CVE-2026-66666: Insertion of Sensitive Information Into Sent Data

Insertion of Sensitive Information Into Sent Data vulnerability in Automattic WordPress allows Retrieve Embedded Sensitive Data. This issue affects WordPress: from 7.1 through 7.1.2, from 7.0 through 7.0.6, from 6.9 through 6.9.9, from 6.8 through 6.8.10, from 6.7 through 6.7.9, and from 6.6...

CVE-2026-25291: Use After Free

Memory corruption when performing concurrent operations on shared memory page lists due to lack of proper synchronization mechanisms...

CVE-2026-41563: Insertion of Sensitive Information Into Sent Data

Unauthenticated Sensitive Data Exposure in Sitemovr = 1.0.1 versions...

CVE-2026-56952: Missing Authorization

In platformmsghandlerinit of defaultmsghandlers.c, there is a possible permission bypass due to a missing permission check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-32577: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Frontend File Manager = 23.6 versions...

PT-2026-107327

Name of the Vulnerable Software and Affected Versions IBM Langflow OSS versions 1.0.0 through 1.12.2 Description A remote attacker can execute arbitrary code because the code security scanner uses an incomplete blocklist, which fails to prevent all malicious inputs. Recommendations Update IBM...

CVE-2026-57555: Use After Free

Memory Corruption when executing system service routines due to improper handling of user input buffers...

CVE-2026-104385: Insertion of Sensitive Information Into Sent Data

Unauthenticated Sensitive Data Exposure in Groundhogg = 4.8.3 versions...

CVE-2026-95112: Undefined Security Weakness

When processing issue and comment bodies, Gitea scanned the entire preceding text for action keywords such as "closes" or "fixes" once per Markdown link, giving processing time quadratic in the input size. An authenticated user able to submit issue or comment content could send a crafted body of...

CVE-2026-97300: Improper Control of Interaction Frequency

Unauthenticated Broken Access Control in WP Event Solution = 4.1.25 versions...

CVE-2026-57554: Use After Free

Memory Corruption when asynchronous threads access shared performance counter data simultaneously during FastRPC invocations...

CVE-2026-101149: Server-Side Request Forgery (SSRF)

Insufficient validation of OIDC SSO provider configuration could allow a user with specific high privileges to direct requests to arbitrary destinations...

CVE-2026-101157: Improper Neutralization of Input During Web Page Generation

A stored cross-site scripting XSS vulnerability may allow an unauthenticated attacker with adjacent-network access to inject malicious content that executes when an authenticated user views affected content. Successful exploitation may allow the attacker to compromise the victim's authenticated...

CVE-2026-98340: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: only group hidden BSSes with beacon entries When a probe response for an unknown BSS comes in, cfg80211bssupdate looks for an existing entry with the same BSSID and a hidden zero-length or NUL-filled SSID, and if ...

CVE-2025-8352: Allocation of Resources Without Limits or Throttling

Allocation of resources without limits or throttling vulnerability in ESET PROTECT On-Prem increased resource consumption CPU and RAM, leading to conditions for a Denial-of-Service attack...

stream-json: JSONC parser and verifier re-scan the whole accumulated comment on every input chunk

Summary The JSONC parser stream-json/jsonc/parser.js and verifier stream-json/jsonc/verifier.js scan a comment for its terminator starting from the comment's opening / on every input chunk. When a comment doesn't finish inside the current buffer, the scanner returns the comment's start offset and...

nuclei-templates v10.5.0

Nuclei Templates Community curated list of templates for the nuclei engine to find security vulnerabilities in applications. Documentation • Contributions • Discussion • Community • FAQs • Join Discord Templates are the core of the nuclei scanner which powers the actual scanning engine. This...

CVE-2021-44228-POC

CVE-2021-44228-POC exploit CVE-2021-44228 download nuclei sudo cp nuclei /usr/bin/nuclei sudo chmod +x /usr/bin/nuclei git clone https://github.com/sec13b/CVE-2021-44228-POC.git mv CVE-2021-44228-POC log4shellexploit mkdir yaml mv .yaml yaml/ run: python3 log4shellexploit.py http://iptoexploit...

trackem

trackem Passive Device Tracker AndroidTrackEm Mobile is a real-time, passive Wi-Fi + Bluetooth LE probe-request scanner designed for OSINT, red-team ops, and wireless research.It listens for client devices phones, laptops, IoT that are actively broadcasting the names of Wi-Fi networks...

Freak-Scanner

Freak-Scanner Multithreaded Python FREAK scanner, used to detect SSL EXP Ciphers, vulnerable to CVE-2015-0204 It's pretty quick, should be able to scan just shy of 1k hosts in an hour. The output is messy though, you'll have to grep on Vulnerable/NotVulnerable I'll try to clean this up later if...