67698 matches found
CVE-2026-72548
OpenSignLabs OpenSign (up to version 2.37.0) contains an information disclosure vulnerability in the gettenant Parse cloud function. The function accepts a contactId parameter and returns the full tenant record without authentication/authorization checks, enabling unauthenticated remote attackers...
Exploit for CVE-2026-62737
CVE-2026-62737: from crash to lab-assisted SYSTEM A follow-up...
CVE-2026-5304
CVE-2026-5304 affects Axis devices via an ACAP configuration file input validation weakness. Exploitation requires the device to allow unsigned ACAP installations and user interaction to install a malicious ACAP app, potentially enabling privilege escalation (CVSS v3.1: 5.7, NETWORK, Privileges R...
CVE-2026-66774
SAP Approuter does not consistently handle certain error conditions. An attacker with low privileges could exploit this under a non-default configuration. Successful exploitation is highly complex, as it depends on conditions outside the attacker's control. This could result in a low impact on...
CVE-2026-58238
SAP Approuter does not sufficiently handle certain requests under specific conditions. An unauthenticated attacker could send specially crafted input that causes the component to crash and restart. Successful exploitation requires specific runtime conditions to be met, making the attack complex t...
VulnCheck KEV: CVE-2022-50997
Weaver Fanwei E-cology 8.0 and 9.0 contains a SQL injection vulnerability in the HrmCareerApplyPerView.jsp endpoint that allows unauthenticated remote attackers to extract arbitrary data from the backend database by manipulating the id GET parameter. Attackers can send a single crafted GET reques...
CVE-2026-18950
creationtimestamp| type| source ---|---|--- 2026-08-10 23:01:22+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3msr7em5vzi2a 2026-08-11 00:15:42+00:00| seen| https://bsky.app/profile/termsofsurrender.bsky.social/post/3msrdjjue7q2v...
dts-data__damn-vulnerable-tiny-web-server
Damn Vulnerable Tiny Web Server A deliberately insecure webse...
CVE-2026-59091
A flaw was found in GIMP's file format plugins, including those for PSD and PAA files. A remote attacker could exploit these vulnerabilities by tricking a user into opening a specially crafted image file. This could lead to unexpected application behavior or other potential security impacts witho...
CVE-2026-59091 Gimp: gimp: multiple vulnerabilities in file format plugins via crafted image file
A flaw was found in GIMP's file format plugins, including those for PSD and PAA files. A remote attacker could exploit these vulnerabilities by tricking a user into opening a specially crafted image file. This could lead to unexpected application behavior or other potential security impacts witho...
CVE-2026-20347
creationtimestamp| type| source ---|---|--- 2026-08-10 12:45:05+00:00| seen| https://www.acn.gov.it/portale/w/risolte-vulnerabilita-in-clamav-2 2026-08-10 13:20:07+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3msq6vaybd72j 2026-08-12 04:45:22+00:00| seen|...
CVE-2026-72580
An OS command injection vulnerability in duhow/xiaoai-patch through commit fb07049 allows a remote attacker to execute arbitrary system commands on Xiaomi smart speakers running the patch. The /mute and /unmute endpoint handlers in api/main.py pass the user-supplied silent query parameter directl...
emp3r0r v4.9.0
emp3r0r Self‑healing Gossip Mesh C2 with Assisted Peer Discovery, Cross-Platform BOF Execution, and Scriptable Agents. What is emp3r0r? emp3r0r is an advanced, zero-trust post-exploitation framework and command & control C2 system designed for Linux and Windows target environments. Built from the...
aipoc
AIPOC – AI POC Thinking Framework Skill A framework designed...
CVE-2026-19383
A security vulnerability has been detected in saithink/saigroup SaiAdmin up to 5.0.1. This impacts the function shellexec of the file /app/saipackage/install/upload of the component Plugin Upload Endpoint. The manipulation leads to unrestricted upload. Remote exploitation of the attack is possibl...
CVE-2026-19384 SourceCodester Simple Doctors Appointment System ajax.php set_appointment sql injection
A weakness has been identified in SourceCodester Simple Doctors Appointment System 1.0. The affected element is an unknown function of the file /admin/ajax.php?action=setappointment. This manipulation of the argument ID causes sql injection. The attack may be initiated remotely. The exploit has...
CVE-2026-19382
A weakness has been identified in Almico Speedfan 4.52. This affects the function KiSystemCall64 in the library speedfan.sys of the component MSR Index Handler. Executing a manipulation can lead to memory leak. The attack can only be executed locally. The exploit has been made available to the...
CVE-2026-19383 saithink/saigroup SaiAdmin Plugin Upload Endpoint upload shell_exec unrestricted upload
A security vulnerability has been detected in saithink/saigroup SaiAdmin up to 5.0.1. This impacts the function shellexec of the file /app/saipackage/install/upload of the component Plugin Upload Endpoint. The manipulation leads to unrestricted upload. Remote exploitation of the attack is possibl...
EUVD-2026-54982
A security vulnerability has been detected in saithink/saigroup SaiAdmin up to 5.0.1. This impacts the function shellexec of the file /app/saipackage/install/upload of the component Plugin Upload Endpoint. The manipulation leads to unrestricted upload. Remote exploitation of the attack is possibl...