CVE-2026-82215

The Payment Gateway PayPay for WooCommerce WordPress plugin (versions 0.5 through 0.9.3) fails to verify the authenticity of incoming payment notification webhooks before acting on them. An unauthenticated attacker who knows a store's merchant identifier can mark arbitrary orders as paid , or can...

YellowKey-Bitlocker

🔑 YellowKey-Bitlocker - Gestiona la seguridad de BitLocker en sistemas Windows 🛡️ ¿Qué es YellowKey-Bitlocker? YellowKey-Bitlocker es un programa para Windows 10 y Windows 11. Ayuda a los usuarios a proteger las unidades frente a la vulnerabilidad CVE-2026-45585. Este problema afecta a la forma en...

Presentations

Presentations 2025 CodeBlue 2025 - 18th to 19th November 2025 AI Accelerated Exploiting: Compromising MTE Enabled Pixel from DSP Coprocessor by PAN Zhenpeng & Billy JHENG Bing Jhong Dancing with Exynos Coprocessor: Pwning Samsung for fun and “profit” by Muhammad Ramdhan, PAN Zhenpeng & Billy JHEN...

MsSettingsDelegateExecute

MsSettingsDelegateExecute Bypass UAC on Windows 10/11 x64 using ms-settings DelegateExecute registry key. This visual studio project will compile a static x64 binary to test this issue. License These files are available under the 3-clause BSD license...

rewrite-cve-2026-22732

rewrite-cve-2026-22732 OpenRewrite recipe that detects code susceptible to CVE-2026-22732, a Spring Security defect where setting Content-Length through one of three response methods bypasses Spring Security's OnCommittedResponseWrapper. Because the wrapper never sees the header,...

CVE-2026-87569

A flaw was found in Google Chrome. Missing authorization in the Views component allows a remote attacker, leveraging social engineering, to bypass system access restrictions. This can be achieved by enticing a user to open a specially crafted HTML page...

CVE-2026-87548

A flaw was found in the Installer component of Google Chrome. A remote attacker could exploit this vulnerability by enticing a user to visit a specially crafted HTML page. This improper state validation could allow the attacker to bypass system access restrictions, potentially leading to...

CVE-2026-9198

🚨 CVE-2026-9198 IBM Langflow OSS Unauthenticated RCE via Auto-Login Bypass 📋 Overview CVE-2026-9198 is a critical unauthenticated Remote Code Execution RCE vulnerability in IBM Langflow OSS. This exploit chains two vulnerabilities: CVE-2026-9103 : Auto-login bypass that grants superuser JWT token...

cve-2026-34472-auth-bypass-zte-h188a-router

CVE-2026-34472 Technical breakdown of CVE-2026-34472, an auth bypass via leaked credentials affecting ZTE ZXHN H188A V6 firmware. Summary In the tested H188A V6 builds, unauthenticated requests to the root path can reach pre-login wizard handlers and disclose sensitive data including: WLAN PSKs...

Automated-scanner-CVE-2026-41940

CPANEL CVE EXPLOIT Inglés | فارسی Persa root@kitploit: ██████╗██████╗ █████╗ ███╗ ██╗███████╗██╗ ██╔════╝██╔══██╗██╔══██╗████╗ ██║██╔════╝██║ ██║ ██████╔╝███████║██╔██╗ ██║█████╗ ██║ ██║ ██╔═══╝ ██╔══██║██║╚██╗██║██╔══╝ ██║ ╚██████╗██║ ██║ ██║██║ ╚████║███████╗███████╗ ╚═════╝╚═╝ ╚═╝ ╚═╝╚═╝...

By-Poloss..-..CVE-2026-10580

CVE-2026-10580: Hippoo Mobile App for WooCommerce = 1.9.4 - Omisión de Autenticación No Autenticada para Toma de Control de Administrador No autenticado → Toma de control de cuenta de administrador mediante error de confusión lógica 📌 Resumen...

cve-2024-4577-phpcgi_rce_reproduction

CVE-2024-4577 - Inyección de Argumentos CGI en PHP en Windows "WorstFit" Resumen CVE-2024-4577 es una vulnerabilidad crítica de ejecución remota de código en la implementación CGI de PHP en Windows. Evita el parche para el CVE-2012-1823 original explotando la conversión de páginas de código...

cve-2025-53779-kerberos_bypass_reproduction

CVE-2025-53779: Bypass de autenticación de Kerberos en Microsoft Windows Puntuación CVSS: 9.8 Crítica Estado: Explotación activa en el mundo real Divulgación: Microsoft Patch Tuesday de agosto de 2025 día cero Resumen CVE-2025-53779 es una vulnerabilidad crítica de bypass de autenticación en la...

CVE-2026-52614

CVE-2026-52614 - RuoYi v4.8.3 Bypass de filterKeyword para Inyección SQL Chino | Inglés Se requiere autorización / Solo pruebas autorizadas Este repositorio está destinado únicamente a la investigación de seguridad y las pruebas autorizadas. No lo utilice contra sistemas sin permiso explícito. Es...

CVE-2026-87447

A flaw was found in the Network component of Google Chrome. This vulnerability, stemming from incorrect authorization, could allow a remote attacker to bypass the web origin policy. By leveraging social engineering and a specially crafted Chrome extension, an attacker could potentially gain...

CVE-2026-8181

CVE-2026-8181 - Burst Statistics Authentication Bypass CVSS 9.8 Critical — Bypass de autenticación para la toma de control de la cuenta de administrador Descripción CVE-2026-8181 es una vulnerabilidad de Authentication Bypass en el plugin de WordPress Burst Statistics versiones 3.4.0 a 3.4.1.1...

CVE-2026-0257-PoC

CVE-2026-0257 — Omisión de Autenticación de GlobalProtect en PAN-OS Prueba de Concepto de Detección Remota Solo detección. Sin explotación. No se envían credenciales. No se falsifican cookies. Resumen CVE-2026-0257 es una vulnerabilidad de omisión de autenticación CWE-565 — Dependencia de cookies...

CVE-2026-80469

An attacker may achieve arbitrary code execution on a target system by uploading a malicious device driver package, bypassing driver verification mechanisms, and triggering the execution of attacker-controlled code. User interaction is required...

CVE-2026-47839 Federated OIDC Users Can Bypass externalGroupsWhitelist to Gain uaa.admin

A vulnerability allows users authenticating through a federated OIDC provider to obtain the uaa.admin scope despite operators restricting that provider through externalGroupsWhitelist configuration. The issue occurs specifically when an OIDC identity provider uses groupMappingMode: ASSCOPES with ...

CVE-2026-89175

Smart Video Intercom System developed by Kingdom Communication Associated has a Client-Side Authentication vulnerability. Unauthenticated remote attackers can bypass authentication to access specific pages and obtain partial system configuration values...