CVE-2026-7808

justhtml (Python HTML parsing library) before 1.16.0 contains multiple HTML sanitization bypass issues that can allow active content such as [removed] or to survive sanitization, potentially leading to cross-site scripting . The issues primarily affect advanced usage rather than the default Just...

CVE-2026-78115

A vulnerability has been found in SourceCodester Class and Exam Timetabling System 1.0. Affected is an unknown function of the file /admin/edituseraccount.php of the component User Account Update. Such manipulation of the argument id/username leads to improper authorization. The attack may be...

CVE-2026-78061

A vulnerability was determined in vas3k TaxHacker up to 0.8.2. Impacted is the function buildImapConfig of the file lib/email-sync/imap-client.ts of the component Email Sync. Executing a manipulation of the argument host/port can lead to server-side request forgery. It is possible to launch the...

CVE-2026-78061

CVE-2026-78061 affects vas3k TaxHacker up to version 0.8.2 . The vulnerability is a server-side request forgery (SSRF) in the Email Sync component, specifically in the function buildImapConfig within lib/email-sync/imap-client.ts. An attacker can manipulate the host/port arguments to force the se...

CVE-2026-78061 vas3k TaxHacker Email Sync imap-client.ts buildImapConfig server-side request forgery

A vulnerability was determined in vas3k TaxHacker up to 0.8.2. Impacted is the function buildImapConfig of the file lib/email-sync/imap-client.ts of the component Email Sync. Executing a manipulation of the argument host/port can lead to server-side request forgery. It is possible to launch the...

EUVD-2026-64626

A vulnerability was determined in vas3k TaxHacker up to 0.8.2. Impacted is the function buildImapConfig of the file lib/email-sync/imap-client.ts of the component Email Sync. Executing a manipulation of the argument host/port can lead to server-side request forgery. It is possible to launch the...

CVE-2026-78061 vas3k TaxHacker Email Sync imap-client.ts buildImapConfig server-side request forgery

A vulnerability was determined in vas3k TaxHacker up to 0.8.2. Impacted is the function buildImapConfig of the file lib/email-sync/imap-client.ts of the component Email Sync. Executing a manipulation of the argument host/port can lead to server-side request forgery. It is possible to launch the...

PT-2026-79775

Name of the Vulnerable Software and Affected Versions justhtml versions prior to 1.16.0 Description Multiple HTML sanitization bypass issues allow active or dangerous content, such as script or style tags, to survive the sanitization process, potentially leading to cross-site scripting. These...

dompurify: DOMPurify: Sanitization bypass via hook manipulation

A flaw was found in DOMPurify. An attacker can exploit a vulnerability in how DOMPurify handles its sanitization hooks when default configurations are used. By manipulating the uponSanitizeElement or uponSanitizeAttribute hooks, an attacker can permanently alter the allowed HTML tags and...

dompurify: DOMPurify: Sanitization bypass via hook manipulation

A flaw was found in DOMPurify. An attacker can exploit a vulnerability in how DOMPurify handles its sanitization hooks when default configurations are used. By manipulating the uponSanitizeElement or uponSanitizeAttribute hooks, an attacker can permanently alter the allowed HTML tags and...

CVE-2025-8088-Winrar

CVE-2025-8088 Sfruttamento WinRAR Strumento avanzato di sfruttamento del path traversal di WinRAR Un sofisticato strumento GUI per creare file RAR dannosi che sfruttano la vulnerabilità di path traversal di WinRAR CVE-2025-8088 tramite la manipolazione delle intestazioni ADS e RAR5. Caratteristic...

CVE-2026-16738

The Conekta Payment Gateway WordPress plugin before 6.2.2 does not verify the authenticity of incoming payment gateway webhook notifications, nor bind the confirmed payment to the targeted order or verify its amount, allowing unauthenticated attackers to mark arbitrary orders as paid without...

CVE-2026-16738 Conekta Payment Gateway < 6.2.2 - Unauthenticated Order Payment Completion via Webhook Forgery

The Conekta Payment Gateway WordPress plugin before 6.2.2 does not verify the authenticity of incoming payment gateway webhook notifications, nor bind the confirmed payment to the targeted order or verify its amount, allowing unauthenticated attackers to mark arbitrary orders as paid without...

EUVD-2026-64218

The Conekta Payment Gateway WordPress plugin before 6.2.2 does not verify the authenticity of incoming payment gateway webhook notifications, nor bind the confirmed payment to the targeted order or verify its amount, allowing unauthenticated attackers to mark arbitrary orders as paid without...

PR0CESS

PR0CESS alcuni gadget sui processi di Windows, pronti all'uso :...

Cronos-Rootkit

Cronos Rootkit Cronos ist ein Windows 10/11 x64 Ring-0-Rootkit. Cronos kann Prozesse verstecken, schützen und deren Rechte durch Token-Manipulation erhöhen. Funktionen Prozess verstecken Prozessrechte erhöhen Prozess schützen Beiträge Beiträge sind willkommen...

effective-waffle

effective-waffle noch ein weiteres Sleep-Encryption-Ding. Habe dafür auch den Standard-GitHub-Repo-Namen verwendet. TpAllocWork + TpPostWork + TpWaitForWork + TpReleaseWork, um den Callback zu erstellen, auszuführen und zu bereinigen. Der Callback ist eine zusammengeschusterte Assembly-Routine, d...

CVE-2026-64679

Atlantis is a self-hosted golang application that listens for Terraform pull request events via webhooks. From 0.19.8 until 0.45.0, Atlantis does not consistently validate user-controlled workspace values supplied through accepted repository-level atlantis.yaml configuration or authenticated...

CVE-2026-67358

Joomla Extension - j2commerce.com - Download quota manipulation in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 - An authenticated user with a valid order token could increment the download limit counter on a download record belonging to a different order. The endpoint also lacked a CSRF token...

CVE-2026-67358 Joomla Extension - j2commerce.com - Download quota manipulation in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5

Joomla Extension - j2commerce.com - Download quota manipulation in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 - An authenticated user with a valid order token could increment the download limit counter on a download record belonging to a different order. The endpoint also lacked a CSRF token...