39662 matches found
PT-2026-48214
SemCms 5.0 is vulnerable to Cross Site Request Forgery CSRF via crafted POST request to /admin/semcms user.php...
CVE-2026-39170
SemCms 5.0 is vulnerable to Cross Site Request Forgery CSRF via crafted POST request to /admin/semcmsuser.php...
PT-2026-47774
WordPress Insert PHP plugin versions before 3.3.1 contain a PHP code injection vulnerability that allows unauthenticated attackers to execute arbitrary PHP code by injecting malicious shortcodes through the WordPress REST API. Attackers can send POST requests to the wp-json/wp/v2/posts endpoint...
Dell iDRAC Tools 后置链接漏洞
Dell iDRAC Tools are a series of tools developed by the American company Dell for managing and maintaining Dell servers. Versions of Dell iDRAC Tools prior to 11.4.1.0 contained a post-link vulnerability, which stemmed from improper link resolution before file access. This vulnerability could all...
Microsoft Winlogon 后置链接漏洞
Microsoft Winlogon is a component built into the Windows NT series operating system developed by Microsoft. There is a post-release vulnerability in Microsoft Winlogon. Attackers can exploit this vulnerability to gain elevated privileges. The following products and versions are affected: Windows ...
Microsoft Windows Performance Monitor 后置链接漏洞
Microsoft Windows is an operating system used by personal devices by the American company Microsoft. Microsoft Windows has a post-release link vulnerability. Attackers can exploit this vulnerability to gain higher privileges. The following products and versions are affected: Windows 10 Version 18...
Microsoft .NET 后置链接漏洞
Microsoft .NET is a software framework developed by Microsoft Corporation in the United States. It focuses on agile software development, rapid application development, platform independence, and network transparency. There is a post-release vulnerability in Microsoft .NET. Attackers can exploit...
SEMCMS 跨站请求伪造漏洞
SEMCMS is an open-source content management system CMS for foreign trade websites that supports multiple languages. Version SEMCMS 5.0 has a cross-site request forgeing vulnerability, which stems from improper handling of POST requests directed to /admin/semcmsuser.php. This vulnerability may lea...
Microsoft PC Manager 后置链接漏洞
Microsoft PC Manager is a computer management software developed by Microsoft Corporation. It offers features such as one-click acceleration, system space management, pop-up management, and comprehensive health checks. Microsoft PC Manager has a post-release link vulnerability. Attackers can...
MemVenom: Triggered Poisoning of Multimodal Memories in Web Agents
External memory has become a core component of modern web agents, enabling long-horizon reasoning through the retrieval of past experiences. However, this paradigm introduces a critical vulnerability: malicious content injected into memory can be persistently recalled and repeatedly influence age...
PT-2026-47848
Name of the Vulnerable Software and Affected Versions FreeSWITCH versions prior to 1.11.1 Description The mod verto HTTP request handler allocates a fixed 2 MiB buffer for a POST application/x-www-form-urlencoded body but accepts a Content-Length of up to nearly 10 MiB. Because the body-read loop...
cve-2026-41706 - MEDIUM - Open Redirect When Using CookieRequestCache
cve-2026-41706 - MEDIUM - Open Redirect When Using CookieRequestCache...
GHSA-273Q-QGH5-WRJ6 nebula-mesh's web UI lacks CSRF tokens on /ui/* mutating endpoints
Every /ui/ POST / PUT / PATCH / DELETE route processes the request as soon as the session cookie validates. SameSite=Lax on the session cookie prevents most cross-site form submits but does not protect: - top-level form-submit navigations from third-party pages some browsers still send Lax cookie...
nebula-mesh's web UI lacks CSRF tokens on /ui/* mutating endpoints
Every /ui/ POST / PUT / PATCH / DELETE route processes the request as soon as the session cookie validates. SameSite=Lax on the session cookie prevents most cross-site form submits but does not protect: - top-level form-submit navigations from third-party pages some browsers still send Lax cookie...
coruna-postexploit
Coruna Post-Exploitation Framework Overview This is a com...
CVE-2026-44631
creationtimestamp| type| source ---|---|--- 2026-06-08 23:00:40+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mnsrxdvbsz27 2026-06-09 00:51:01+00:00| seen| https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-in-apache-http-server 2026-06-09 12:35:09+00:00| seen|...
CVE-2026-49141
creationtimestamp| type| source ---|---|--- 2026-06-08 21:04:32+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnsledm6gl2f...
CVE-2026-52778
creationtimestamp| type| source ---|---|--- 2026-06-08 20:00:38+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mnshvh27vg2y 2026-06-09 09:12:19+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3mntu5424d22s 2026-07-09 21:42:04+00:00| seen|...
EUVD-2026-35194
WACRM prior to commit 73041bf contain an authorization bypass vulnerability in the automation engine that allows authenticated attackers to access and modify contacts belonging to other tenants by supplying an arbitrary caller-controlled contactid in the POST request body without tenant ownership...
CVE-2026-49141 WACRM Authorization Bypass via Automation Engine Endpoint
WACRM prior to commit 73041bf contain an authorization bypass vulnerability in the automation engine that allows authenticated attackers to access and modify contacts belonging to other tenants by supplying an arbitrary caller-controlled contactid in the POST request body without tenant ownership...