HotelDruid-CVE-2021-42948

CVE-2021-42948 HotelDruid Hotel Management Software v3.0.3 and below was discovered to have exposed session tokens in multiple links via GET parameters, allowing attackers to access user session id's. The session token used to access authenticated pages of the application is passed using GET...

RestroPress 3.0.0-3.2.1 - Authentication Bypass

RestroPress Online Food Ordering System WordPress plugin 3.0.0 to 3.1.9.2 contains an authentication bypass caused by exposure of user private tokens and API data via /wp-json/wp/v2/users endpoint, letting unauthenticated attackers forge JWT tokens and authenticate as other users including...

LottieFiles for Gutenberg <= 3.0.0 - Unauthenticated Settings Disclosure

The LottieFiles – Lottie block for Gutenberg plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.0.0 via the /wp-json/lottiefiles/v1/settings/ REST API endpoint. This makes it possible for unauthenticated attackers to retrieve the site...

MountDev AI MCP Connector <= 1.6.1 - Unauthenticated Admin OAuth Token Exposure

MountDev AI MCP Connector for WordPress mountdev-ai-mcp-connector = 1.6.1 is vulnerable to unauthenticated authorization bypass CWE-862 via its OAuth 2.0 implementation. The plugin exposes a publicly accessible Dynamic Client Registration endpoint /mcp-register at WordPress init-level that allows...

DiscoRape

DiscoRape DiscoRape is a selfbot for Discord written in python3.8 The original repository I forked this from can be found here made by EC-discord Preview 📝 Install/Run pip3 install -r requirements.txt Add your token in data/config.json run by doing python3 selfbot.py or you can Support/Contributi...

CVE-2024-37051

CVE-2024-37051 Analysis Overview CVE-2024-37051 is a vulnerability found in JetBrains' IntelliJ-based IDEs, affecting the GitHub plugin. It allows unauthorized exposure of GitHub access tokens when a malicious pull request PR is loaded. Technical Details The vulnerability occurs during the...

CVE-2025-11749

CVE-2025-11749 AI Engine = 3.1.3 - Unauthenticated Sensitive Information Exposure to Privilege Escalation ⚠️ AI Engine = 3.1.3 — Unauthenticated Sensitive Information Exposure → Privilege Escalation GitHub: Nxploited Telegram: @KNxploited IMPORTANT NOTICE: Many unethical individuals attempt to...

CVE-2026-5514

The IBM Bob IDE (version 2.0.3 ) is vulnerable to an information disclosure flaw (CWE-200) where the authentication provider API exposes session tokens. Specifically, during account enumeration, the token is leaked in the account identifier field without requiring explicit user consent. This allo...

citrix_bleed_2

Citrix Bleed 2 PoC Scanner CVE-2025-5777 This script is a Proof-of-Concept PoC scanner for the hypothetical vulnerability "Citrix Bleed 2" CVE-2025-5777. It is designed to detect potential memory leaks from Citrix ADC devices by sending oversized requests and analyzing the responses for sensitive...

WordPress AI Engine Plugin - Token Exposure

Unauthenticated sensitive information exposure in AI Engine WordPress plugin = 3.1.3 exposes bearer tokens via REST API endpoints when No-Auth URL is enabled. id: CVE-2025-11749 info: name: WordPress AI Engine Plugin - Token Exposure author: 4m3rr0r severity: critical description: | Unauthenticat...

CVE-2026-65820

aeon is a scikit-learn compatible Python library for learning from time series. Prior to version 1.5.0, a GitHub Actions workflow used pullrequesttarget for pre-commit checks on pull requests from forks. In this configuration, fork-controlled code could be checked out and executed in a privileged...

CVE-2026-65820 aeon: Privileged GitHub Actions workflow allowed fork-controlled code execution

aeon is a scikit-learn compatible Python library for learning from time series. Prior to version 1.5.0, a GitHub Actions workflow used pullrequesttarget for pre-commit checks on pull requests from forks. In this configuration, fork-controlled code could be checked out and executed in a privileged...

CVE-2026-65820

The aeon Python library (a scikit-learn compatible library for time series) is vulnerable in versions prior to 1.5.0 . A GitHub Actions workflow utilized pull_request_target for pre-commit checks, allowing code from malicious forks to be executed in a privileged context . This configuration could...

CVE-2026-65820 aeon: Privileged GitHub Actions workflow allowed fork-controlled code execution

aeon is a scikit-learn compatible Python library for learning from time series. Prior to version 1.5.0, a GitHub Actions workflow used pullrequesttarget for pre-commit checks on pull requests from forks. In this configuration, fork-controlled code could be checked out and executed in a privileged...

EUVD-2026-123767

aeon is a scikit-learn compatible Python library for learning from time series. Prior to version 1.5.0, a GitHub Actions workflow used pullrequesttarget for pre-commit checks on pull requests from forks. In this configuration, fork-controlled code could be checked out and executed in a privileged...

CVE-2026-65820

aeon is a scikit-learn compatible Python library for learning from time series. Prior to version 1.5.0, a GitHub Actions workflow used pullrequesttarget for pre-commit checks on pull requests from forks. In this configuration, fork-controlled code could be checked out and executed in a privileged...

CVE-2026-65820: aeon-toolkit aeon: aeon is a scikit-learn compatible Python library for learning from time series

aeon is a scikit-learn compatible Python library for learning from time series. Prior to version 1.5.0, a GitHub Actions workflow used pullrequesttarget for pre-commit checks on pull requests from forks. In this configuration, fork-controlled code could be checked out and executed in a privileged...

PT-2026-145654

This module enables you to accept online payments on your website using Mollie. In some cases the Mollie secret token can be exposed. This vulnerability is mitigated by the fact that the mollie webform submodule must be enabled...

PT-2026-145304

aeon is a scikit-learn compatible Python library for learning from time series. Prior to version 1.5.0, a GitHub Actions workflow used pull request target for pre-commit checks on pull requests from forks. In this configuration, fork-controlled code could be checked out and executed in a privileg...

CVE-2026-123512 Vikunja before 2.7.1 Sensitive Token Exposure via URL Query in Access Logs

Vikunja before 2.7.1 embeds live password-reset, email-confirmation and account-deletion tokens in the URL query string of emailed links, so the full request URI, including the token, is written to Vikunja's HTTP access log and any reverse-proxy logs when a user clicks the link. Attackers with re...