PT-2026-106468

Unauthenticated Sensitive Data Exposure in SafeSnap – Verified WordPress Backup & Restore = 2.1.2 versions...

PT-2026-106332

Unauthenticated Sensitive Data Exposure in Sitemovr = 1.0.1 versions...

PT-2026-106457

Unauthenticated Sensitive Data Exposure in Mailjet Email Marketing = 6.2.3 versions...

PT-2026-106321

A security vulnerability has been detected in uptrace up to 2.1.0-beta.8. Affected by this vulnerability is the function Login of the file pkg/org/user handler.go. The manipulation leads to information exposure through error message. It is possible to initiate the attack remotely. The exploit has...

PT-2026-106371

Unauthenticated Sensitive Data Exposure in Groundhogg = 4.8.3 versions...

PT-2026-106388

Unauthenticated Sensitive Data Exposure in SiteVault – Backup, Restore, Migration & Cloning = 1.5.17 versions...

PT-2026-106368

Unauthenticated Sensitive Data Exposure in Xserver Migrator = 1.6.6 versions...

PT-2026-107301

Name of the Vulnerable Software and Affected Versions Backstage versions prior to 4.1.0 Description The @backstage/plugin-scaffolder-backend package allows sensitive information exposure within scaffolder task logs. An authenticated user with permissions to create and read scaffolder tasks can...

PT-2026-107026

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 155.0.8059.39 Description Improper resource exposure in Extensions allows a remote attacker to obtain cross-origin data through the use of a crafted HTML page. Recommendations Update Google Chrome to version...

PT-2026-107124

Unpatched vulnerabilities don't stay hidden on our atlas. CVE CRITICAL VULNERABILITY DETECTED CVE ID → CVE-2026-76746 Vendor → Unknown Severity → Critical — CVSS 9.3 Product → Unknown Date → 2026-10-06 A critical vulnerability Classic Buffer Overflow has been disclosed affecting Unknown. Patch...

PT-2026-107125

Unpatched vulnerabilities don't stay hidden on our atlas. CVE CRITICAL VULNERABILITY DETECTED CVE ID → CVE-2026-76747 Vendor → Unknown Severity → Critical — CVSS 9.1 Product → Unknown Date → 2026-10-06 A critical vulnerability Classic Buffer Overflow has been disclosed affecting Unknown. Patch...

PT-2026-107305

Name of the Vulnerable Software and Affected Versions Backstage versions prior to 1.15.4 Description The @backstage/plugin-techdocs-node package allows potential file exposure when the local TechDocs publisher is used via the techdocs.publisher.type variable set to 'local'. In this configuration,...

nginx

CVE-2017-7529 당승표@portfolio10 Resumen Este laboratorio reproduce la vulnerabilidad de caché CVE-2017-7529 que ocurre en el proceso de manejo de solicitudes Range del servidor Nginx, y el comportamiento real de la vulnerabilidad. Vulnerabilidad: Error en el procesamiento del encabezado Range de...

MSMQ-Vulnerability

MSMQ Security Lab This repository documents a controlled lab review of Microsoft Message Queuing security exposure, focusing on defensive validation, detection evidence, and remediation planning. The project is positioned as a portfolio artefact: it shows how vulnerability research can be...

vulnbox-easy-CVE-2025-29927

Man-in-the-middle This application is named Man-in-the middle because it contains a vulnerability in Next.JS middleware and the flag is in the API call. 🚀 Production Setup 1. .env.production DATABASEURL=postgresql://postgres:password@db:5432/nextauth JWTSECRET=your-production-secret 2. Build and...

PyMongo: PYTHON-5986 Host injection in PyMongo connection string parsing via percent-encoded delimiters

Summary PyMongo percent-decoded the entire host section of a connection string before splitting it into individual host:port entries. A percent-encoded , or : in a hostname therefore decoded into a real delimiter, injecting an additional attacker-chosen host and port into the client's seed list...

GHSA-VP6J-J7W5-5XJJ PyMongo: PYTHON-5986 Host injection in PyMongo connection string parsing via percent-encoded delimiters

Summary PyMongo percent-decoded the entire host section of a connection string before splitting it into individual host:port entries. A percent-encoded , or : in a hostname therefore decoded into a real delimiter, injecting an additional attacker-chosen host and port into the client's seed list...

CVE-2024-6678

CVE-2024-6678 - GitLab: Pipeline Schedule Arbitrary User Trigger PoC per CVE-2024-6678 Descrizione della vulnerabilità GitLab consente agli utenti di eseguire manualmente le pianificazioni dei pipeline CI/CD Pipeline Schedules tramite il pulsante «Play». La vulnerabilità consiste nel fatto che la...

CVE-2026-27944

CVE-2026-27944 - Nginx UI Unauthenticated Backup Download & Decryption https://img.shields.io/badge/python-3.6+-blue.svg https://img.shields.io/badge/license-MIT-green https://img.shields.io/badge/PoC-Exploit-red A proof‑of‑concept PoC exploit for CVE‑2026‑27944, a critical vulnerability in Nginx...

NPM: vm2: NodeVM zlib Buffers expose pooled host memory across the VM boundary

NPM: vm2: NodeVM zlib Buffers expose pooled host memory across the VM boundary vulnerability discovered by ? in WordPress Npm vm2 versions = 3.12.1...