CVE-2026-88930 Social Web Suite <= 4.1.12 - Unauthenticated Blind SQLi via Unset Shared Secret

The Social Web Suite WordPress plugin through 4.1.12 does not require its shared secret to be set before accepting requests authorised by it, and does not sanitise and escape a parameter before using it in an SQL statement, allowing unauthenticated users to perform SQL injection attacks...

CVE-2026-88930

The Social Web Suite WordPress plugin through 4.1.12 does not require its shared secret to be set before accepting requests authorised by it, and does not sanitise and escape a parameter before using it in an SQL statement, allowing unauthenticated users to perform SQL injection attacks...

nat-tunnel

NAT Tunnel v0.01 Если у вас есть доступ к серверу с публичным IP-адресом и нефильтрованными портами, вы можете запустить сервер NAT Tunnel NT на сервере, а NT-клиент на вашей машине за NAT. Сервер требует 2 открытых порта: один для связи с NT-клиентом --admin, другой для подключения обычных...

CVE-2024-47533-Cobbler-XMLRPC-Authentication-Bypass-RCE-Exploit-POC

CVE-2024-47533 - Cobbler XMLRPC 인증 우회 RCE 익스플로잇 ⚠️ 인증 우회를 통한 Cobbler의 치명적인 원격 코드 실행 🛠️ @dollarboysushil의 PoC 구현 💡 개요 Cobbler는 네트워크 설치 환경의 신속한 설정을 가능하게 하는 Linux 설치 서버로, 버전 3.0.0에서 3.2.3 미만 및 3.3.7 미만의 버전에 인증 취약점이 있습니다. utils.getsharedsecret 함수는 항상 -1을 반환하므로, 누구나 빈 사용자 이름''과 비밀번호 -1로 Cobbler XML-RPC...

CVE-2026-88931

The Social Web Suite WordPress plugin through 4.1.12 does not restrict which of its settings may be written through an unauthenticated endpoint, allowing attackers to overwrite arbitrary Social Web Suite WordPress plugin through 4.1.12 options, including the shared secret that guards its own...

EUVD-2026-95504

The Social Web Suite WordPress plugin through 4.1.12 does not restrict which of its settings may be written through an unauthenticated endpoint, allowing attackers to overwrite arbitrary Social Web Suite WordPress plugin through 4.1.12 options, including the shared secret that guards its own...

CVE-2026-88931

The Social Web Suite WordPress plugin (versions through 4.1.12 ) is vulnerable to an unauthenticated arbitrary plugin settings update . The root cause is a failure to restrict which settings can be modified via an unauthenticated endpoint. This allows an attacker to overwrite arbitrary plugin opt...

Exploit for Improper Authentication in Influxdata Influxdb

InfluxDB Empty JWT Secret Authentication Bypass CVE-2019-2093...

CVE-2024-47533

CVE-2024-47533 - Cobbler XMLRPC 인증 우회 RCE 익스플로잇 Cobbler 인증 우회를 통한 중요 원격 코드 실행 PoC 구현. 요약 Cobbler는 네트워크 설치 환경을 신속하게 설정할 수 있는 Linux 설치 서버로, 버전 3.0.0부터 3.2.3 미만 및 3.3.7 미만에서 인증 취약점이 있습니다. utils.getsharedsecret 함수는 항상 -1을 반환하여, 누구나 빈 사용자 이름''과 비밀번호 -1로 Cobbler XML-RPC 인터페이스에 연결할 수 있습니다. 이로 인해 네트워크 접근...

Russh: Missing X25519 zero-point validation in hybrid ML-KEM key exchange

Vulnerability The hybrid ML-KEM 768 + X25519 key exchange implementation in russh/src/kex/hybridmlkem.rs does not validate that the remote peer's X25519 public key is not the zero point all-zero 32-byte value. This allows a remote peer to force the X25519 contribution to the combined shared secre...

CVE-2026-102824

Russh is a Rust SSH client and server library. Prior to 0.63.0, the hybrid ML-KEM 768 and X25519 implementation in russh/src/kex/hybridmlkem.rs accepts an all-zero 32-byte peer X25519 public key in both serverdh and computesharedsecret, forcing the X25519 contribution to the combined shared secre...

CVE-2026-102824

Russh is a Rust SSH client and server library. Prior to 0.63.0, the hybrid ML-KEM 768 and X25519 implementation in russh/src/kex/hybridmlkem.rs accepts an all-zero 32-byte peer X25519 public key in both serverdh and computesharedsecret, forcing the X25519 contribution to the combined shared secre...

PT-2026-102808

Name of the Vulnerable Software and Affected Versions Russh versions prior to 0.63.0 Description The hybrid ML-KEM 768 and X25519 implementation in russh/src/kex/hybrid mlkem.rs accepts an all-zero 32-byte peer X25519 public key within the server dh and compute shared secret functions. This allow...

CVE-2026-100543

The OpenClaw npm package (version openclaw before 2026.8.1 ) is vulnerable to information disclosure because it includes deterministic hashes computed over original, unredacted configurations within redacted configuration responses. If the Gateway password has low entropy and other configuration ...

CVE-2026-100543: Exposure of Sensitive Information to an Unauthorized Actor

OpenClaw npm package openclaw before 2026.8.1 could include deterministic hashes computed over the original, unredacted configuration in redacted configuration responses. When the Gateway password had low entropy and the remaining configuration values were reconstructable, these hashes acted as...

CVE-2026-82195

The 10Web Booster WordPress plugin before 2.34.0 does not restrict access to the routine which issues the shared secret that authenticates its cloud connection, disclosing that secret to unauthenticated visitors and letting them delete it repeatedly, preventing an administrator from completing a...

PT-2026-97708

Name of the Vulnerable Software and Affected Versions 10Web Booster versions prior to 2.34.0 Description The plugin fails to restrict access to the routine responsible for issuing the shared secret used to authenticate cloud connections. This allows unauthenticated visitors to disclose the secret...

CVE-2026-82195: Missing Authorization

The 10Web Booster WordPress plugin before 2.34.0 does not restrict access to the routine which issues the shared secret that authenticates its cloud connection, disclosing that secret to unauthenticated visitors and letting them delete it repeatedly, preventing an administrator from completing a...

PT-2026-94956

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the hardware Elliptic Curve Diffie-Hellman ECDH path within the atmel ecdh compute shared secret function. The function uses a private key stored in the device, but th...

CVE-2026-87854

The Subscriptions for WooCommerce WordPress plugin before 2.0.3 does not correctly validate the shared secret protecting one of its REST endpoints, allowing unauthenticated users to retrieve the store's full list of subscriptions, including customer usernames, product names, recurring amounts and...