CVE-2026-89258

Hugo (static site generator) versions after v0.123.0 and before v0.165.0 are vulnerable to a symlink confinement bypass via direct resource lookups such as resources.Get and os.ReadFile. Symlinks in parent directories were not dropped during these lookups, allowing an attacker who can place a sym...

CVE-2026-89258 Hugo before v0.165.0 Symlink Confinement Bypass via resources.Get

Hugo is a static site generator. In versions after v0.123.0 and before v0.165.0, symlinks in parent directories were not dropped during direct resource lookups, allowing path confinement to be bypassed. An attacker who can place — or who convinces a site author to place — a symlink inside a mount...

EUVD-2026-76070

Hugo is a static site generator. In versions after v0.123.0 and before v0.165.0, symlinks in parent directories were not dropped during direct resource lookups, allowing path confinement to be bypassed. An attacker who can place — or who convinces a site author to place — a symlink inside a mount...

CVE-2026-89245

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request forgery (CSRF) vulnerability in playlistRemove.php . The root cause is that CSRF protection checks can be bypassed, allowing an attacker to craft a malicious form that submits a POST request to the e...

EUVD-2026-76050

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains an open redirect in objects/playlistSort.php. Because the endpoint is not a .json.php script, AVideo's automatic CSRF guard autoCSRFGuard/forbidIfIsUntrustedRequest does not run, and when the request includes the sort paramet...

CVE-2026-86809

The Persian Elementor WordPress plugin, versions 2.7.10 through before 2.8.2 , fails to verify that the payment authority returned in its ZarinPal payment callback belongs to the specific transaction being completed. This allows unauthenticated attackers to complete a pending order by replaying a...

CVE-2026-86809 Persian Elementor < 2.8.2 - Unauthenticated ZarinPal Payment Callback Authority Bypass

The Persian Elementor WordPress plugin from 2.7.10 before 2.8.2 does not verify that the payment authority returned to its ZarinPal payment callback belongs to the transaction being completed, allowing unauthenticated attackers to complete a pending order using a valid payment authority obtained...

CVE-2026-86809 Persian Elementor < 2.8.2 - Unauthenticated ZarinPal Payment Callback Authority Bypass

The Persian Elementor WordPress plugin from 2.7.10 before 2.8.2 does not verify that the payment authority returned to its ZarinPal payment callback belongs to the transaction being completed, allowing unauthenticated attackers to complete a pending order using a valid payment authority obtained...

CVE-2026-82215 WC PayPay Gateway 0.5 - 0.9.3 - Unauthenticated Payment Bypass via Unverified Webhook

The Payment Gateway PayPay for WooCommerce WordPress plugin from 0.5 to 0.9.3 does not verify the authenticity of the payment notifications it receives before acting on them, allowing unauthenticated attackers who know the store's merchant identifier to mark arbitrary orders as paid, or to cancel...

CVE-2026-82215

The Payment Gateway PayPay for WooCommerce WordPress plugin (versions 0.5 through 0.9.3) fails to verify the authenticity of incoming payment notification webhooks before acting on them. An unauthenticated attacker who knows a store's merchant identifier can mark arbitrary orders as paid , or can...

YellowKey-Bitlocker

🔑 YellowKey-Bitlocker - Gestiona la seguridad de BitLocker en sistemas Windows 🛡️ ¿Qué es YellowKey-Bitlocker? YellowKey-Bitlocker es un programa para Windows 10 y Windows 11. Ayuda a los usuarios a proteger las unidades frente a la vulnerabilidad CVE-2026-45585. Este problema afecta a la forma en...

Presentations

Presentations 2025 CodeBlue 2025 - 18th to 19th November 2025 AI Accelerated Exploiting: Compromising MTE Enabled Pixel from DSP Coprocessor by PAN Zhenpeng & Billy JHENG Bing Jhong Dancing with Exynos Coprocessor: Pwning Samsung for fun and “profit” by Muhammad Ramdhan, PAN Zhenpeng & Billy JHEN...

MsSettingsDelegateExecute

MsSettingsDelegateExecute Bypass UAC on Windows 10/11 x64 using ms-settings DelegateExecute registry key. This visual studio project will compile a static x64 binary to test this issue. License These files are available under the 3-clause BSD license...

rewrite-cve-2026-22732

rewrite-cve-2026-22732 OpenRewrite recipe that detects code susceptible to CVE-2026-22732, a Spring Security defect where setting Content-Length through one of three response methods bypasses Spring Security's OnCommittedResponseWrapper. Because the wrapper never sees the header,...

CVE-2026-87569

A flaw was found in Google Chrome. Missing authorization in the Views component allows a remote attacker, leveraging social engineering, to bypass system access restrictions. This can be achieved by enticing a user to open a specially crafted HTML page...

CVE-2026-87548

A flaw was found in the Installer component of Google Chrome. A remote attacker could exploit this vulnerability by enticing a user to visit a specially crafted HTML page. This improper state validation could allow the attacker to bypass system access restrictions, potentially leading to...

CVE-2026-9198

🚨 CVE-2026-9198 IBM Langflow OSS Unauthenticated RCE via Auto-Login Bypass 📋 Overview CVE-2026-9198 is a critical unauthenticated Remote Code Execution RCE vulnerability in IBM Langflow OSS. This exploit chains two vulnerabilities: CVE-2026-9103 : Auto-login bypass that grants superuser JWT token...

cve-2026-34472-auth-bypass-zte-h188a-router

CVE-2026-34472 Technical breakdown of CVE-2026-34472, an auth bypass via leaked credentials affecting ZTE ZXHN H188A V6 firmware. Summary In the tested H188A V6 builds, unauthenticated requests to the root path can reach pre-login wizard handlers and disclose sensitive data including: WLAN PSKs...

Automated-scanner-CVE-2026-41940

CPANEL CVE EXPLOIT English | فارسی Persian root@kitploit: ██████╗██████╗ █████╗ ███╗ ██╗███████╗██╗ ██╔════╝██╔══██╗██╔══██╗████╗ ██║██╔════╝██║ ██║ ██████╔╝███████║██╔██╗ ██║█████╗ ██║ ██║ ██╔═══╝ ██╔══██║██║╚██╗██║██╔══╝ ██║ ╚██████╗██║ ██║ ██║██║ ╚████║███████╗███████╗ ╚═════╝╚═╝ ╚═╝ ╚═╝╚═╝...

By-Poloss..-..CVE-2026-10580

CVE-2026-10580: Hippoo Mobile App for WooCommerce = 1.9.4 - Omisión de Autenticación No Autenticada para Toma de Control de Administrador No autenticado → Toma de control de cuenta de administrador mediante error de confusión lógica 📌 Resumen...