cve-2026-9082-drupal-postgresql-rce

CVE-2026-9082 Drupal PostgreSQL SQLi to RCE This repository contains a local lab and a short exploit for the Drupal JSON:API PostgreSQL SQL injection described in the Ambionics article. The important part of the exploit is the PostgreSQL escalation: once the injection can evaluate a SELECT...

CVE-2026-43499-T807D

T807D Final Artifacts — Source One-to-One Correspondence Recovery Package Generated: 2026-08-08 Conclusion This directory has organized the complete popsicle source tree, necessary header files, embedded su payload, production binaries, and runtime scripts that can be recovered from the current...

cve-2025-4664

CVE-2025-4664 This repository contains a PoC for exploiting CVE-2025-4664, a vulnerability where Chromium-based browsers leak sensitive URL parameters through Link header preload requests. Resources For a detailed explanation of how this exploit works, read the blog post:...

CVE-2025-13401-XSS-Stored

Proof of Concept: Stored XSS in Autoptimize tags for images found in the content when image optimization or preloading is enabled. In version 3.1.13, the function uses a "blacklist" approach via pregreplace to remove specific attributes like title, alt, class, id, width, and height from the...

CVE-2026-111737

The Speed Optimizer WordPress plugin in versions before 7.8.5 is vulnerable to a Stored Cross-Site Scripting (XSS) attack. The root cause is the failure to properly sanitise or escape specific settings before they are outputted in the head section of front-end pages. This flaw allows high-privile...

CVE-2026-111737 Speed Optimizer < 7.8.5 - Admin+ Stored XSS via DNS Prefetch and Font Preload URL Lists

The Speed Optimizer WordPress plugin before 7.8.5 does not sanitise or escape some of its settings before outputting them in the head of front-end pages, which could allow high-privilege users such as admins to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is...

Astra Linux – Vulnerability in Chromium

Missing authorization in the Preload feature of Google Chrome before version 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass web origin policies through a crafted HTML page. Chromium security severity: Low...

Astra Linux – Vulnerability in Chromium

Incorrect reference resolution in the Preload mechanism in Google Chrome prior to version 152.0.7977.65 allowed a remote attacker to bypass web origin policies through a crafted HTML page. Chromium security severity: Medium...

Preload Component Protected Information Access

The Preload component vulnerability in Google Chrome and Microsoft Edge web browsers is related to the use of a name with an incorrect reference. Exploitation of this vulnerability may allow a remote attacker to gain access to protected information via a specially crafted HTML page...

Preload Component Protected Information Access

The Preload component vulnerability in Google Chrome and Microsoft Edge web browsers is related to authorization errors. Exploitation of this vulnerability may allow a remote attacker to gain access to protected information via a specially crafted HTML page...

Preload Component Protected Information Access

The Preload component vulnerability in Google Chrome and Microsoft Edge web browsers is related to information disclosure in an unprotected data area. Exploitation of this vulnerability may allow a remote attacker to gain access to protected information via a specially crafted HTML page...

Preload Component Protected Information Access

The Preload component vulnerability in Google Chrome and Microsoft Edge web browsers is related to authorization errors. Exploitation of this vulnerability may allow a remote attacker to gain access to protected information via a specially crafted HTML page...

Preload Component Protected Information Access

The Preload component vulnerability in Google Chrome and Microsoft Edge web browsers is related to insufficient validation of user-supplied protected information. Exploitation of this vulnerability may allow a remote attacker to gain access to protected information via a specially crafted HTML pa...

CVE-2026-104848

The Tinypool minimal Node.js worker thread pool implementation is vulnerable to a Prototype Pollution gadget in versions prior to 2.1.1 . The root cause is located in dist/index.js, where the software constructs ThreadPool.options from a normal options object and reads execArgv and env worker opt...

CVE-2026-102677

A flaw was found in Electron. The cache mechanism for sandboxed preload scripts fails to verify that cached entries match the requested script. In applications that load untrusted web content, an attacker with a compromised renderer process can write malicious data into the cache to be reused on...

CVE-2026-102677

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. From 42.3.3 until 42.10.0, 43.5.0, and 44.0.0-beta.6, Electron's sandboxed preload code cache did not verify that a cached entry matched the preload it was served for. A compromised renderer...

GHSA-QMV3-FV6V-RMHQ Electron: Sandboxed preload code cache can be poisoned by a compromised renderer

Impact The cache Electron keeps for sandboxed preload scripts did not verify that a cached entry matched the preload it was served for. A compromised renderer could use this to run its own code in the preload context on a later load. Apps are only affected if they load untrusted content. Apps tha...

Protection Mechanism Failure

Overview org.webjars.npm:electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS. Affected versions of this package are vulnerable to Protection Mechanism Failure via insufficient keying of sandboxed preload script code cache entries, allowi...

NPM: Electron: Sandboxed preload code cache can be poisoned by a compromised renderer

NPM: Electron: Sandboxed preload code cache can be poisoned by a compromised renderer vulnerability discovered by ? in WordPress Npm electron versions = 42.3.3, 42.10.0...

Protection Mechanism Failure

Overview electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS. Affected versions of this package are vulnerable to Protection Mechanism Failure via insufficient keying of sandboxed preload script code cache entries, allowing a renderer...