D-Link - Unauthenticated Remote Code Execution

OS command injection vulnerability in soap.cgi soapcgimain in cgibin in D-Link DIR-880L DIR-880LREVAFIRMWAREPATCH1.08B04 and previous versions, DIR-868L DIR868LA1FW112b04 and previous versions, DIR-65L DIR-865LREVAFIRMWAREPATCH1.08.B01 and previous versions, and DIR-860L DIR860LA1FW110b04 and...

PaperCut - Unauthenticated Remote Code Execution

This vulnerability allows remote attackers to bypass authentication on affected installations of PaperCut NG 22.0.5 Build 63914. Authentication is not required to exploit this vulnerability. The specific flaw exists within the SetupCompleted class. The issue results from improper access control. ...

CVE-2026-15980

The MyHome Core WordPress plugin (all versions ≤ 4.4.5) contains an Authentication Bypass caused by missing authorization in the send_link() AJAX handler and improper token validation in the activate() function. Unauthenticated attackers can generate an activation token for an unconfirmed user ac...

EUVD-2026-68149

The MyHome Core plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 4.4.5. This is due to missing authorization in the sendlink AJAX handler and improper token validation in the activate function. This makes it possible for unauthenticated attackers t...

langflow-exploit

CVE-2025-3248 - Langflow कोड सत्यापन एंडपॉइंट RCE Langflow के कोड सत्यापन एंडपॉइंट में रिमोट कोड निष्पादन भेद्यता को प्रदर्शित करने वाला एक प्रूफ-ऑफ-कॉन्सेप्ट एक्सप्लॉइट। यह भेद्यता Langflow के 1.3.0 से पहले के संस्करणों को प्रभावित करती है, जिससे बिना प्रमाणीकरण के हमलावर क्राफ्टेड HTTP अनुरोधों...

EXPLOIT-CVE-2026-9198

CVE-2026-9198 — IBM Langflow OSS RCE Não Autenticado Prova de conceito de exploit e um laboratório Docker autocontido para CVE-2026-9198 , uma vulnerabilidade de execução remota de código não autenticada em IBM Langflow OSS. O exploit encadeia dois endpoints — autologin que entrega um token...

CVE-2026-1357

CVE-2026-1357 — WPvivid Backup & Migration ≤ 0.9.123 Upload Arbitrário de Arquivo Não Autenticado → RCE PoC para CVE-2026-1357 CVSS 9.8 Crítico, CWE-434: um upload arbitrário de arquivo não autenticado no plugin WPvivid Backup & Migration para WordPress que leva à execução remota de código...

CVE-2026-75759 Encrypted ID token or JARM response accepted without a nested signature in erlef oidcc

Improper Verification of Cryptographic Signature vulnerability in erlef oidcc allows an unauthenticated attacker to impersonate an arbitrary user via an encrypted ID token or JARM response carrying no nested signature. OpenID Connect Core 1.0 section 2 requires that an encrypted ID token be signe...

CVE-2026-75759 Encrypted ID token or JARM response accepted without a nested signature in erlef oidcc

Improper Verification of Cryptographic Signature vulnerability in erlef oidcc allows an unauthenticated attacker to impersonate an arbitrary user via an encrypted ID token or JARM response carrying no nested signature. OpenID Connect Core 1.0 section 2 requires that an encrypted ID token be signe...

CVE-2026-4282-Scanner

CVE-2026-4282-Scanner Uno scanner di vulnerabilità non intrusivo, basato sulla versione, per CVE-2026-4282 , che interessa Keycloak e Red Hat Build of Keycloak RHBK. ⚠️ Disclaimer: Questo strumento è destinato esclusivamente a ricerche di sicurezza autorizzate, test di penetrazione e gestione...

hdwebmobile-formula-pricing

Prezzi con Formula HDWebmobile Prezza un prodotto in base a numeri inseriti dal cliente utilizzando una formula — valutata in modo sicuro, mai con la funzione eval di PHP. WordPress.org: https://wordpress.org/plugins/hdwebmobile-formula-pricing/ Richiede: WordPress 6.9+, WooCommerce, PHP 7.4+...

CVE-2026-82286-gpt-crawler-Arbitrary-File-Write

CVE-2026-82286 — gpt-crawler Scrittura Arbitraria di File Non Autenticata Proof-of-concept per una scrittura arbitraria di file non autenticata in BuilderIO/gpt-crawler ≈22k ★ tramite il parametro outputFileName dell'endpoint API POST /crawl...

PT-2026-83570

WWBN AVideo current e01e41ecc and earlier contains a brute-force rate limiting bypass in enforceRateLimit, which protects login.json.php and 13 other endpoints. The function stores its attempt counter via a cache layer ObjectYPT::setCacheGlobal that silently discards writes for any client...

PT-2026-83516

Name of the Vulnerable Software and Affected Versions oidcc versions 3.2.0-beta.1 through 3.8.9 Description Improper verification of cryptographic signatures allows an unauthenticated attacker to impersonate any user. The issue occurs when the software accepts a JSON Web Encryption JWE wrapping...

PT-2026-83558

Name of the Vulnerable Software and Affected Versions jina-ai reader affected versions not specified Description The software disables its private-address guard when deployed outside of Google Cloud environments, which enables unauthenticated attackers to perform server-side request forgery SSRF...

CVE-2026-19195-PoC

CVE-2026-19195 - Proof of Concept Modifiche Arbitrarie alle Chiavi di Registro tramite richieste IOCTL non autenticate nel Driver del Kernel dell'Antivirus Jingyun ZyArk.sys Asset Interessato Prodotto: Jingyun Antivirus Versione: 2.4.2.39 Componente: ZyArk.sys SHA-256 Hash:...

CVE-2025-43920

CVE-2025-43920: Befehlseinschleusung über den E-Mail-Betreff in GNU Mailman 2.1.39 cPanel/WHM Bundle Entdeckt von: Firudin Davudzada & Musazada Aydan Offenlegungsdatum: April 2025 CVE-ID: CVE-2025-43920 Schweregrad: 5.4 Mittel CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N Angriffstyp: Remote...

CVE-2026-9198

CVE-2026-9198 - IBM Langflow OSS Esecuzione Remota di Codice Non Autenticata RCE Vulnerabilità critica di esecuzione remota di codice non autenticata che interessa IBM Langflow OSS. La vulnerabilità deriva dalla combinazione di due debolezze: 1. /api/v1/autologin può rilasciare un bearer token...

CVE-2026-72898

CVE-2026-72898 PoC : Iniezione SQL non autenticata in Metabase Iniezione SQL pre-autenticazione in Metabase che porta alla compromissione dell'admin Proof-of-concept per CVE-2026-72898, una vulnerabilità critica di SQL injection non autenticata nell'endpoint di reset della password di Metabase. I...

CVE-2023-22047---Oracle-PeopleSoft-LFI

CVE-2023-22047---Oracle-PeopleSoft-LFI CVE-2023-22047 è una vulnerabilità critica non autenticata di inclusione locale di file LFI in Oracle PeopleSoft Enterprise PeopleTools. Questo exploit consente a un attaccante di leggere file arbitrari dal server di destinazione senza alcuna autenticazione...