CVE-2026-37068

CVE-2026-37068 Arbitrary file write in /vfm-admin/index.php?section=translations&action=update in Veno File Manager Project 4.4.9 allows an authenticated user with the role of super administrator to overwrite any php file in the application via a specially crafted POST request to the affected...

CVE-2026-47670

CVE-2026-47670 Authenticated Remote Code Execution via loadReader functionName code injection in DbGate DbGate is an open-source, cross-platform database management tool designed for developers and database administrators who need to work with multiple database systems simultaneously. It provides...

CVE-2026-5415

CVE-2026-5415 CVE-2026-5415 WP Captcha PRO Authenticated Authentication Bypass Exploit...

motioneye-authenticated-RCE

MotionEye/MotionEyeOS Authenticated RCE A Python 3 script that uploads a tasks.pickle file that enables RCE in MotionEye. You need administrator credentials, so it should not be that big of a deal. Unfortunately, MotionEye/MotionEyeOS can frequently be found running with default credentials...

CVE-2026-38526

CVE-2026-38526 - Krayin CRM RCE Description PoC script for critical vulnerability in Krayin CRM v2.2.x allowing authenticated RCE via unrestricted file upload. Usage Web shell python3 exploit.py -u http://target.com -e [email protected] -p password123 Reverse shell python3 exploit.py -u...

CVE-2025-49844

🚨 CVE-2025-49844 — “RediShell” Critical Remote Code Execution in the World's Fastest In-Memory Store Redis Lua scripting just became the perfect post-auth landing zone. Authenticated attacker → crafted Lua script → escape sandbox → full RCE on host ⚠️ Overview CVE-2025-49844 "RediShell " is a...

CVE-2022-2185

CVE-2022-2185 wo ee cve-2022-2185 gitlab authenticated rce read: https://starlabs.sg/blog/2022/07-gitlab-project-import-rce-analysis-cve-2022-2185/ how to use First spawn a gitlab instance. Log in, create a group and project with a unique name. Create an access token. Edit these lines in main.go...

swoosh has email-derived URL path injection in Microsoft Graph endpoint

Summary Swoosh.Adapters.MsGraph builds its Microsoft Graph API request URL by interpolating the sender's email address directly into the URL path /users/from/sendMail without percent-encoding or validation. In applications that derive the from address from untrusted or user-influenced input a...

EUVD-2026-103142

Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.10, recipe utility endpoints retrieve same-Space Recipe objects without invoking the private-recipe owner or sharing permission when an authenticated member of a shared Space supplies...

CVE-2026-111793

Openwave Webtop Media Transcoder does not enforce administrator-defined file type restrictions to restrict the file-types to be converted. This may allow an authenticated user to process and convert unintended document types if bypassing the Webmail experience...

EUVD-2026-103137

IBM i 7.3, 7.4, 7.5, and 7.6 is could allow a remote authenticated attacker to bypass security restrictions due to improper enforcement of the ChrootDirectory configuration directive...

CVE-2026-17491

IBM i versions 7.3, 7.4, 7.5, and 7.6 (product 5733-SC1) are vulnerable to an improper privilege management flaw (CWE-269) in OpenSSH . The root cause is the improper enforcement of the ChrootDirectory configuration directive, which could allow a remote authenticated attacker to bypass security r...

EUVD-2026-103135

Openwave Webtop Media Transcoder does not enforce administrator-defined file type restrictions to restrict the file-types to be converted. This may allow an authenticated user to process and convert unintended document types if bypassing the Webmail experience...

CVE-2026-111793

The Openwave Webtop Media Transcoder fails to enforce administrator-defined file type restrictions during the conversion process. This security weakness, categorized under CWE-669 , may allow an authenticated user to process and convert unintended document types by bypassing the Webmail experienc...

CVE-2026-111709

WhaTicket Community through commit cf04795 contains an insecure direct object reference vulnerability that allows authenticated agents to access other agents' tickets because ShowTicketService performs no ownership or queue checks. Attackers can supply another agent's ticket id to GET...

CVE-2026-111715

Arkon through 0.9.2 contains a missing authorization vulnerability in GET /api/wiki/graph that lets authenticated employees read other departments' wiki metadata by supplying a foreign slug. Attackers with only wiki:read:owndept permission can query getneighborhood without scope checks to obtain...

CVE-2026-111703

yshop-crm through 2.1.3 contains an insecure direct object reference vulnerability that allows authenticated sales users to access other users' customer records by supplying arbitrary ids. Attackers can enumerate ids against the get, update, delete and do-open endpoints to read contact details,...

CVE-2026-111668

AIHelms through 0.1.25 contains a missing authorization vulnerability in apps/api/v1/efficiency.py that allows authenticated low-privileged users to bypass efficiency:read and efficiency:write permission checks. Attackers can query routes like /cost/detail, /top-users and /budget to read...

CVE-2026-111654

FastBee through 2.1.0 contains an insecure direct object reference vulnerability that allows authenticated low-privilege users to access other users' device groups because GroupController queries lack owner checks. Attackers, including self-registered users, can supply sequential group IDs to rea...

CVE-2026-111648

BuildAdmin through 2.3.9 contains an insecure direct object reference vulnerability that allows authenticated backend administrators to modify other administrators' profiles via the id parameter. Attackers holding the routine/adminInfo/edit permission can overwrite avatar, nickname, email, mobile...