EUVD-2026-94738

linuxserver Heimdall through 2.8.3 applies its SafeUrlFetcher SSRF protection mechanism only to ItemController; the enhanced-application test and live-stats requests occur via SupportedApps::execute, a GuzzleHttp client that lacks IP address restrictions. In some realistic installations, the POST...

CVE-2026-107449

linuxserver Heimdall through 2.8.3 applies its SafeUrlFetcher SSRF protection mechanism only to ItemController; the enhanced-application test and live-stats requests occur via SupportedApps::execute, a GuzzleHttp client that lacks IP address restrictions. In some realistic installations, the POST...

CVE-2026-87685

An arbitrary file manipulation vulnerability exists in the WebTools management interface of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. When processing configuration transfer requests, the application fails to properly validate and sanitize a user-supplied status file pa...

CVE-2026-87685

An arbitrary file manipulation vulnerability exists in the WebTools management interface of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. When processing configuration transfer requests, the application fails to properly validate and sanitize a user-supplied status file pa...

CVE-2024-40725

Herramienta de Detección de HTTP Request Smuggling Este repositorio contiene una herramienta basada en Python para detectar vulnerabilidades de HTTP Request Smuggling, dirigida específicamente a CVE-2024-40725. La herramienta intenta explotar esta vulnerabilidad en el servidor HTTP Apache enviand...

USTP-Secure

USTP USTP means UDP Speedy Transmission Protocol. USTP keeps the same authenticated transport model, but the project name is now simply USTP again. By default, USTP uses AEAD for DATA. It also supports an optional negotiated cleartext + HMAC mode for DATA, where payload bytes are visible on the...

CVE-2025-25257

Fortinet FortiWeb CVE-2025-25257 Vulnerability Tester Description This PowerShell script is designed for authorized penetration testing purposes only. It tests Fortinet FortiWeb appliances for CVE-2025-25257, an unauthenticated SQL injection vulnerability in the /api/fabric/device/status endpoint...

EUVD-2026-94195

The Nexi XPay Build WordPress plugin through 7.6.2 does not verify the payment result supplied to several of its unauthenticated routes, allowing attackers to mark arbitrary orders as paid or failed, to cancel them, and to obtain order keys which expose guest buyers' details...

PT-2026-107418

The Nexi XPay Build WordPress plugin through 7.6.2 does not correctly validate the security token on its payment notification route, accepting the request when the target order has no stored token, which allows unauthenticated attackers to mark arbitrary orders as paid, or to mark genuinely paid...

CVE-2020-5839

CVE-2020-5839 CVE-2020-5839 POC Symantec EDR on-prem versione precedente alla "4.4.0" è soggetto a una vulnerabilità di divulgazione di informazioni tramite i seguenti URL: https://@IPEDR/r3epmpi/status/ https://@IPEDR/r3epmpi/status/routes https://@IPEDR/r3epmpi/v1/event/status/ds...

WordPress elegro Crypto Payment plugin <= 1.0.1 - Unauthenticated Arbitrary Order Status Change vulnerability

Unauthenticated Arbitrary Order Status Change vulnerability discovered by JunHee CHO in WordPress Plugin elegro Crypto Payment versions = 1.0.1...

ROOT-OS-DEBIAN-11-CVE-2026-34002 CVE-2026-34002 in xorg-server - Patched by Root

Root has patched CVE-2026-34002 in the xorg-server package for Root:Debian:11. Multiple fixed versions available...

CVE-2026-98275 net: ethernet: cortina: Ack RX overrun interrupt correctly

In the Linux kernel, the following vulnerability has been resolved: net: ethernet: cortina: Ack RX overrun interrupt correctly The RX overrun interrupt is reported in interrupt status register 4, but gmacirq acknowledges it using the RX descriptor error bit from status register 0. For GMAC0 this...

CVE-2026-94271

The Deema Payment Gateway WordPress plugin through 1.1.2 does not verify the payment with the payment provider when handling the return from the hosted checkout, and does not check the payment status or amount, allowing unauthenticated users to have orders marked as paid without any payment being...

CVE-2026-89289 Fast Courier <= 5.2.3 - Unauthenticated Order Fulfillment Update via order-status-update REST Endpoint

The Fast Courier WordPress plugin through 5.2.3 does not restrict an unauthenticated REST route that writes order fulfillment data, allowing unauthenticated attackers to overwrite the courier status and customer-facing tracking details of any WooCommerce order by supplying its id...

CVE-2026-89289

The Fast Courier WordPress plugin (versions

CVE-2026-89289 Fast Courier <= 5.2.3 - Unauthenticated Order Fulfillment Update via order-status-update REST Endpoint

The Fast Courier WordPress plugin through 5.2.3 does not restrict an unauthenticated REST route that writes order fulfillment data, allowing unauthenticated attackers to overwrite the courier status and customer-facing tracking details of any WooCommerce order by supplying its id...

CVE-2026-94299

The elegro Crypto Payment WordPress plugin versions through 1.0.1 is vulnerable to an unauthenticated arbitrary order status change via IPN callback. The root cause is a failure to require a shared secret for validating incoming payment notification requests. If the secret remains at its default ...

CVE-2026-94299 elegro Crypto Payment <= 1.0.1 - Unauthenticated Arbitrary Order Status Change via IPN Callback

The elegro Crypto Payment WordPress plugin through 1.0.1 does not require a shared secret to be configured before trusting incoming payment notification requests, allowing unauthenticated attackers to forge payment confirmations and change the status of arbitrary orders on any installation where...

CVE-2026-94299 elegro Crypto Payment <= 1.0.1 - Unauthenticated Arbitrary Order Status Change via IPN Callback

The elegro Crypto Payment WordPress plugin through 1.0.1 does not require a shared secret to be configured before trusting incoming payment notification requests, allowing unauthenticated attackers to forge payment confirmations and change the status of arbitrary orders on any installation where...