capsule

Getting Started • Documentation • Issues • Contributing Capsule is a runtime for executing untrusted code in isolated environments. Each task runs inside its own WebAssembly sandbox, providing: Isolated execution : Each task runs isolated from your host system Resource limits : Set CPU, memory, a...

WPTimeCapsulePOC

Backup and Staging by WP Time Capsule 1.21.16 - Authentication Bypass Proof Of Concept An authentication bypass was recently discovered https://www.webarxsecurity.com/vulnerability-infinitewp-client-wp-time-capsule/ on WP Time Capsule 1.21.16 . This PoC prove how the issue works and how it can be...

CVE-2024-8856

CVE-2024-8856 This tool scans WordPress websites for vulnerabilities in the WP Time Capsule plugin related to CVE-2024-8856. It identifies plugin versions below "1.22.22" as vulnerable and logs results to "vuln.txt". Simple and efficient, it helps security researchers and admins detect and addres...

CVE-2024-8856

CVE-2024-8856: WordPress WP Time Capsule Plugin Arbitrary File Upload Vulnerability Overview CVE-2024-8856 is a security vulnerability found in the WP Time Capsule plugin for WordPress that allows unauthenticated users to upload arbitrary files to the server. This can lead to remote code executio...

Linux Distros Unpatched Vulnerability : CVE-2026-55367

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. Prior to commit 4212ce114506a073505fd389db16ad2ba4e582a0, a client could send an incomplete...

DEBIAN-CVE-2026-55367

h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. Prior to commit 4212ce114506a073505fd389db16ad2ba4e582a0, a client could send an incomplete CONNECT-UDP Capsule with an excessively large declared length, causing H2O to keep buffering received bytes without a per-Capsule limit...

CVE-2026-55367

h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. Prior to commit 4212ce114506a073505fd389db16ad2ba4e582a0, a client could send an incomplete CONNECT-UDP Capsule with an excessively large declared length, causing H2O to keep buffering received bytes without a per-Capsule limit...

CVE-2026-55367 h2o: heap exhaustion using capsules

h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. Prior to commit 4212ce114506a073505fd389db16ad2ba4e582a0, a client could send an incomplete CONNECT-UDP Capsule with an excessively large declared length, causing H2O to keep buffering received bytes without a per-Capsule limit...

CVE-2026-55367 h2o: heap exhaustion using capsules

h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. Prior to commit 4212ce114506a073505fd389db16ad2ba4e582a0, a client could send an incomplete CONNECT-UDP Capsule with an excessively large declared length, causing H2O to keep buffering received bytes without a per-Capsule limit...

CVE-2026-55367

The h2o HTTP server is vulnerable to heap exhaustion due to a lack of per-Capsule limits when handling CONNECT-UDP requests. A client can send an incomplete capsule with an excessively large declared length, forcing the server to buffer received bytes indefinitely. This can lead to memory exhaust...

NovaFabric: A Black-Box Recorder for AI Agents with Sealed, Replayable, Diffable and Auditable Runs

An AI agent run is no longer a function call. It is a cascade of prompts, model calls, tool invocations, file and network effects and sub-agents. When such a run misbehaves, or an auditor asks what happened, logs and traces answer poorly: they are mutable, partial and cannot be re-executed. This...

WordPress Backup and Staging by WP Time Capsule plugin < 1.22.28 - Subscriber+ Staging-to-Live Deployment vulnerability

Subscriber+ Staging-to-Live Deployment vulnerability discovered by Het Kalariya in WordPress Plugin Backup and Staging by WP Time Capsule versions 1.22.28...

CVE-2026-107237

The Backup and Staging by WP Time Capsule WordPress plugin before 1.22.28 does not perform capability or nonce checks on the handler that deploys a staging site to the live site, allowing any authenticated user with a Subscriber account on a WP Time Capsule staging site to overwrite the separate...

EUVD-2026-107060

The Backup and Staging by WP Time Capsule WordPress plugin before 1.22.28 does not perform capability or nonce checks on the handler that deploys a staging site to the live site, allowing any authenticated user with a Subscriber account on a WP Time Capsule staging site to overwrite the separate...

CVE-2026-107237 Backup and Staging by WP Time Capsule < 1.22.28 - Subscriber+ Staging-to-Live Deployment via wptc_copy_stage_to_live

The Backup and Staging by WP Time Capsule WordPress plugin before 1.22.28 does not perform capability or nonce checks on the handler that deploys a staging site to the live site, allowing any authenticated user with a Subscriber account on a WP Time Capsule staging site to overwrite the separate...

CVE-2026-107237

The Backup and Staging by WP Time Capsule WordPress plugin, in versions before 1.22.28 , is vulnerable to an authorization bypass. The plugin fails to perform necessary capability or nonce checks on the handler responsible for deploying a staging site to a live site (specifically via wptc_copy_st...

CVE-2026-107237 Backup and Staging by WP Time Capsule < 1.22.28 - Subscriber+ Staging-to-Live Deployment via wptc_copy_stage_to_live

The Backup and Staging by WP Time Capsule WordPress plugin before 1.22.28 does not perform capability or nonce checks on the handler that deploys a staging site to the live site, allowing any authenticated user with a Subscriber account on a WP Time Capsule staging site to overwrite the separate...

PT-2026-120455

The Backup and Staging by WP Time Capsule WordPress plugin before 1.22.28 does not perform capability or nonce checks on the handler that deploys a staging site to the live site, allowing any authenticated user with a Subscriber account on a WP Time Capsule staging site to overwrite the separate...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: efi/capsule-loader: fix incorrect sizeof in phys array reallocation The krealloc call for capinfo-phys in eficapsulesetupinfo uses sizeofphysaddrt instead of sizeofphysaddrt, which might be causing an undersized allocation. The...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerability has been resolved: efi/capsule-loader: corrected incorrect allocation size gcc-14 notes that the allocation using sizeofvoid on 32-bit architectures is insufficient for a 64-bit physaddrt: drivers/firmware/efi/capsule-loader.c: In the function...