MAL-007

MAL-007: XML External Entity via Local Registry Entries in WSO2 ESB An inline XML External Entity XXE attack was identified in the WSO2 ESB “Local Entities” tool. Why no CVE? The vendor replied that this vulnerability was "Fixed in WUM" and no public disclosure was made. Requirements: This...

fuzztruction

Fuzztruction Fuzztruction is an academic prototype of a fuzzer that does not directly mutate inputs as most fuzzers do but instead uses a so-called generator application to produce an input for our fuzzing target. As programs generating data usually produce the correct representation, our fuzzer...

Parsero

What's Parsero? Parsero is a free script written in Python which reads the Robots.txt file of a web server and looks at the Disallow entries. The Disallow entries tell the search engines what directories or files hosted on a web server mustn't be indexed. For example, "Disallow: /portal/login"...

EUVD-2026-107072

The Redirection for Contact Form 7 WordPress plugin before 3.2.12 does not sanitise or escape submitted form data stored as lead entries before outputting it in the lead debug metabox, allowing unauthenticated attackers to store a malicious script that executes when a logged-in user views the ent...

CVE-2026-114110

Astral uv before 0.11.6 contains a path traversal vulnerability that allows attackers to delete arbitrary files by supplying wheels with relative traversal paths in RECORD entries. Attackers can craft a malicious wheel whose RECORD references files outside the installation prefix, causing uv to...

CVE-2026-114110 Astral uv before 0.11.6 Arbitrary File Deletion via Wheel RECORD Entries

Astral uv before 0.11.6 contains a path traversal vulnerability that allows attackers to delete arbitrary files by supplying wheels with relative traversal paths in RECORD entries. Attackers can craft a malicious wheel whose RECORD references files outside the installation prefix, causing uv to...

CVE-2026-114110

Astral uv versions before 0.11.6 are vulnerable to a path traversal vulnerability (CWE-23). An attacker can craft a malicious wheel package containing RECORD entries with relative traversal paths. When a user uninstalls the affected package, uv may delete arbitrary files located outside the insta...

EUVD-2026-106913

Astral uv before 0.11.6 contains a path traversal vulnerability that allows attackers to delete arbitrary files by supplying wheels with relative traversal paths in RECORD entries. Attackers can craft a malicious wheel whose RECORD references files outside the installation prefix, causing uv to...

EUVD-2026-105963

Vulnerability in the Oracle Payroll product of Oracle E-Business Suite component: Element Types, Links, Entries. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Payroll...

PT-2026-120467

The Redirection for Contact Form 7 WordPress plugin before 3.2.12 does not sanitise or escape submitted form data stored as lead entries before outputting it in the lead debug metabox, allowing unauthenticated attackers to store a malicious script that executes when a logged-in user views the ent...

CVE-2026-101553

Vulnerability in the Oracle Payroll product of Oracle E-Business Suite component: Element Types, Links, Entries. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Payroll...

CVE-2026-101553

A vulnerability exists in the Oracle Payroll product of Oracle E-Business Suite , specifically affecting the Element Types, Links, and Entries components. The affected versions range from 12.2.3 to 12.2.15 . A low-privileged attacker with network access via HTTP can easily exploit this flaw to co...

ACEshark

ACEshark What is it? ACEshark is a utility designed for rapid extraction and analysis of Windows service configurations and Access Control Entries, eliminating the need for tools like accesschk.exe or other non-native binaries. Why? Efficiently identify and analyze service permissions to uncover...

CVE-2026-98595

A flaw was found in the Linux kernel's UDP networking subsystem. When a connected User Datagram Protocol UDP socket bound to a specific address is disconnected, the kernel fails to remove the socket entry from its internal connection lookup table. A local user can cause stale entries to persist,...

Contact Form Entries < 1.2.4 - Cross-Site Scripting

The plugin does not sanitise and escape various parameters, such as formid, status, enddate, order, orderby and search before outputting them back in the admin page id: CVE-2021-25079 info: name: Contact Form Entries 1.2.4 - Cross-Site Scripting author: r3Y3r53 severity: medium description: | The...

Formidable Form Builder < 2.05.03 - Unauthenticated Information Disclosure

The Formidable Form Builder plugin for WordPress is vulnerable to Sensitive Data Exposure in versions up to, and including, 2.05.03 via the frmformspreview AJAX action. This makes it possible for unauthenticated attackers to export all of the form entries for a given form. id: CVE-2017-20194 info...

PT-2026-119235

Vulnerability in the Oracle Payroll product of Oracle E-Business Suite component: Element Types, Links, Entries. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Payroll...

Set-AuditRule

Set-AuditRule A repository of useful access control entries ACE that could be added to the system access control list SACL of a securable object's security descriptor to monitor potential adversarial activity. These entries are categorized by specific securable objects such as files, registry key...

CVE-2026-98569 ip_gre: Reject enabling collect metadata through changelink

In the Linux kernel, the following vulnerability has been resolved: ipgre: Reject enabling collect metadata through changelink ipgrenetlinkparms can enable collectmd on an existing GRE, GRETAP or ERSPAN device. Unlike newlink, changelink does not enforce metadata tunnel uniqueness. Converting a...

gix-pack: gix-pack: Denial of Service via malformed packfile delta entries

A flaw was found in gix-pack. A malicious remote repository can cause a Denial of Service DoS by serving a crafted Git packfile containing malformed delta offset entries during a fetch operation. Processing these entries leads to an unhandled application crash, abruptly terminating the fetch...