CVE-2026-92953

A flaw was found in vm2. The sandbox fails to properly isolate host object structures from untrusted code running inside the virtual machine. An attacker can exploit this issue by manipulating object prototype chains to modify shared host prototypes, resulting in prototype pollution the...

CVE-2026-103237 MISP: Nested Model Alias Key Bypasses Sanitization to Modify Cross-Tenant Rows

MISP contains an improper input validation vulnerability in its ORM save path. When a user submits data through various endpoints attribute add/edit, event edit, free-text import, sighting capture, shadow attribute proposal, event report creation, object reference add, user admin edit, the...

CVE-2026-103237 MISP: Nested Model Alias Key Bypasses Sanitization to Modify Cross-Tenant Rows

MISP contains an improper input validation vulnerability in its ORM save path. When a user submits data through various endpoints attribute add/edit, event edit, free-text import, sighting capture, shadow attribute proposal, event report creation, object reference add, user admin edit, the...

cve-2019-5420-POC

Rails ActiveSupport 漏洞利用 cve-2019-5420 PoC（可用于链式攻击 CVE-2019-5418！） 与 CVE-2019-5418 完美搭配！ PoC 截图 🚨 警告 本仓库包含一个概念验证（PoC）漏洞利用 ，演示了通过滥用 ActiveSupport::MessageVerifier 在 Ruby on Rails 应用程序中实现远程代码执行（RCE） 。请负责任地使用！ 📌 概述 该脚本通过利用精心构造的 ERB 对象 （包裹在 DeprecatedInstanceVariableProxy 中）来利用 ActiveSupport 反序列化漏洞...

SUSE-SU-2026:4402-1 Security update for python-PyYAML

This update for python-PyYAML fixes the following issues: - Update to 5.3.1. - CVE-2020-14343: A vulnerability was discovered in the PyYAML library, where it was susceptible to arbitrary code execution when it processes untrusted YAML files through the fullload method or with the FullLoader loade...

Exploit-CVE-2025-68613

Exploit-CVE-2025-68613 보안 권고: n8n의 치명적인 원격 코드 실행 취약점 CVE-2025-68613 n8n 워크플로우 자동화 도구에서 임의 코드 실행을 허용하는 치명적인 취약점이 발견되었습니다. 워크플로우를 생성하거나 편집할 권한이 있는 인증된 사용자는 이 결함을 악용하여 n8n 인스턴스가 실행 중인 시스템을 제어할 수 있습니다. 요약 CVE ID CVE-2025-68613 취약점 동적으로 관리되는 코드 리소스에 대한 부적절한 제어 심각도 치명적 영향 임의 명령 실행, 시스템 완전 장악 근본 원인 표현식...

oss

oss 中文 |English S3 プロトコルベースのクロスクラウドオブジェクトストレージコマンドラインツール。単一のバイナリで、主要クラウドベンダーのオブジェクトストレージを操作： AWS S3、Alibaba Cloud OSS、Tencent Cloud COS、Huawei Cloud OBS、Baidu Cloud BOS、Kingsoft Cloud KS3、 UCloud US3、JD Cloud OSS、Google Cloud Storage、Cloudflare R2、Scaleway、Wasabi、 DigitalOcean Spaces、Backblaze...

CVE-2026-91051

The EWWW Image Optimizer WordPress plugin before 8.8.0 does not prevent authenticated users with author-level permissions from storing a serialized value in a post meta field that is deserialized when the post is rendered, allowing them to perform PHP Object Injection, which can lead to remote co...

EUVD-2026-89618

The EWWW Image Optimizer WordPress plugin before 8.8.0 does not prevent authenticated users with author-level permissions from storing a serialized value in a post meta field that is deserialized when the post is rendered, allowing them to perform PHP Object Injection, which can lead to remote co...

CVE-2026-91051 EWWW Image Optimizer 8.6.0 - 8.7.7 - Author+ PHP Object Injection via 'eio_page_settings' Post Meta

The EWWW Image Optimizer WordPress plugin before 8.8.0 does not prevent authenticated users with author-level permissions from storing a serialized value in a post meta field that is deserialized when the post is rendered, allowing them to perform PHP Object Injection, which can lead to remote co...

CVE-2026-91051

The EWWW Image Optimizer WordPress plugin versions before 8.8.0 (specifically versions 8.6.0 - 8.7.7 ) is vulnerable to PHP Object Injection . Authenticated users with author-level permissions can store a serialized value in a post meta field (specifically 'eio_page_settings' ). When the post is ...

CVE-2026-91051 EWWW Image Optimizer 8.6.0 - 8.7.7 - Author+ PHP Object Injection via 'eio_page_settings' Post Meta

The EWWW Image Optimizer WordPress plugin before 8.8.0 does not prevent authenticated users with author-level permissions from storing a serialized value in a post meta field that is deserialized when the post is rendered, allowing them to perform PHP Object Injection, which can lead to remote co...

CVE-2019-13272

CVE-2019-13272 Linux ローカル root エクスプロイト Linux 4.10 5.1.17 PTRACETRACEME ローカル root CVE-2019-13272 In the Linux kernel before 5.1.17, ptracelink in kernel/ptrace.c mishandles the recording of the credentials of a process that wants to create a ptrace relationship, which allows local users to obtain...

vulnerable-bsr-lab-CVE-2023-6933

CVE-2023-6933 취약점 연구소 개요 이 연구소 환경은 Better Search Replace WordPress 플러그인 버전 ≤1.4.4의 심각한 PHP 객체 주입 취약점인 CVE-2023-6933을 시연합니다. 취약점 상세 CVE ID : CVE-2023-6933 CVSS 점수 : 9.8 심각 영향 받는 플러그인 : Better Search Replace ≤1.4.4 취약점 유형 : 직렬화 해제된 사용자 입력을 통한 PHP 객체 주입 공격 벡터 : AJAX 엔드포인트 /wp-admin/admin-ajax.php...

My Geo Posts Free <= 1.2 - PHP Object Injection

The My Geo Posts Free plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 1.2 via deserialization of untrusted input. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software. If ...

Masteriyo LMS <= 1.7.3 - Insecure Direct Object Reference

Authentication Bypass Using an Alternate Path or Channel vulnerability in Masteriyo Masteriyo - LMS. Unauth access to course progress.This issue affects Masteriyo - LMS: from n/a through 1.7.3. id: CVE-2024-33939 info: name: Masteriyo LMS = 1.7.3 - Insecure Direct Object Reference author:...

Everest Forms WordPress Plugin <= 3.4.3 - PHP Object Injection

The Everest Forms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.4.3 via deserialization of untrusted input from form entry metadata. This is due to the html-admin-page-entries-view.php file calling PHP's native unserialize on stored entry meta...

GiveWP Donation Plugin <= 3.16.1 - Unauthenticated PHP Object Injection

The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.16.1. This is due to insufficient input validation on user-supplied data. An unauthenticated attacker can inject a serialized PHP object, which...

SEOPress < 7.9 - Authentication Bypass

The SEOPress WordPress plugin before 7.9 does not properly protect some of its REST API routes, which combined with another Object Injection vulnerability can allow unauthenticated attackers to unserialize malicious gadget chains, compromising the site if a suitable chain is present. id:...

GiveWP <= 4.16.7.1 - Remote Code Execution

GiveWP = 4.16.7.1 contains an insecure deserialization vulnerability caused by deserialization of untrusted data, letting attackers perform object injection remotely, exploit requires crafted input id: CVE-2026-82222 info: name: GiveWP = 4.16.7.1 - Remote Code Execution author: 0xAkoko,pdteam...