CVE-2026-56707

Grav Flex Objects plugin versions 1.4.0 through 1.4.7 contain an authorization bypass vulnerability in the flex-objects shortcode that allows users with page-edit access to render any registered Flex collection without permission checks. Attackers can place the shortcode in published pages to...

EUVD-2026-65219

Grav before 2.0.16 allows sandboxed Twig templates to access sensitive User fields through allow-listed offsetGet and offsetexists methods that lack field filtering. Attackers with page-edit permissions can call offsetGet on User objects to extract hashed passwords and 2FA secrets, enabling offli...

CVE-2026-76839 Grav before 2.0.16 Information Disclosure via offsetGet

Grav before 2.0.16 allows sandboxed Twig templates to access sensitive User fields through allow-listed offsetGet and offsetexists methods that lack field filtering. Attackers with page-edit permissions can call offsetGet on User objects to extract hashed passwords and 2FA secrets, enabling offli...

CVE-2026-76839

Grav before 2.0.16 is affected by an information disclosure vulnerability in its sandboxed Twig templates. The allow-listed offsetGet() and offsetexists() methods lack field filtering on User objects , permitting attackers with page-edit permissions to extract hashed passwords and 2FA secrets , e...

CVE-2026-72698

Grav CMS before 2.0.16 fails to filter system, site, and theme configuration arrays in sandboxed Twig renders. An attacker with page-content edit access (low privilege) can bypass the config_denied_paths restrictions by using dot notation in Twig templates, exposing raw configuration values inclu...

CVE-2026-56707 Grav Flex Objects 1.4.0 through 1.4.7 Authorization Bypass via Shortcode

Grav Flex Objects plugin versions 1.4.0 through 1.4.7 contain an authorization bypass vulnerability in the flex-objects shortcode that allows users with page-edit access to render any registered Flex collection without permission checks. Attackers can place the shortcode in published pages to...

EUVD-2026-65193

The BetterLinks – Link Shortener, Link Cloaking, Redirects, Affiliate Link Manager & MCP plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.1.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This...

EUVD-2026-65175

Unauthenticated Sensitive Data Exposure in Lead Generation Contact Widget & AI Chatbot: Chat Button, Phone Call, Telegram, Email – SiteLeads = 1.2.0 versions...

CVE-2017-12637_SAP-NetWeaver-URL-Traversal

CVE-2017-12637SAP-NetWeaver-URL-Traversal Scanner LFI proof-of-concept: rilevamento automatico delle esposizioni di /etc/passwd tramite directory traversal e corrispondenza regex. root@kitploit: Scanner LFI Un proof-of-concept Python leggero per scansionare host target per vulnerabilità di Local...

PT-2026-81860

GitHub CLI gh is GitHub's official command line tool. Versions 2.28.0 through 2.97.0 bind the local listener created by gh codespace ports forward to all available network interfaces by default. While port forwarding is active, a service in a Codespace can therefore become reachable through the...

APSB26-124 : Security update available for Adobe Illustrator

Adobe has released an update for Adobe Illustrator. This update resolves an important vulnerability that could result in memory exposure...

VulnCheck KEV: CVE-2026-19632

The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.3.1 via the 'trpgettranslationsregular' AJAX action. This makes it possible for unauthenticated attackers to extract t...

Adobe Illustrator < 29.8.10 / 30.0 < 30.7 Memory exposure (APSB26-124)

The version of Adobe Illustrator installed on the remote Windows host is prior to 29.8.10, 30.7. It is, therefore, affected by a vulnerability as referenced in the APSB26-124 advisory. - Out-of-bounds Read CWE-125 potentially leading to Memory exposure CVE-2026-71441 Note that Nessus has not test...

CVE-2026-23918-Passive-Audit

Script de auditoria CVE-2026-23918 alternativamente, você poderia apenas usar curl nos cabeçalhos e dar uma olhada, mas aqui está: Auditor de metadados HTTP não invasivo para Apache HTTP Server Triagem de exposição CVE-2026-23918 https://www.openwall.com/lists/oss-security/2026/05/04/19. A...

CVE-2023-6444-POC

CVE-202306444-POC Prova di concetto per la divulgazione dell'email dell'amministratore senza autenticazione CVE-2023-6444 Uso: python3 cve-2023-6444.py $URL https://vulners.com/cvelist/CVELIST:CVE-2023-6444...

CVE-2022-45354

Download Monitor = 4.7.60 - Esposizione di Informazioni Sensibili tramite API REST CVE-2022-45354:versione trovata su http://wordpress.lan Dettagli : CVE-2022-45354:versione corrispondente su http://wordpress.lan Protocollo : HTTP URL Completo :...

CVE-2026-78268

Unauthenticated Sensitive Data Exposure in Lead Generation Contact Widget & AI Chatbot: Chat Button, Phone Call, Telegram, Email – SiteLeads = 1.2.0 versions...

CVE-2026-78268 WordPress Lead Generation Contact Widget & AI Chatbot: Chat Button, Phone Call, Telegram, Email – SiteLeads plugin <= 1.2.0 - Sensitive Data Exposure vulnerability

Unauthenticated Sensitive Data Exposure in Lead Generation Contact Widget & AI Chatbot: Chat Button, Phone Call, Telegram, Email – SiteLeads = 1.2.0 versions...

CVE-2026-78268

CVE-2026-78268 affects the SiteLeads WordPress plugin (Lead Generation Contact Widget & AI Chatbot) in versions ≤ 1.2.0 . The vulnerability allows unauthenticated sensitive data exposure through the plugin's Chat Button, Phone Call, Telegram, and Email contact features, with no user interaction r...

react-server-cve-lab

Laboratorio di Sicurezza React Server Components CVE-2025-55183 e CVE-2025-55184 Un ambiente completo di test di sicurezza per le vulnerabilità CVE-2025-55183 Esposizione del codice sorgente e CVE-2025-55184 Denial of Service in React Server Components. ⚠️ Disclaimer SOLO PER SCOPI EDUCATIVI E DI...