CVE-2026-76053

TranslatePress – Translate Multilingual sites with AI Translation (WordPress plugin) is vulnerable to Stored Cross-Site Scripting in all versions up to and including 3.3.3 . The root cause is insufficient input sanitization and output escaping in the plugin's HTML parser: WordPress's comment KSES...

EUVD-2026-67397

The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Noise-Key Injection into HTML Parser in all versions up to, and including, 3.3.3 due to insufficient input sanitization and output escaping. This mak...

solidity_CVE-2021-42574-POC

solidityCVE-2021-42574-POC 2023年1月31日，Altin tin-z，github.com/tin-z PoC 针对solidity和solc编译器的CVE-2021-42574的PoC。 安装 root@kitploit: solc 并选择 0.8.17 版本 https://github.com/crytic/solc-select foundry https://github.com/foundry-rs/foundry 部署合约 root@kitploit: SOLV=0.8.17 foldert=testopen mkdir $foldert &&...

w3-total-cache-cve-2013-2010

w3-total-cache-cve-2013-2010 w3 total cache cve 2013-2010에서 원격 코드 실행 사용법: python3 w3tcrceexploit.py -u http://example.com -p "system'whoami';" 출력: Targeting: http://example.com + Payload sent successfully. + Check the target for execution of the payload. import requests import argparse def...

CVE-2025-29775

Ambiente di Laboratorio SAMLStorm CVE-2025-29775 Questo è un ambiente di laboratorio per dimostrare la vulnerabilità SAMLStorm CVE-2025-29775 che colpisce la libreria xml-crypto e le implementazioni SAML in Node.js. Nota: non si tratta di un vero sfruttamento della vulnerabilità, ma di una...

Wordpress_cve-2019-9787_defense

Wordpresscve-2019-9787defense Avviso Questo è un progetto di Sijia Zhanghttps://github.com/sijiahi e Bowen Zhouhttps://github.com/KonjakZhou Prerequisiti: 1 Riproduzione dell'attacco: root@kitploit: - Configura e installa Wordpress5.0 su http://localhost/wp-admin/; - Accedi a Wordpress come...

EUVD-2026-63579

The github-issue-bot templates in appwrite/templates verify the GitHub webhook signature with an inverted condition. verifyWebhook in node/github-issue-bot/src/github.js and in node-typescript/github-issue-bot/src/github.ts returns "typeof signature !== 'string' || await verify...", so when the...

CVE-2026-72861 Appwrite Templates github-issue-bot Skips Webhook Signature Verification When the X-Hub-Signature-256 Header Is Absent

The github-issue-bot templates in appwrite/templates verify the GitHub webhook signature with an inverted condition. verifyWebhook in node/github-issue-bot/src/github.js and in node-typescript/github-issue-bot/src/github.ts returns "typeof signature !== 'string' || await verify...", so when the...

CVE-2026-72861

In Appwrite templates' github-issue-bot, verifyWebhook uses an inverted condition (typeof signature !== 'string' || (await verify(...))) that short-circuits to success when the X-Hub-Signature-256 header is absent, skipping HMAC verification. Unauthenticated callers can then post arbitrary commen...

PT-2026-79116

Name of the Vulnerable Software and Affected Versions appwrite/templates affected versions not specified Description The github-issue-bot templates contain a logic error in the GitHub webhook signature verification process. The verifyWebhook function in node/github-issue-bot/src/github.js and...

EUVD-2026-61062

authentik is an open-source identity provider. Prior to 2026.2.6 and 2026.5.5, an inbound SAML Source configured with the non-default USERNAMELINK or EMAILLINK user-matching mode interprets an XML comment in a NameID differently from the identity provider's signed assertion. An attacker with an...

CVE-2026-58438 Cross-repository IDOR in issue-dependency removal lets an attacker tamper with and comment on private repos they cannot access

Cross-repository IDOR in issue-dependency removal lets an attacker tamper with and comment on private repos they cannot access...

EUVD-2026-56853

Cap v0.3.1 contains a broken access control vulnerability in the POST /api/video/comment endpoint that allows authenticated users to post comments on any private video without permission by supplying an arbitrary videoId in the request body. Attackers can inject comments into private video...

CVE-2026-69113 Cap v0.3.1 Broken Access Control via video comment endpoint

Cap v0.3.1 contains a broken access control vulnerability in the POST /api/video/comment endpoint that allows authenticated users to post comments on any private video without permission by supplying an arbitrary videoId in the request body. Attackers can inject comments into private video...

SUSE CVE-2026-58438

Cross-repository IDOR in issue-dependency removal lets an attacker tamper with and comment on private repos they cannot access...

PT-2026-70823

Cap v0.3.1 contains a broken access control vulnerability in the POST /api/video/comment endpoint that allows authenticated users to post comments on any private video without permission by supplying an arbitrary videoId in the request body. Attackers can inject comments into private video...

CVE-2026-65636 YAML injection via unescaped newlines in ymlr document comments

Improper Neutralization of CRLF Sequences vulnerability in ufirstgroup ymlr Elixir.Ymlr module allows attackers to inject arbitrary content into generated YAML documents through document comments. Ymlr.document!/2 interpolates each caller-supplied comment string into the output behind a single...

CVE-2026-65636

Improper Neutralization of CRLF Sequences vulnerability in ufirstgroup ymlr Elixir.Ymlr module allows attackers to inject arbitrary content into generated YAML documents through document comments. Ymlr.document!/2 interpolates each caller-supplied comment string into the output behind a single...

PT-2026-66757

Improper Neutralization of CRLF Sequences vulnerability in ufirstgroup ymlr Elixir.Ymlr module allows attackers to inject arbitrary content into generated YAML documents through document comments. Ymlr.document!/2 interpolates each caller-supplied comment string into the output behind a single...

oapi-codegen: OpenAPI Server Description Escapes Generated Go Comment and Injects Executable Code

Summary The vulnerability in oapi-codegen seems to be similar with CVE-2026-22785, which is a generated-code injection issue where untrusted OpenAPI summary text is embedded into generated TypeScript MCP server source without proper escaping. oapi-codegen has a similar vulnerability in its server...