PT-2026-102871

🚨 CVE-2026-76727 Command injection vulnerabilities exist in the affected interface of HPE Networking Instant ON that could allow an authenticated remote attacker with high privileges to perform command injection. Successful exploitation could allow an attacker to execute arbitrary commands as a...

SUSE CVE-2026-97476

In the Linux kernel, the following vulnerability has been resolved: rds: filter RDSINFO getsockopt by caller's netns The RDSINFO family of getsockopt2 options reads several file-scope global lists that are not per-netns: rdssockinfo / rds6sockinfo, rdssockincinfo / rds6sockincinfo - rdssocklist...

CVE-2024-4898-Poc

CVE-2024-4898-Poc CVE-2024-4898 InstaWP Connect – 1-клик WP Staging & Migration = 0.1.0.38 - Отсутствие авторизации для неаутентифицированной настройки API/Обновление произвольных опций/Создание административного пользователя...

CVE-2021-41091

CVE-2021-41091 Un bug dans Moby Docker Engine permet aux utilisateurs non privilégiés de traverser les répertoires et d'exécuter des programmes directement depuis le docker sur la machine hôte. Si un programme suid existe dans le docker, l'utilisateur pourra l'exécuter en tant que suid sur la...

CVE-2026-102365 mall4j through 4.0 Missing Authorization in Admin User Address Endpoints

mall4j through 4.0 fails to enforce authorization checks on GET endpoints in UserAddrController that retrieve customer address data. Authenticated attackers can call /user/addr/page and /user/addr/info endpoints to harvest all customer addresses including names, phone numbers, and postal...

CVE-2026-102361 mall4j through 4.0 Missing Authentication in Password Update Endpoint

mall4j through 4.0 contains a missing authentication vulnerability in the PUT /user/updatePwd endpoint that allows unauthenticated attackers to reset any storefront account password. Attackers can supply a target username in the request body to overwrite passwords without verification, enabling...

CVE-2026-102361 mall4j through 4.0 Missing Authentication in Password Update Endpoint

mall4j through 4.0 contains a missing authentication vulnerability in the PUT /user/updatePwd endpoint that allows unauthenticated attackers to reset any storefront account password. Attackers can supply a target username in the request body to overwrite passwords without verification, enabling...

CVE-2026-102361

The mall4j software, version through 4.0 , is vulnerable to a missing authentication flaw in the PUT /user/updatePwd endpoint. This vulnerability allows unauthenticated attackers to reset the password of any storefront account by providing a target username in the request body without verificatio...

CVE-2026-24061-setup

Mise en place de CVE-2026-24061 Ce dépôt contient la configuration Docker pour CVE-2026-24061. Une fois Docker installé, procédez simplement comme suit : 1. Clonez ce dépôt. 2. Exécutez la commande suivante : sudo docker build . --tag telnetd-auth-bypass 3. Une fois l’image Docker construite, nou...

CVE-2025-64446-Exploit

CVE-2025-64446-Эксплойт Эксплойт CVE-2025-64446 для FortiWeb WAF. С помощью этого эксплойта вы можете создать пользователя и пароль. Как запускать? python3 exploitforti.py targets.txt python3 exploitforti.py 192.168.1.1 python3 exploitforti.py 192.168.1.1:8443 python3 exploitforti.py...

CVE-2026-11961

CVE-2026-11961 Mass Exploit инструмент для CVE-2026-11961 , затрагивающий плагин WordPress User Registration & Membership. Возможности Определение версии плагина Поддержка одиночной цели Обработка пакета целей Многопоточная поддержка Случайные или пользовательские учётные данные Поддержка...

DNS-Mayhem-CVE-2026-41096-Deep-Dive

DNS-Mayhem-CVE-2026-41096-Deep-Dive Углубленный технический анализ CVE‑2026‑41096, критического переполнения кучи в Windows DNSAPI.dll, позволяющего удаленное выполнение кода через поддельные DNS-ответы. Включает векторы атак, анализ патча и рекомендации по защите для команд безопасности. Обзор...

CVE-2026-24061-POC

CVE-2026-24061 - Обход аутентификации в telnetd PoC Критический обход аутентификации в telnetd, приводящий к выполнению кода с правами root Затрагивает системы с версиями telnetd, содержащими уязвимость, начиная с 2015 года О уязвимости Данный PoC демонстрирует CVE-2026-24061 — критическую...

CVE-2026-97547

A flaw was found in the Linux kernel's XFS file system. When exchanging file ranges between files that share storage blocks reflinks, a local user can trigger a condition where the system prematurely clears copy-on-write protection flags from a file that still retains shared data blocks...

CVE-2024-22274

CVE-2024-22274 Exécutez et saisissez l'ip de l'hôte, le port, le nom d'utilisateur et le mot de passe. L'exploit créera l'utilisateur NinhPwn avec le mot de passe "NinhPwn123" puis lancera ssh avec un shell root. Correction des paquets d'installation python3 : pip install pwinput, pip install...

CVE-2021-40223

CVE-2021-40223 Application : Rittal CMC PU III Web management Périphériques : CMC PU III 7030.000 Révision logicielle : V3.11.002 Révision matérielle : V3.00 Type d'attaque : XSS stocké Solution : Mettre à jour vers la révision logicielle V3.17.10 ou ultérieure Résumé : L'application web ne...

CVE-2026-98021

A flaw was found in the Linux kernel. A local user can cause a Denial of Service DoS by triggering excessive memory consumption on the host. When creating or updating network interfaces through the routing netlink rtnetlink interface, the kernel fails to validate and enforce maximum limits on the...

CVE-2026-98035

A flaw was found in the Linux kernel's BPF subsystem. When updating or deleting elements in resizable hash tables, the kernel directly releases special object fields rather than safely deferring their cancellation, which is not safe when running in Non-Maskable Interrupt NMI context. A local user...

CVE-2026-101093

Cotonti through 1.0.0 contains a cross-site request forgery vulnerability in admin.users.php that allows attackers to delete user groups without token verification. Attackers can craft malicious links or pages that trick authenticated administrators into deleting custom groups and their associate...

CVE-2026-101093 Cotonti through 1.0.0 Cross-Site Request Forgery via User Group Deletion

Cotonti through 1.0.0 contains a cross-site request forgery vulnerability in admin.users.php that allows attackers to delete user groups without token verification. Attackers can craft malicious links or pages that trick authenticated administrators into deleting custom groups and their associate...