CVE-2026-85492 All in One SEO <= 5.0.1.1 - Reflected DOM-Based Cross-Site Scripting via URL Pathname

The All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic Schema, Local SEO, Sitemap & SEO Insights plugin for WordPress is vulnerable to DOM-Based Cross-Site Scripting via URL Pathname in all versions up to, and including, 5.0.1.1 due to insufficient input sanitization and output...

EUVD-2026-91336

The All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic Schema, Local SEO, Sitemap & SEO Insights plugin for WordPress is vulnerable to DOM-Based Cross-Site Scripting via URL Pathname in all versions up to, and including, 5.0.1.1 due to insufficient input sanitization and output...

CVE-2026-85492

The All in One SEO plugin for WordPress is vulnerable to DOM-Based Cross-Site Scripting (XSS) in all versions up to and including 5.0.1.1 . The root cause is insufficient input sanitization and output escaping involving the URL Pathname . An unauthenticated attacker can inject arbitrary web scrip...

Invoke-DCSync

Invoke-DCSync Invoke-DCSync Reference: https://adsecurity.org/?p=1729 Reference: https://silentbreaksecurity.com/invoke-dcsync-because-we-all-wanted-it/ Goal: retrieve password hashes from all user accounts on a domain controller using the mimikatz DCSync function Warning：Only do this in a lab...

CVE-2026-19856: Undefined Security Weakness

The All in One SEO WordPress plugin before 5.0.2.1 does not correctly determine which shortcodes are present in content derived from user input before deciding which ones to strip, allowing unauthenticated users to execute arbitrary shortcodes registered on the site. On sites upgraded from older...

Linux Distros Unpatched Vulnerability : CVE-2026-94484

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Next.js is a React framework for building full-stack web applications. From 15.0.0 until 15.5.27 and 16.3.8, applications with a root-level catch-all page and...

PT-2026-104415

Name of the Vulnerable Software and Affected Versions All in One SEO versions prior to 5.0.2.1 Description Unauthenticated users can execute arbitrary shortcodes registered on the site because the plugin fails to correctly determine which shortcodes are present in content derived from user input...

PT-2026-104376

Name of the Vulnerable Software and Affected Versions Next.js versions 15.0.0 through 15.5.26 Next.js versions prior to 16.3.8 Description Applications using a root-level catch-all page and statically generated or Incremental Static Regeneration ISR routes use a shared response cache key that is...

PT-2026-104176

Name of the Vulnerable Software and Affected Versions All in One SEO versions prior to 5.0.1.2 Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform DOM-Based Cross-Site Scripting XSS via the URL pathname. This occurs when a user with the aiose...

L4J-Vuln-Patch

NOTICE This tool is no longer necessary mojang has released its own patch which should cover everyone who is affected https://www.minecraft.net/en-us/article/important-message--security-vulnerability-java-edition WARNING THIS EXPLOIT EFFECTS BOTH CLIENTS AND SERVERS There is currently a exploit...

CVE-2026-31431-copy-fail

Copy Fail Большинство LPE-эксплойтов для Linux требуют окна гонки или специфичного для ядра смещения. Copy Fail — это прямолинейный логический изъян — ему не нужно ни то, ни другое. Один и тот же Python-скрипт размером 732 байта даёт root-права на каждом дистрибутиве Linux, выпущенном с 2017 года...

CVE-2021-24307-all-in-one-seo-pack-admin-rce

Admin PHP unserialization RCE in All in one SEO pack CVE-2021-24307 Simple PoC of an admin authenticated RCE in AISEO = 4.1.0.1 provided as an example. Full write-up here: https://darkpills.com/php-unserialize-write-up-with-admin-rce-in-all-in-one-seo-pack-cve-2021-24307/ Usage: php exploit.php u...

All-ReverseIP-MultiThreading

All-ReverseIP-MultiThreading Python 2.7 Donation : BTC : 31mtLHqhaXXyCMnT2EU73U8fwYwigiEEU1 Perfect Money : U22270614...

CVE-2026-103248

n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a filter injection vulnerability in the Supabase node's Filters String mode that fails to escape field values. Attackers can inject filter expressions from untrusted input to read all table rows, update...

CVE-2026-103248 n8n before 1.123.80, 2.39.6, and 2.40.1 PostgREST Filter Injection via Supabase

n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a filter injection vulnerability in the Supabase node's Filters String mode that fails to escape field values. Attackers can inject filter expressions from untrusted input to read all table rows, update...

CVE-2026-103248 n8n before 1.123.80, 2.39.6, and 2.40.1 PostgREST Filter Injection via Supabase

n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a filter injection vulnerability in the Supabase node's Filters String mode that fails to escape field values. Attackers can inject filter expressions from untrusted input to read all table rows, update...

CVE-2026-103248

The n8n workflow automation tool is vulnerable to a filter injection vulnerability in the Supabase node 's Filters (String) mode. The flaw exists because the application fails to escape field values, allowing attackers to inject filter expressions from untrusted input. Impacted versions include t...

CVE-2026-103248 n8n before 1.123.80, 2.39.6, and 2.40.1 PostgREST Filter Injection via Supabase

n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a filter injection vulnerability in the Supabase node's Filters String mode that fails to escape field values. Attackers can inject filter expressions from untrusted input to read all table rows, update...

EUVD-2026-90642

n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a filter injection vulnerability in the Supabase node's Filters String mode that fails to escape field values. Attackers can inject filter expressions from untrusted input to read all table rows, update...

Rocky Linux 9.6 [CIQ] Security Update: nginx / nginx-all-modules / nginx-core / nginx-core-debuginfo / etc (ciqsa-2026_1476)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the CIQ ciqsa-20261476 advisory. This advisory aggregates security fixes for the nginx SRPM in CIQ LTS 9.6. It addresses 1 CVE: CVE-2026-42055. Tenable has extracted the preceding description blo...