EUVD-2026-118760

IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to forge audit records due to improper output neutralization for logs...

CVE-2026-17377

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 are affected by multiple vulnerabilities. A remote authenticated attacker could forge audit records due to improper output neutralization for logs (CWE-117). This flaw allows for the manipulation of log integrity. N...

CVE-2026-120677

The Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 4.2.18 due to insufficient input sanitization and output escaping. This...

Tarmageddon-CVE-2025-62518-

Tarmageddon CVE-2025-62518 Video: https://youtu.be/EYBB4BHsp9E Repo directories vulnerable-extract minimal repoducible example, takes a path as arg, and extracts that file to ./output malicious-payload creates a simple malicious.tar archive with some example of smuggled content, comments explain...

EUVD-2026-118603

The Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 4.2.18 due to insufficient input sanitization and output escaping. This...

CVE-2026-120677

The Optimole WordPress plugin (versions up to and including 4.2.18 ) is vulnerable to Unauthenticated Stored Cross-Site Scripting (XSS) . The root cause is insufficient input sanitization and output escaping of the comment parameter. This allows an unauthenticated attacker to inject arbitrary web...

CVE-2026-120677 Optimole <= 4.2.18 - Unauthenticated Stored Cross-Site Scripting via Comment Content

The Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 4.2.18 due to insufficient input sanitization and output escaping. This...

CVE-2026-119070

The Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 4.2.17 due to insufficient input sanitization and output escaping. This...

VulnFanatic-NG

VulnFanatic-NG LLM-assisted vulnerability research for Binary Ninja. VulnFanatic-NG adds a sidebar panel that scans the current binary and asks an LLM — a locally hosted OpenAI-compatible model by default, or Anthropic Claude, Google Gemini, or Azure OpenAI see LLM backends — to judge whether...

pythia-sql-clairvoyance

Production-ready SQL injection scanner with 6 detection methods, AI-powered remediation, SARIF output, and CI/CD integration. Quick Start · Documentation · Docker · AI Analysis · Star on GitHub In Action Live scan · PHP vulnerable shop · 11 findings detected · safe mode · 2265.56s !Pythia — HTML...

EUVD-2026-118552

The Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 4.2.17 due to insufficient input sanitization and output escaping. This...

EUVD-2026-118548

The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wdformelement Hidden Input field, name = user-defined, e.g. hiddenprobe' parameter in all versions up to, and including, 1.15.50 due to insufficien...

CVE-2021-44228

CVE-2021-44228 checker This is the repository for checking for vulnerability CVE-2021-44228. This is a PoC that only displays strings without any external class loading. It cannot be used for arbitrary code execution. How it works? Step 1: Run the server application The image...

permanently-jailbroken

Permanently Jailbroken We asked GPT-4, Claude, Gemini, DeepSeek, Grok, and Mistral 5 questions about their own programming. All 6 said jailbreaking will never be fixed. Not because the patches are bad. Because alignment doesn't change what the model understands — it changes what the model says. T...

CVE-2024-10793

CVE-2024-10793 CVE-2024-10793 poc exploit CVE-2024-10793.yaml script is needed to search for a plugin. CVE-2024-10793.sh script is the exploit itself. For post-exploitation, you can use beef-xss. Google dork: inurl:wp-content/plugins/wp-security-audit-log The WP Activity Log plugin for WordPress ...

PT-2026-139439

The Real Testimonials – Testimonial Slider, Collect Customer Reviews and Video Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tpro client testimonial' parameter in all versions up to, and including, 4.1.0 due to insufficient input sanitization and output...

PT-2026-139426

The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '' parameter in all versions up to, and including, 3.6.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

PT-2026-139447

The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'guestsdocuments' Parameter in all versions up to, and including, 1.8.17 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers...

EulerOS Virtualization 2.15.1 : perl-IO-Compress (EulerOS-SA-2026-4781)

According to the versions of the perl-IO-Compress package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : IO::Compress versions before 2.220 for Perl can execute arbitrary code in File::GlobMapper via an attacker-controlled outp...

PT-2026-139443

The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'note form field whose value is written to post meta note' parameter in all versions up to, and including, 3.6.8 due to insufficient input sanitization and output escaping...