसमें एक एकीकृत रिवर्स-शेल हैंडलर है।...

zeroheight-account-verification-bypass-CVE-2025-65925

CVE-2025-65925 — Fehlerhafte Zugriffskontrolle im Kontoerstellungsprozess von Zeroheight Offenlegungsdatum: 2025-06-11 Datum der Herstellerkorrektur laut Hersteller: 2025-06-13 Validierungsdatum des Forschers: 2025-06-26 Entdeckt von: Sneden Rebello Zusammenfassung Ein Legacy-API-Pfad zur...

CVE-2025-39247

CVE-2025-39247 الهدف: HikCentral Professional HCMP، خادم VMS مركزي CVE: CVE-2025-39247 — ثغرة في التحكم بالوصول CVSS 3.1: 8.6 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N المتأثر: V2.3.1 – V2.6.2 و V3.0.0 المُعالَج: V2.6.3 / V3.0.1 / حزمة الإصلاح CVE-2025-39247 تاريخ الإفصاح: 2025-08-28 تاريخ التحليل:...

CVE-2026-55468 Wagtail: Improper restriction handling on Pages admin API

Wagtail is an open source content management system built on Django. Prior to versions 7.0.9, 7.3.4, 7.4.3, and 8.0rc2 on their respective release lines, the internal Pages admin API returns page fields declared in apifields without sufficient access control, allowing a user with Wagtail admin...

CVE-2026-55468

CVE-2026-55468 affects the internal Pages admin API in Wagtail , an open-source CMS built on Django. The API returns page fields declared in api_fields without sufficient access control , allowing any user with Wagtail admin access to retrieve restricted draft and live page content , including ba...