snmpvlan

snmpvlan CVE ID: CVE-2014-3341. Cisco Bug ID: CSCup85616. NexusTaco es un escáner SNMP que se puede utilizar tanto para pruebas internas como externas para evaluar switches Cisco Nexus familia 5000 y 6000. Hay muchos escáneres SNMP y herramientas de fuerza bruta; este se hizo solo por completitud...

WordPressMassExploiter

WordPressMassExploiter Mass exploiter of CVE-2015-1579 for WordPress CMS This mass exploiter is based on CVE-2015-1579, discovered by CLAUDIO VIVIANI https://www.exploit-db.com/exploits/36554/ How it works: 1 - I use Selenium Framework to make the search on google. 2 - The results of search, are...

CVE-2026-57128 PraisonAI: Unauthenticated Event Injection via SSE `/publish` Endpoint

PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.58, the SSE server in src/praisonai-agents/praisonaiagents/server/server.py does not consult ServerConfig.authtoken before handling /publish, /events, or /info requests. A network client that can reach the server can broadcast...

Astra Linux – Vulnerability in Git

Git for Windows is a fork of Git that contains Windows-specific patches. This vulnerability affects users working on multi-user machines, where untrusted parties have write access to the same hard disk. These untrusted parties could create the folder C:.git, which would be included in Git...

389-ds-base: 389-ds-base: pre-auth LDAP filter injection in CleanAllRUV status check

A flaw was found in 389 Directory Server. An unauthenticated remote attacker can inject LDAP search filters into the CleanAllRUV replication status-check extended operation. Because the handler performs the search against cn=config with elevated replication plugin privileges and returns a boolean...

389-ds-base: 389-ds-base: pre-auth LDAP filter injection in CleanAllRUV status check

A flaw was found in 389 Directory Server. An unauthenticated remote attacker can inject LDAP search filters into the CleanAllRUV replication status-check extended operation. Because the handler performs the search against cn=config with elevated replication plugin privileges and returns a boolean...

389-ds-base: 389-ds-base: pre-auth LDAP filter injection in CleanAllRUV status check

A flaw was found in 389 Directory Server. An unauthenticated remote attacker can inject LDAP search filters into the CleanAllRUV replication status-check extended operation. Because the handler performs the search against cn=config with elevated replication plugin privileges and returns a boolean...

389-ds-base: 389-ds-base: pre-auth LDAP filter injection in CleanAllRUV status check

A flaw was found in 389 Directory Server. An unauthenticated remote attacker can inject LDAP search filters into the CleanAllRUV replication status-check extended operation. Because the handler performs the search against cn=config with elevated replication plugin privileges and returns a boolean...

389-ds-base: 389-ds-base: pre-auth LDAP filter injection in CleanAllRUV status check

A flaw was found in 389 Directory Server. An unauthenticated remote attacker can inject LDAP search filters into the CleanAllRUV replication status-check extended operation. Because the handler performs the search against cn=config with elevated replication plugin privileges and returns a boolean...

CVE-2026-56567 HCL iControl is affected by multiple security vulnerabilities.

HCL iControl v4.3.0 was affected by Security Misconfiguration vulnerabilities. It involves the public exposure of internal configuration files due to improper web server or application hardening...

CVE-2026-66012 SiYuan before v3.7.2 Unauthenticated Administrator Takeover via MCP

SiYuan before v3.7.2 contains a missing authorization vulnerability in the POST /mcp kernel endpoint, which is gated only by a general auth check model.CheckAuth with no admin-role or read-only enforcement. This exposes 31 MCP tools, including a file tool with list/read/write/delete/rename/copy...

CVE-2026-66012 SiYuan before v3.7.2 Unauthenticated Administrator Takeover via MCP

SiYuan before v3.7.2 contains a missing authorization vulnerability in the POST /mcp kernel endpoint, which is gated only by a general auth check model.CheckAuth with no admin-role or read-only enforcement. This exposes 31 MCP tools, including a file tool with list/read/write/delete/rename/copy...

CVE-2026-14503

The pCloud WP Backup plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.0.3 via the wp2pclajaxprocessrequestinner. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract force generation of a...

CVE-2026-14503 pCloud WP Backup <= 2.0.3 - Missing Authorization on the 'start_backup' AJAX Method to Authenticated (Subscriber+) Arbitrary File Read

The pCloud WP Backup plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.0.3 via the wp2pclajaxprocessrequestinner. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract force generation of a...

CVE-2026-14503

The CVE-2026-14503 entry concerns the pCloud WP Backup plugin for WordPress, affected up to version 2.0.3. The root cause is a Sensitive Information Exposure via the wp2pcl_ajax_process_request_inner path. An authenticated attacker with subscriber-level access or higher can trigger generation of ...

CVE-2026-14503 pCloud WP Backup <= 2.0.3 - Missing Authorization on the 'start_backup' AJAX Method to Authenticated (Subscriber+) Arbitrary File Read

The pCloud WP Backup plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.0.3 via the wp2pclajaxprocessrequestinner. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract force generation of a...

CVE-2026-61454

CVE-2026-61454 affects Grav's Admin2 plugin prior to 2.0.4. The vulnerability arises from embedding a global JavaScript variable, window.GRAV_CONFIG , in the Admin2 SPA bootstrap page at /grav/admin and subroutes. This object is returned in every unauthenticated response and exposes server URL, A...

CVE-2026-61450

Grav prior to 2.0.2 contains a Twig sandbox bypass that enables a page author (including any admin.pages user or anyone with write access to user/pages) to exfiltrate configuration secrets. The sandbox replaces the config variable with a redacted facade and strips Config::get/toArray from the all...

PYSEC-2026-2087

The Config API in Apache Airflow surfaced per-key secrets-backend overrides environment variables like AIRFLOWSECRETSBACKENDKWARGSECRETID and AIRFLOWWORKERSSECRETSBACKENDKWARGSECRETID as synthetic config options whose option names were not in sensitiveconfigvalues, so the masker did not redact...

GHSA-95PQ-HR8P-F5G7 ComfyUI-Manager has an Unprotected Alternate Channel (CWE-420)

Impact An Unprotected Alternate Channel CWE-420 vulnerability was discovered in ComfyUI-Manager versions prior to 3.38. Vulnerability Details In affected versions, ComfyUI-Manager stored its configuration in the user/default/ComfyUI-Manager/ directory, which was accessible via ComfyUI's web APIs...