1140678 matches found
EUVD-2026-74768
A Code Injection vulnerability in adk web in Google Cloud Agent Development Kit ADK for Python versions 2.0.0 through 2.6.0 on Python OSS, Cloud Run, and GKE environments where pytest is installed allows an unauthenticated remote attacker to execute arbitrary code using a crafted test session...
CVE-2026-79696 Remote Code Execution in Google ADK for Python via Incomplete Standard Library Denylist
A Code Injection vulnerability in adk web in Google Cloud Agent Development Kit ADK for Python versions 2.0.0 through 2.6.0 on Python OSS, Cloud Run, and GKE environments where pytest is installed allows an unauthenticated remote attacker to execute arbitrary code using a crafted test session...
CVE-2026-79696
Google Cloud Agent Development Kit (ADK) for Python (versions 2.0.0 through 2.6.0) contains a code injection vulnerability in the adk web component caused by an incomplete standard library denylist . In environments where pytest is installedāon Python (OSS), Cloud Run, and GKEāan unauthenticated ...
CVE-2026-22686
Enclave VM Sandbox Escape CTF Challenge Challenge: "Breaking the Walls" Difficulty: Hard Category: Source Code Review / Sandbox Escape Points: 500 Scenario You've discovered a mysterious sandboxed JavaScript execution environment...
Vulnerabilities in Microsoft Windows
Microsoft has identified 666 vulnerabilities in Windows. Malicious actors can exploit these vulnerabilities to carry out attacks that can cause various types of damage, as listed in the table below. Microsoft has identified 666 vulnerabilities in Windows. The 32 most severe vulnerabilities are...
ROOT-APP-NPM-GHSA-M5W8-4GQ2-6F8X GHSA-m5w8-4gq2-6f8x in vm2 - Patched by Root
Root has patched GHSA-m5w8-4gq2-6f8x in the vm2 package for Root:npm. Multiple fixed versions available...
ROOT-APP-NPM-CVE-2026-47698 CVE-2026-47698 in vm2 - Patched by Root
Root has patched CVE-2026-47698 in the vm2 package for Root:npm. Multiple fixed versions available...
React2Shell-CVE-2025-55182-Advanced-Scanner
CVE-2025-55182 é«ēŗ§ę«ęåØ ēØäŗę£ęµåå©ēØ Next.js åŗēØēØåŗäø CVE-2025-55182 ę¼ę“ēé«ēŗ§ęøéęµčÆå·„å · š ē®å½ ę¦čæ° åč½ å®č£ ä½æēØ ē¤ŗä¾ ē»čæęęÆ ęęÆē»č å č“£å£°ę č“”ē® č®øåÆčÆ š ę¦čæ° CVE-2025-55182 ęÆäøäøŖå½±å Next.js åŗēØēØåŗļ¼éčæ React ęå”åØē»ä»¶ļ¼ēäø„éčæēØ代ē ę§č”ļ¼RCEļ¼ę¼ę“ćčÆ„ę«ęåØęä¾äŗäøē§čŖåØåēę¹å¼ę„ę£ęµåå©ēØę¤ę¼ę“ļ¼å¹¶å å«å¤ē§ WAF ē»čæęęÆć CVSS čÆåļ¼9.8ļ¼äø„éļ¼ āØ åč½ å¤ē§č½½č·åä½ļ¼äøåēå©ēØęØ”å¼ WAF ē»čæęęÆļ¼8 ē§äøåēē»čæę¹ę³ čŖå®ä¹å½ä»¤ę§č”ļ¼ę§č”ä»»ęē³»ē»å½ä»¤...
CVE-2026-19802
The Checkout Custom Fields Builder for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.1.5. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated...
September Microsoft Patch Tuesday
September Microsoft Patch Tuesday. A total of 973 vulnerabilities were addressed - more than twice as many as in August. Seven products had 20 or more vulnerabilities fixed: Windows Biometric Service 64, Microsoft SQL Server 54, Windows DHCP Server 36, Microsoft Office Word 35, Windows NTFS 29,...
Multiple vulnerabilities in baserCMS plugin "BurgerEditor"
Overview baserCMS plugin "BurgerEditor" provided by D-ZERO CO.,LTD. contains multiple vulnerabilities listed below: Authorization Bypass Through User-Controlled Key CWE-639 - CVE-2026-84062 Unrestricted Upload of File with Dangerous Type CWE-434 - CVE-2026-84063 Kuniyoshi Noguchi @KuniNogu report...
EUVD-2026-74726
The Checkout Custom Fields Builder for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.1.5. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated...
CVE-2026-19802 Checkout Custom Fields Builder for WooCommerce <= 1.1.5 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation via 'plugin' Parameter
The Checkout Custom Fields Builder for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.1.5. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated...
CVE-2026-19802
The Checkout Custom Fields Builder for WooCommerce WordPress plugin (versions ā¤ 1.1.5) is vulnerable to authorization bypass , discovered by Nabil Irawan. The plugin fails to properly verify that a user is authorized before allowing plugin installation. Critically, the required nonce is emitted i...
CVE-2026-19802 Checkout Custom Fields Builder for WooCommerce <= 1.1.5 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation via 'plugin' Parameter
The Checkout Custom Fields Builder for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.1.5. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated...
CVE-2026-25253-research
CVE-2026-25253 Proof of Concept One-click RCE on OpenClaw via Cross-Site WebSocket Hijacking. DISCLAIMER: This code is provided for authorized security research and educational purposes only. Use of this code against systems without explicit written permission is illegal and unethical. The author...
Malicious code in external_deps_enjoyer (npm)
Source: amazon-inspector 8d4909b60251f0448ff7bc689262f363e3ec4c2cebf82abe3eb0c7f8769931a6 package.json declares dependencies and optionalDependencies whose specifiers point at non-registry, attacker-controlled or mutable sources rather than the npm registry. Listed sources include a Discord CDN...
CVE-2025-60787
CVE-2025-60787 - MotionEye RCE MotionEye v0.43.1b4 OS Command Injection A proof-of-concept exploit OS Command Injection for vulnerability in motionEye, a web frontend for the motion daemon. The vulnerability abuses the imagefilename configuration parameter, which is passed directly to the shell...
CVE-2026-85117 Contact Form 7 Captcha 0.1.7 - 0.1.8 - Unauthenticated Arbitrary Shortcode Execution via Form Field Repopulation
The Contact Form 7 Captcha WordPress plugin before 0.1.9 runs the shortcode parser over the whole rendered Contact Form 7 form, including the values a visitor submitted, allowing unauthenticated users to execute arbitrary shortcodes registered on the site...
n8n-RCE-CVE-2025-68613
n8n CVE-2025-68613 Overview This repository contains an educational security research project focused on CVE-2025-68613 , a vulnerability affecting specific versions of n8n related to unsafe workflow expression evaluation. The project was tested only in a controlled local lab environment. About...