CVE-2023-26209

CVE-2023-26209 Exploit Automation For Educational Purposes 🚨 📌 Description This is a Python script with a graphical interface Tkinter that allows the user to test automated request submissions to a login endpoint. The goal is to simulate how servers respond to different payload sizes and analyze...

CallStackMasker

CallStackMasker This repository demonstrates a PoC technique for dynamically spoofing call stacks using timers. Prior to our implant sleeping, we can queue up timers to overwrite its call stack with a fake one and then restore the original before resuming execution. Hence, in the same way we can...

CVE-2026-77630

A flaw was found in libupnp. This vulnerability allows a remote, unauthenticated attacker to cause a Denial of Service DoS by submitting requests containing slow or non-responsive hostnames. Because the library performs synchronous network address lookups on attacker-supplied hostnames, worker...

CVE-2026-19621

Mattermost versions 11.10.x = 11.10.0, 11.7.x = 11.7.9, 11.9.x = 11.9.1, 11.8.x = 11.8.5 fail to strip action integration secrets from post payloads before broadcasting post-deletion web socket events and returning thread API responses, which allows an authenticated channel member to obtain...

EUVD-2026-102743

Mattermost versions 11.10.x = 11.10.0, 11.7.x = 11.7.9, 11.9.x = 11.9.1, 11.8.x = 11.8.5 fail to strip action integration secrets from post payloads before broadcasting post-deletion web socket events and returning thread API responses, which allows an authenticated channel member to obtain...

CVE-2026-19621 Mattermost leaks interactive-message integration secrets to non-admin users via post-deletion events and thread reads

Mattermost versions 11.10.x = 11.10.0, 11.7.x = 11.7.9, 11.9.x = 11.9.1, 11.8.x = 11.8.5 fail to strip action integration secrets from post payloads before broadcasting post-deletion web socket events and returning thread API responses, which allows an authenticated channel member to obtain...

CVE-2026-19621

Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, and 11.8.x

CVE-2026-19621: Exposure of Sensitive Information to an Unauthorized Actor

Mattermost versions 11.10.x = 11.10.0, 11.7.x = 11.7.9, 11.9.x = 11.9.1, 11.8.x = 11.8.5 fail to strip action integration secrets from post payloads before broadcasting post-deletion web socket events and returning thread API responses, which allows an authenticated channel member to obtain...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: ptrace: The logic related to getdumpable has been made slightly more robust. The “dumpability” of a task essentially relates to the memory image of the task—the concept stems from whether the task can generate a core dump or not...

CVE-2026-79831

A heap buffer overflow in HPE NonStop Posix User Threads may allow arbitrary code execution...

CVE-2026-79831

A heap buffer overflow in HPE NonStop Posix User Threads may allow arbitrary code execution . The vulnerability affects the Posix User Threads component, specifically version T1280 - T1280L02^ACG and earlier . HPE has released a fix in version T1280L02^ACH (L24.08 onwards), which does not require...

EUVD-2026-102002

A heap buffer overflow in HPE NonStop Posix User Threads may allow arbitrary code execution...

CVE-2026-79831 HPE NonStop Posix User Threads - Heap buffer overflow vulnerability

A heap buffer overflow in HPE NonStop Posix User Threads may allow arbitrary code execution...

CVE-2026-79831: Heap-based Buffer Overflow

A heap buffer overflow in HPE NonStop Posix User Threads may allow arbitrary code execution...

CVE-2026-102992

A flaw was found in piscina. This vulnerability allows an attacker to achieve arbitrary code execution by leveraging inherited configuration options. The worker pool stores options in a standard object that inherits base JavaScript properties without defining defaults for all sensitive parameters...

CVE-2026-107831

Jivejdon through 5.0 contains a cross-site request forgery vulnerability that allows remote attackers to perform state-changing actions by abusing GET endpoints lacking anti-CSRF tokens. Attackers can lure authenticated users to crafted links targeting /account/protected/delAll,...

CVE-2026-107792

Jivejdon from commit d58a36b0 through commit ee67a65e contains a missing authorization vulnerability in UpdateThreadToForumAction that allows authenticated users to move other users' threads. Attackers can send crafted threadId and forumId values to /message/threadToForum/save to relocate any...

CVE-2026-107792 Jivejdon through commit ee67a65e Missing Authorization via /message/threadToForum/save Thread Move

Jivejdon from commit d58a36b0 through commit ee67a65e contains a missing authorization vulnerability in UpdateThreadToForumAction that allows authenticated users to move other users' threads. Attackers can send crafted threadId and forumId values to /message/threadToForum/save to relocate any...

PT-2026-108265

Name of the Vulnerable Software and Affected Versions Jivejdon versions prior to 5.1 Description Cross-site request forgery CSRF occurs when an attacker tricks an authenticated user into performing unwanted actions. The software allows remote attackers to execute state-changing actions by abusing...

CVE-2026-107792: Missing Authorization

Jivejdon from commit d58a36b0 through commit ee67a65e contains a missing authorization vulnerability in UpdateThreadToForumAction that allows authenticated users to move other users' threads. Attackers can send crafted threadId and forumId values to /message/threadToForum/save to relocate any...