EUVD-2026-89405

In Anjvision YSSD-RTMP-H5 firmware version 3.3.2.4, an empty-body POST to /setUserConfig, dispatched through the web server's SOAP-RPC handler, silently downgrades the administrator password to the default value and corrupts the in-memory authentication state until the device reloads. The handler...

CVE-2026-100296 Improper Check for Unusual or Exceptional Conditions in Anjvision YSSD-RTMP-H5

In Anjvision YSSD-RTMP-H5 firmware version 3.3.2.4, an empty-body POST to /setUserConfig, dispatched through the web server's SOAP-RPC handler, silently downgrades the administrator password to the default value and corrupts the in-memory authentication state until the device reloads. The handler...

CVE-2026-100296 Improper Check for Unusual or Exceptional Conditions in Anjvision YSSD-RTMP-H5

In Anjvision YSSD-RTMP-H5 firmware version 3.3.2.4, an empty-body POST to /setUserConfig, dispatched through the web server's SOAP-RPC handler, silently downgrades the administrator password to the default value and corrupts the in-memory authentication state until the device reloads. The handler...

CVE-2023-34212

CVE-2023-34212: Java Deserialization via JNDI Components in Apache NiFi The JndiJmsConnectionFactoryProvider Controller Service along with the ConsumeJMS and PublishJMS Processors, in Apache NiFi 1.8.0 through 1.21.0 allow an authenticated and authorized user to configure URL and library properti...

CVE-2026-8937 Missing Authorization in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.0 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user to read private child issue contents, including titles and descriptions, from projects...

CVE-2026-8937

GitLab CE/EE versions 19.0 before 19.2.7 , 19.3 before 19.3.3 , and 19.4 before 19.4.1 are affected by a Missing Authorization vulnerability. Under specific conditions, an authenticated user could read private child issue contents, such as titles and descriptions, from projects they are not autho...

CVE-2026-10518 Incorrect Authorization in GitLab

GitLab has remediated an issue in GitLab EE affecting all versions from 17.9 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user with guest-level permissions to read private security policy content they were not authoriz...

CVE-2012-2982

CVE-2012-2982 Description file/show.cgi in Webmin 1.590 and earlier allows remote authenticated users to execute arbitrary commands via an invalid character in a pathname, as demonstrated by a | pipe character. Installation 1. git clone https://github.com/CpyRe/CVE-2012-2982.git 2. pip3 install -...

CVE-2026-101169

Affected versions of Octopus Server are vulnerable to insecure deserialization of specifically crafted JSON content. An authenticated user with permissions to edit an Environment or Project can exploit this flaw to execute arbitrary code within the Octopus Server process. No specific patch versio...

CVE-2026-60004-PoC

CVE-2026-60004: Gitea Diffpatch API Remote Code Execution !WARNING This repository is intended exclusively for authorized security research and controlled laboratory testing. Do not run the proof of concept against systems you do not own or have explicit permission to assess. Overview...

CVE-2021-43408

CVE-2021-43408: WordPress Plugin Duplicate Post version 1.1.9 - SQL Injection I. Overview 1. What is WordPress WordPress is an open-source CMS Content Management System software, a content management system. Instead of using HTML encoding language, WP is written in the PHP programming language...

CVE-2023-40028

CVE-2023-40028 Proof of Concept This repository contains a proof of concept POC for CVE-2023-40028, demonstrating a vulnerability in the Ghost content management system where authenticated users can upload symlinks, leading to arbitrary file read vulnerabilities. Disclaimer This POC is provided f...

CVE-2021-21551

CVE-2021-21551 Dell Driver EoP CVE-2021-21551 Description Dell dbutil23.sys driver contains an insufficient access control vulnerability which may lead to escalation of privileges, denial of service, or information disclosure. Local authenticated user access is required. This exploit was tested o...

CVE-2022-1329-WordPress-Elementor-3.6.0-3.6.1-3.6.2-Remote-Code-Execution-Exploit

WordPress Plugin - Elementor 3.6.0 3.6.1 3.6.2 Remote Code Execution Google Dork: none Date: April 16 2022 Exploit Author: AkuCyberSec https://github.com/AkuCyberSec Vendor Homepage: https://elementor.com/ Software Link: https://wordpress.org/plugins/elementor/advanced/ scroll down to select the...

EUVD-2026-88257

Path traversal in the Btrfs storage driver unpackVolume in Canonical LXD on Linux allows an authenticated user with instance creation privileges to delete or replace arbitrary files and directories on the host filesystem as root via a crafted subvolumes.path entry in backup/optimizedheader.yaml...

CVE-2026-9809

CVE-2026-9809 CVE-2026-9809 is a Stored Cross-Site Scripting Stored XSS vulnerability affecting Mautic 7 versions 7.0.0 through 7.1.1. The flaw exists in the Projects component, where project names are displayed as tags and hover popovers on administrative pages such as campaigns, emails, and for...

EUVD-2026-88224

Improper parameter handling in NeuVector allows any authenticated user who holds the namespaced Runtime Policies write permission or anyone with access to NeuVector’s internal gRPC certificate key pair the ability to inject OS commands in the privileged enforcer container, which can lead to the...

CVE-2026-19759

An Incorrect Authorization vulnerability in the task configuration in Google Cloud Application Integration versions prior to 2026-06-17 on Google Cloud Platform allows an authenticated Google Cloud user to execute arbitrary internal RPCs from inside Google's production network under a privileged...

CVE-2026-81867 Deserialization of Untrusted Data in Application Integration allows Remote Code Execution

A Deserialization of Untrusted Data vulnerability in the JavaScript Task in Google Cloud Application Integration versions prior to 2026-06-28 on Google Cloud Platform allows an authenticated user with standard permissions to run arbitrary code on the shared production servers using a specially...

CVE-2023-33829

CVE-2023-33829: Stored-XSS-on-SCM-Manager-1.60 Summary A vulnerability is discovered in the SCM Manager 1.2 = 1.60 version that allows an attackers previously authenticated with write permissions execute javascript code in specific fields. This Proof of Concept is maded in a local environment...