CVE-2026-78159

abraxaslabs.tech · github.com/abraxas · @abraxasnull · CVE-2026-78159 CVE-2026-78159 The Events Calendar 6.17.3 — stellarwp WordPress 的 The Events Calendar 插件在所有版本（包括 6.17.3）中，通过 parsearray 函数存在远程代码执行漏洞。这是由于对 widget 的 'classes' 映射验证不足，允许纯数组载荷绕过 issafewidgetinstance 对象检查，并到达...

Exploit for CVE-2026-78159

abraxaslabs.tech · github.com/abraxas ·&...

cve-2026-75157-poc

CVE-2026-75157 PoC 针对 Apache Airflow 3.3.2 之前版本中 queued-events 授权缺陷的授权安全研究 PoC。 范围 仅针对你拥有或明确获授权测试的 Airflow 实例运行。默认运行器会拒绝非回环目标。本仓库不包含任何扫描、目标枚举、持久化、凭据窃取或破坏性载荷逻辑。 文件 root@kitploit: README.md poc.py poc.py 是一个通用的、目标感知的 HTTP 请求运行器。它从命令行接收目标 URL、方法、路径、请求头、请求体、认证来源和预期结果，而不是硬编码主机。 用法 针对本地 Airflow...

LAB-DFIR-cve-2023-38831

LAB-DFIR-cve-2023-38831 このラボは CVE-2023–38831 攻撃をシミュレートし、ディスクイメージを調査する必要があります。Windows レジストリ、NTFS ファイル、キャッシュブラウザの理解、および一連のイベントにおける Windows から生成される機能の完全な理解を含む、さまざまな質問があります。これは、このチャレンジの解答と解説です。 リンク :- https://medium.com/@ra3ed.uoro/dfir-actf-e24a21838bde...

CVE-2026-93984

OpenPanel tracking API through commit bad75bddc74d12d36cfb843f4531d3b830a8d994 fails to verify client secret cryptographic hash before authorizing revenue events and bot filtering. Attackers with only a public client ID can supply arbitrary dummy secrets to inject forged revenue metrics and bypas...

Exploit for CVE-2026-75157

CVE-2026-75157 PoC Authorized security research PoC for the A...

CVE-2026-63405 AnyCable: Pusher REST API Does Not Verify Request Body MD5 Enabling Signed-Request Replay with Arbitrary Body

AnyCable is a realtime server for reliable two-way communication that supports any backend. Prior to 1.6.15, the Pusher-compatible REST API in pusher/http.go includes the caller-supplied bodymd5 value in the HMAC input but does not calculate the digest of the received request body or compare it...

CLEANSTART-2026-PI41655 Security fix for CVE-2022-1996 applied in: argo-events 1.6.3-r1, cert-manager-webhook-pdns-fips 2.3.0-r0, kserve-modelmesh-serving 0.9.0-r1, kyverno-policy-reporter-kyverno-plugin-fips 1.3.1-r2

CVE-2022-1996 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CVE-2026-75157

Apache Airflow's asset queued-events DELETE endpoints checked the caller's Dag-axis permission with READ instead of EDIT. Any authenticated user who could read a Dag could therefore delete that Dag's queued asset events, silently suppressing asset-triggered scheduling for it — a state-changing...

CVE-2026-75157 Apache Airflow: Asset queued-events DELETE endpoints gated on Dag READ instead of Dag EDIT (asset-triggered scheduling suppression)

Apache Airflow's asset queued-events DELETE endpoints checked the caller's Dag-axis permission with READ instead of EDIT. Any authenticated user who could read a Dag could therefore delete that Dag's queued asset events, silently suppressing asset-triggered scheduling for it — a state-changing...

CVE-2026-75157

In versions of Apache Airflow prior to 3.3.2 , an incorrect authorization flaw exists in the delete_asset_queued_events, delete_dag_asset_queued_events, and related DELETE routes within airflow/api_fastapi/core_api/routes/public/assets.py. The system incorrectly checks for READ permissions on the...

EUVD-2026-82766

Apache Airflow's asset queued-events DELETE endpoints checked the caller's Dag-axis permission with READ instead of EDIT. Any authenticated user who could read a Dag could therefore delete that Dag's queued asset events, silently suppressing asset-triggered scheduling for it — a state-changing...

CVE-2026-75157 Apache Airflow: Asset queued-events DELETE endpoints gated on Dag READ instead of Dag EDIT (asset-triggered scheduling suppression)

Apache Airflow's asset queued-events DELETE endpoints checked the caller's Dag-axis permission with READ instead of EDIT. Any authenticated user who could read a Dag could therefore delete that Dag's queued asset events, silently suppressing asset-triggered scheduling for it — a state-changing...

CVE-2026-75157 Apache Airflow: Asset queued-events DELETE endpoints gated on Dag READ instead of Dag EDIT (asset-triggered scheduling suppression)

Apache Airflow's asset queued-events DELETE endpoints checked the caller's Dag-axis permission with READ instead of EDIT. Any authenticated user who could read a Dag could therefore delete that Dag's queued asset events, silently suppressing asset-triggered scheduling for it — a state-changing...

CVE-2026-13471: Authorization Bypass Through User-Controlled Key

The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.6.3 via the LatePointAbilityDeleteBooking::execute due to missing validation on a user controlled key. This makes it...

CVE-2026-75157: Incorrect Authorization

Apache Airflow's asset queued-events DELETE endpoints checked the caller's Dag-axis permission with READ instead of EDIT. Any authenticated user who could read a Dag could therefore delete that Dag's queued asset events, silently suppressing asset-triggered scheduling for it — a state-changing...

CVE-2026-16582

The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to unauthorized modification of data in all versions up to, and including, 2.4.5. This is due to the plugin accepting a client-supplied package-redemption identifier as proof of payment without validating...

CVE-2026-93295

MISP contains a vulnerability in its background job dispatch mechanism that allows remote code execution as the web user. Background job arguments are passed directly as the argv of the CakePHP console process. CakePHP's ShellDispatcher::parsePaths scans the entire argv for path switches -app,...

CVE-2026-93295

MISP (Malicious Intelligence Sharing Platform) is vulnerable to remote code execution via its background job dispatch mechanism. User-controlled fields (person and message) from the events/contact endpoint are passed unvalidated into the CakePHP console process argv. An attacker sets person to a ...

CVE-2026-93295 MISP Background Job Argument Injection via Console Path Switches Enables Remote Code Execution

MISP contains a vulnerability in its background job dispatch mechanism that allows remote code execution as the web user. Background job arguments are passed directly as the argv of the CakePHP console process. CakePHP's ShellDispatcher::parsePaths scans the entire argv for path switches -app,...