CVE-2026-92403 Secure Custom Fields < 6.9.4 - Unauthenticated Post Modification via Front-End Form ID Substitution

The Secure Custom Fields WordPress plugin before 6.9.4 does not properly verify that a front-end form submission corresponds to the form that was rendered to the visitor, allowing unauthenticated users to submit against a different registered form and modify the title and content of the post that...

CVE-2026-92403 Secure Custom Fields < 6.9.4 - Unauthenticated Post Modification via Front-End Form ID Substitution

The Secure Custom Fields WordPress plugin before 6.9.4 does not properly verify that a front-end form submission corresponds to the form that was rendered to the visitor, allowing unauthenticated users to submit against a different registered form and modify the title and content of the post that...

CVE-2025-65670

CVE-2025-65670 Una referencia directa a objetos insegura IDOR en classroomio 0.1.13 permite a los estudiantes acceder a endpoints sensibles de administradores/profesores mediante la manipulación de IDs de cursos en las URL, lo que resulta en la divulgación no autorizada de datos sensibles del...

CVE-2026-73034-PoC

CVE-2026-73034 — DB-GPT v0.8.1 Unauthenticated Path Traversal → Arbitrary File Write CVSS 9.8 Critical · CWE-22 · GHSA/Issue 3104 Summary POST /api/v1/python/file/upload in DB-GPT v0.8.1 takes the user-id HTTP header and uses it raw as a path component : root@kitploit: uploaddir =...

CVE-2026-89334 Better Messages <= 2.15.33 - Missing Authorization to Authenticated (Custom+) Chat-Room Transcript Disclosure via '/thread/<id>' REST Endpoint

The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.15.33. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it...

CVE-2026-89334

The Better Messages plugin for WordPress (chat rooms, group chat, private messages & AI chat bots) is vulnerable to authorization bypass in all versions up to and including 2.15.33 . The plugin fails to properly verify user authorization on the /thread/ REST endpoint , allowing any authenticated ...

CVE-2026-66384

cve-id Donate...

untitledgoosetool

Untitled Goose Tool The Goose is loose. Table of Contents About Getting Started Prerequisites Requirements Installing Usage Config GUI Auth Csv Honk Messagetrace Recommended Default Workflow Recommended Workflow for UAL Call with Time Bounds Considerations Known Issues Acknowledgements Contributi...

CVE-2021-42667

CVE-2021-42667 CVE-2021-42667 - Vulnerabilidad de inyección SQL en el sistema de reservas y reserva de eventos en línea versión 2.3.0. Descripción técnica: Existe una vulnerabilidad de inyección SQL en el software de gestión de eventos versión 2.3.0. Un atacante puede aprovechar el parámetro...

CVE-2026-65643

cve-id Donate...

CVE-2026-93593

ArcadeDB before 26.9.1 fails to enforce security-group types ACL entries for TimeSeries types because the ACL resolver builds permissions from bucket IDs, but TimeSeries types do not own normal record buckets. An authenticated low-privilege user can read or insert TimeSeries samples despite...

Azure

Azure Offensive Security Toolkit A collection of Bash and PowerShell scripts for Azure security assessments, covering IAM privilege escalation, container security, Key Vault exposure, Entra ID configuration, and more. Designed to run in Azure Cloud Shell or any authenticated terminal. Scripts IAM...

CVE-2026-93593 ArcadeDB before 26.9.1 TimeSeries ACL Bypass via Type Permission

ArcadeDB before 26.9.1 fails to enforce security-group types ACL entries for TimeSeries types because the ACL resolver builds permissions from bucket IDs, but TimeSeries types do not own normal record buckets. An authenticated low-privilege user can read or insert TimeSeries samples despite...

CVE-2026-93592 vLLM before 0.28.0 Denial of Service via negative token ID

vLLM versions before 0.28.0 fail to validate the lower bound of token IDs in the /v1/embeddings and /pooling endpoints, allowing unauthenticated attackers to crash the engine by submitting negative token IDs. A single request with a negative token ID triggers a CUDA device-side assertion that...

CVE-2026-93592

vLLM versions before 0.28.0 fail to validate the lower bound of token IDs in the /v1/embeddings and /pooling endpoints. An unauthenticated attacker can send a single request containing a negative token ID , triggering a CUDA device-side assertion that poisons the GPU context and causes all subseq...

CVE-2026-93592 vLLM before 0.28.0 Denial of Service via negative token ID

vLLM versions before 0.28.0 fail to validate the lower bound of token IDs in the /v1/embeddings and /pooling endpoints, allowing unauthenticated attackers to crash the engine by submitting negative token IDs. A single request with a negative token ID triggers a CUDA device-side assertion that...

CVE-2026-93592 vLLM before 0.28.0 Denial of Service via negative token ID

vLLM versions before 0.28.0 fail to validate the lower bound of token IDs in the /v1/embeddings and /pooling endpoints, allowing unauthenticated attackers to crash the engine by submitting negative token IDs. A single request with a negative token ID triggers a CUDA device-side assertion that...

the-token-was-a-row-number-cve-2026-67602-phpipam-rest-api-authentication-bypass

CVE-2026-67602 — phpIPAM 1.8.2 REST API Authentication Bypass Unauthenticated authentication bypass in the phpIPAM REST API, caused by an object-cache key collision: the database row cached while resolving an API app's appid satisfies the subsequent appcode token check whenever the supplied token...

Event-ID-268-Rule-Name-SOC292-Possible-PHP-Injection-Detected-CVE-2024-4577-

Este repositorio no tiene un README...

DEBIAN-CVE-2026-93578

A flaw was found in Netty's Online Certificate Status Protocol OCSP Client. The client fails to verify the 'id-kp-OCSPSigning' Extended Key Usage EKU in OCSP responder certificates. A remote attacker, holding any valid certificate issued by the same Certificate Authority CA, can exploit this by...