scour

Scour - AWS Detection Framework This tool is used to emulate attack patterns inside of the AWS Controlplane. Each attack is tagged with a specific UA for the blue team to signal off of. Status This is still an active work in progress. Lots of Bugs Not ready for production Where to file issues :...

Ametys CMS Information Disclosure

Ametys CMS before 4.5.0 allows a remote unauthenticated attacker to read documents such as plugins/web/service/search/auto-completion/domain/en.xml and similar pathnames for other languages via the auto-completion plugin, which contain all characters typed by all users, including the content of...

cryptr

cryptr A simple shell utility for encrypting and decrypting files using OpenSSL. Installation git clone https://github.com/nodesocket/cryptr.git ln -s "$PWD"/cryptr/cryptr.bash /usr/local/bin/cryptr Requirements shred if optionally deleting original file. Bash tab completion Add...

grype

Grype A vulnerability scanner for container images and filesystems. Features Scan container images , filesystems , and SBOMs for known vulnerabilities see the docs for a full list of supported scan targets Supports major OS package ecosystems Alpine, Debian, Ubuntu, RHEL, Oracle Linux, Amazon...

quiver

Quiver : A Meta-Tool for Kali Linux Quiver is an organized namespace of shell functions that pre-fill commands in your terminal so that you can ditch your reliance on notes, copying, pasting, editing, copying and pasting again. Quiver helps you remember how to use every tool in your arsenal and...

CVE-2026-121993

wePOS Point Of Sale for WooCommerce before 2.0.3 contains a missing authorization vulnerability in the wepos/v1/payment/process REST route that allows authenticated vendor-level users to mark arbitrary orders as paid and completed by supplying another order's ID. Attackers with only the...

CVE-2026-121993 wePOS before 2.0.3 Missing Authorization via payment/process Endpoint

wePOS Point Of Sale for WooCommerce before 2.0.3 contains a missing authorization vulnerability in the wepos/v1/payment/process REST route that allows authenticated vendor-level users to mark arbitrary orders as paid and completed by supplying another order's ID. Attackers with only the...

CVE-2026-121993

The wePOS (Point Of Sale for WooCommerce) plugin versions before 2.0.3 is susceptible to a missing authorization vulnerability in the wepos/v1/payment/process REST route. This flaw allows authenticated vendor-level users, such as Dokan vendor staff with the publish_shop_orders capability, to mani...

CVE-2026-121993 wePOS before 2.0.3 Missing Authorization via payment/process Endpoint

wePOS Point Of Sale for WooCommerce before 2.0.3 contains a missing authorization vulnerability in the wepos/v1/payment/process REST route that allows authenticated vendor-level users to mark arbitrary orders as paid and completed by supplying another order's ID. Attackers with only the...

EUVD-2026-116911

wePOS Point Of Sale for WooCommerce before 2.0.3 contains a missing authorization vulnerability in the wepos/v1/payment/process REST route that allows authenticated vendor-level users to mark arbitrary orders as paid and completed by supplying another order's ID. Attackers with only the...

CVE-2026-99229

A flaw was found in the Linux kernel's iouring subsystem. A local attacker can cause a Denial of Service DoS by triggering an infinite loop when waiting for completion queue events. If entries on the overflow list cannot be flushed into the completion queue, the waiting kernel task continuously...

PT-2026-136969

wePOS Point Of Sale for WooCommerce before 2.0.3 contains a missing authorization vulnerability in the wepos/v1/payment/process REST route that allows authenticated vendor-level users to mark arbitrary orders as paid and completed by supplying another order's ID. Attackers with only the publish...

CVE-2026-121993: wedevs wePOS – Point Of Sale (POS) for WooCommerce & Dokan: wePOS (Point Of Sale for WooCommerce) before 2.0.3 contains a missing authorization vulnerability in the…

wePOS Point Of Sale for WooCommerce before 2.0.3 contains a missing authorization vulnerability in the wepos/v1/payment/process REST route that allows authenticated vendor-level users to mark arbitrary orders as paid and completed by supplying another order's ID. Attackers with only the...

CVE-2026-106004

The DT LMS WordPress plugin through 1.2 does not perform capability or nonce checks on one of its AJAX actions, allowing unauthenticated attackers to revoke any learner's course and class completion status...

CVE-2026-106004 DT LMS <= 1.2 - Unauthenticated Arbitrary Course Completion Revocation

The DT LMS WordPress plugin through 1.2 does not perform capability or nonce checks on one of its AJAX actions, allowing unauthenticated attackers to revoke any learner's course and class completion status...

WordPress DT LMS plugin <= 1.2 - Unauthenticated Arbitrary Course Completion Revocation vulnerability

Unauthenticated Arbitrary Course Completion Revocation vulnerability discovered by Enrico Marcolini, Claudio Marchesini, Dottor Marc in WordPress Plugin DT LMS – elearning, WordPress LMS Plugin versions = 1.2...

EUVD-2026-115680

The DT LMS WordPress plugin through 1.2 does not perform capability or nonce checks on one of its AJAX actions, allowing unauthenticated attackers to revoke any learner's course and class completion status...

CVE-2026-106004

The DT LMS WordPress plugin (versions

CVE-2026-99227

In the Linux kernel, the following vulnerability has been resolved: iouring/waitid: prevent cancel reference wrap iowaitid packs the cancellation state into bit 31 of -refs and uses bits 30:0 as a 31-bit reference counter: define IOWAITIDCANCELFLAG BIT31 define IOWAITIDREFMASK GENMASK30, 0...

DEBIAN-CVE-2026-99227

In the Linux kernel, the following vulnerability has been resolved: iouring/waitid: prevent cancel reference wrap iowaitid packs the cancellation state into bit 31 of -refs and uses bits 30:0 as a 31-bit reference counter: define IOWAITIDCANCELFLAG BIT31 define IOWAITIDREFMASK GENMASK30, 0...