Hikvision IP Camera - webLanguage Command Injection (CVE-2021-36260)

Exploits CVE-2021-36260 by injecting OS commands into PUT /SDK/webLanguage, writing stdout under webLib/ and reading it back. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """Hikvision IP camera unauthenticated RCE CVE-2021-36260 — opens execute session.""" impor...

PT-2026-69732

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the airoha ppe deinit function. The function replaces the NPU pointer with NULL using rcu replace pointer but fails to wait for existing RCU readers to...

PT-2026-69577

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free bug exists in the tracing component. The issue occurs because the module refcount is released immediately while the freeing of enable event data is handled via the priva...

PT-2026-69821

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the put prev task scx function where a warning is incorrectly triggered when a runnable task drops to a lower sched class without SCX OPS ENQ LAST. This occurs because...

PT-2026-69642

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A NULL dereference occurs in the IOCTL path when a sched engine allocation fails. This happens because intel context put is called before intel context init within the execlists create...

CVE-2025-15682: Allocation of Resources Without Limits or Throttling

TBEA TLogger V2.1.0.0B0.0.0.0 contains an unauthenticated resource exhaustion vulnerability in its web server. An unauthenticated remote attacker can send PUT requests to the /tmp/ endpoint, causing the web server to create persistent files containing attacker-controlled data under...

PT-2026-69929

Name of the Vulnerable Software and Affected Versions TBEA TLogger version 2.1.0.0B0.0.0.0 Description The web server contains a resource exhaustion issue where an unauthenticated remote attacker can send PUT requests to the '/tmp/' endpoint. This action causes the server to create persistent fil...

PT-2026-69522

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A reference count leak occurs in the ovpn module during TCP RX or TX error paths. When ovpn peer hold is called followed by schedule work for the peer-tcp.defer del work item, a race...

KVM ARM64 vGIC-ITS Guest Escape (CVE-2026-46316)

Runs the ITScape PoC vgicitsinvalidatecache double-put UAF on a KVM/arm64 hypervisor host via /dev/kvm. Default payload starts a reverse TCP shell as root on the host new KittySploit session. Marker-only mode creates /ITScape for lab verification. !/usr/bin/env python3 -- coding: utf-8 --...

CVE-2026-48086

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.2, a TENANTADMIN promotes themselves to platform-wide GLOBALADMIN through a single PUT request. The role-update handler accepts the GLOBALADMIN enum value from any tena...

CVE-2026-48086

OpenReception’s appointment-booking software (pre‑1.0.2) allows a TENANT_ADMIN to promote themselves to GLOBAL_ADMIN via a single PUT to the role-update handler. The handler accepts GLOBAL_ADMIN from any tenant admin updating their own staff, with no policy enforcing that only an existing GLOBAL_...

CVE-2026-48086 OpenReception: Tenant admin self-promotes to GLOBAL_ADMIN

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.2, a TENANTADMIN promotes themselves to platform-wide GLOBALADMIN through a single PUT request. The role-update handler accepts the GLOBALADMIN enum value from any tena...

Linux kernel uacce_put_queue uacce_fops_unl_ioctl Data Compromise

The vulnerabilities of the functions uacceputqueue and uaccefopsunlioctl in the drivers/misc/uacce/uacce.c module of the Linux kernel are related to state management errors. Exploiting these vulnerabilities can allow attackers to compromise the confidentiality, integrity, and accessibility of...

Exploit for Path Traversal in Gogs

CVE-2025-8110 – Gogs ≤ 0.13.3 RCE PoC Proof-of-Concept for...

CVE-2026-70617 Spacebar Server Missing Authorization via Group DM Recipient Endpoint

Spacebar Server before commit dcfd910 contains a missing authorization vulnerability that allows any authenticated attacker to add themselves to arbitrary group DM channels by sending a PUT request to the channels recipient endpoint without membership verification. Attackers can exploit the...

CVE-2026-64580

In the Linux kernel, the following vulnerability has been resolved: xfrm6: clear dst.dev on error to avoid double netdevput in xfrm6filldst On the error path where in6devgetdev returns NULL, xfrm6filldst releases the device reference with netdevput but leaves xdst-u.dst.dev set. dstdestroy later...

CVE-2026-64580 xfrm6: clear dst.dev on error to avoid double netdev_put in xfrm6_fill_dst()

In the Linux kernel, the following vulnerability has been resolved: xfrm6: clear dst.dev on error to avoid double netdevput in xfrm6filldst On the error path where in6devgetdev returns NULL, xfrm6filldst releases the device reference with netdevput but leaves xdst-u.dst.dev set. dstdestroy later...

CVE-2026-71214 NASA-AMMOS plandev - Client-Supplied session_variables Bypass Hasura-Origin Authorization in sequencing-server

The Aerie/PlanDev sequencing-server's authorization middleware sequencing-server/src/app.ts derives the caller's Hasura session role via getHasuraSession, which prefers a sessionvariables object taken directly from the client-supplied JSON request body over the Authorization header's JWT claims,...

CVE-2026-71214

The Aerie/PlanDev sequencing-server's authorization middleware sequencing-server/src/app.ts derives the caller's Hasura session role via getHasuraSession, which prefers a sessionvariables object taken directly from the client-supplied JSON request body over the Authorization header's JWT claims,...

UBUNTU-CVE-2026-71191

In OpenStack Swift through 2.38.0, S3API middleware does not enforce that semantic x-amz- headers are covered by the SigV4 signature on presigned URL requests. An attacker who obtains a presigned PUT URL can inject an unsigned X-Amz-Copy-Source header, causing Swift to perform a server-side copy...