EUVD-2026-93665

Hydra instantiate target blacklist bypasses permit code execution...

CVE-2021-21551

CVE-2021-21551 CVE-2021-21551에 대한 개념 증명 익스플로잇입니다. 이 취약점은 사용자 제공 주소가 memmove 호출의 인수로 전달되어 임의 읽기/쓰기를 가능하게 하는 것ioctls 0x9B0C1EC4 및 0x9B0C1EC8과, MmMapIoSpace 호출의 물리적 주소 매개변수가 또 다른 임의 읽기/쓰기를 제공하는 것ioctls 0x9B0C1F40 및 0x9B0C1F44에서 발생합니다...

CVE-2024-43160

Wordpress BerqWP = 1.7.6 - 인증되지 않은 임의 파일 업로드 CVE-2024-43160 WordPress용 BerqWP – 자동 올인원 PageSpeed 최적화 플러그인Core Web Vitals, Cache, CDN, Images, CSS, JavaScript은 /api/storewebp.php 파일에서 파일 유형 검증이 누락되어 1.7.6 이하의 모든 버전에서 임의 파일 업로드에 취약합니다. 이를 통해 인증되지 않은 공격자가 영향을 받는 사이트의 서버에 임의의 파일을 업로드하여 원격 코드 실행이 가능해질...

WordPress Bricksforge plugin <= 3.1.8.9 - Unauthenticated Arbitrary File Upload via 'temporaryFileUploads' Parameter vulnerability

Unauthenticated Arbitrary File Upload via 'temporaryFileUploads' Parameter vulnerability discovered by d.v4ns3c in WordPress Plugin Bricksforge versions = 3.1.8.9...

CVE-2024-8425

WordPress WooCommerce Ultimate Gift Card = 2.6.0 - 인증되지 않은 사용자의 임의 파일 업로드 CVE-2024-8425 WordPress용 WooCommerce Ultimate Gift Card 플러그인은 'mwbwgmpreviewmail' 및 'mwbwgmwoocommerceaddcartitemdata' 함수에서 파일 유형 검증이 충분하지 않아 2.6.0 버전을 포함한 모든 버전에서 임의 파일 업로드에 취약합니다. 이를 통해 인증되지 않은 공격자가 영향을 받는 사이트의 서버에 임의의 파일...

CVE-2026-41958

A flaw was found in VisiData. This path traversal vulnerability allows a remote attacker to perform arbitrary file writes on the host system. By convincing a user to process a specially crafted URL pointing to a malicious ZIP archive, an attacker can extract files outside the intended destination...

CVE-2026-42532

A flaw was found in VisiData. A path traversal vulnerability in the EmailSheet attachment extraction feature allows an attacker to write arbitrary files by convincing a user to process a specially crafted email .eml file. This flaw enables an attacker to create or overwrite critical files outside...

LocalStranger

LocalStranger LocalStrangerは、脆弱なカーネルモードドライバが実際にどれほど危険であるかを実証するために設計されたProof of Concept プロジェクトです。 WinNotify.sys（私がそう呼んでいる、msft.sys）は、呼び出し元の検証が完全に欠如しているため、任意のカーネルプリミティブを露出させる非常に危険な脆弱ドライバです。 予想外なことに、このドライバはMicrosoft Windows Hardware Compatibility Publisherパートナーシッププログラムの下で署名されており、今日に至るまで、 Microsoft...

CVE-2026-106442

A flaw was found in hydra-core. The instantiate mechanism does not properly validate callable targets against its blocklist, allowing execution wrappers and deferred calls to bypass authorization checks. An attacker who convinces an application or user to process untrusted configuration files can...

CVE-2026-106440

A flaw was found in hydra-optuna-sweeper. This vulnerability allows an attacker who controls sweep configuration settings or command-line overrides to achieve arbitrary code execution. The component dynamically resolves and invokes callable objects specified in user-controlled configuration paths...

CVE-2026-93520

A flaw was found in xorg-x11-server. In the X Keyboard Extension XKB, key name memory is allocated with an insufficient buffer size compared to the maximum supported range. An authenticated local client can exploit this flaw by sending requests that modify the keycode range, triggering a heap-bas...

CVE-2026-93518

A flaw was found in xorg-x11-server. Due to an integer truncation issue during memory allocation calculations within the X Keyboard Extension XKB, the server allocates an undersized buffer when resizing key types. An authenticated local client can exploit this vulnerability by sending specially...

CVE-2026-93517

A flaw was found in xorg-x11-server. The GLX OpenGL Extension to the X Window System interface fails to verify that incoming data sizes do not exceed allocated buffer limits when handling large rendering requests. An authenticated local client can exploit this vulnerability by sending a specially...

WordPress Super Forms plugin <= 6.3.316 - Unauthenticated Arbitrary Directory Deletion via 'data[...][files][][subdir]' Parameter vulnerability

Unauthenticated Arbitrary Directory Deletion via 'data...filessubdir' Parameter vulnerability discovered by d.v4ns3c in WordPress Plugin Super Forms versions = 6.3.316...

WordPress Uncanny Automator – AI + Automation for WordPress | AI Agent, AI Page Builder, Free AI Usage Included plugin <= 7.6.1.1 - Authenticated (Subscriber+) PHP Object Injection to Arbitrary File Deletion vulnerability

Authenticated Subscriber+ PHP Object Injection to Arbitrary File Deletion vulnerability discovered by 0xd4rk5id3 in WordPress Plugin Uncanny Automator versions = 7.6.1.1...

WordPress Super Forms plugin <= 6.3.316 - Authenticated (Subscriber+) Arbitrary File Upload via 'extensions' Form Element Attribute vulnerability

Authenticated Subscriber+ Arbitrary File Upload via 'extensions' Form Element Attribute vulnerability discovered by d.v4ns3c in WordPress Plugin Super Forms versions = 6.3.316...

CVE-2026-76501

A vulnerability in the Segment Routing over IPv6 SRv6 Operation, Administration, and Maintenance OAM feature of Cisco NX-OS Software, known as NGOAM, could allow an unauthenticated, remote attacker to execute arbitrary code with root privileges or cause a denial of service DoS on an affected...

CVE-2026-76485

A vulnerability in the VXLAN Operation, Administration, and Maintenance OAM feature of Cisco NX-OS Software, known as NGOAM, could allow an unauthenticated, remote attacker to execute arbitrary code with root privileges or cause a Denial-of-Service DoS on an affected device. This vulnerability is...

CVE-2026-76471

A vulnerability in the NX-API feature of Cisco NX-OS Software could allow an unauthenticated, remote attacker to execute arbitrary code with root privileges or cause a denial of service DoS condition on an affected device. The vulnerability is due to insufficient input validation of data that is...

CVE-2026-76454

A vulnerability in the Cisco Smart Licensing Utility API of Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem SSM On-Prem, could allow an unauthenticated, remote attacker to write arbitrary files to the system or cause a DoS condition on an affected application. This...