CVE-2026-97212

The Monta monta.app software is affected by a vulnerability in its WebSocket backend . The system uses charging station identifiers to associate sessions but incorrectly allows multiple endpoints to connect using the same session identifier, leading to predictable session identifiers . This flaw ...

CVE-2024-3094-checker

مدقق CVE-2024-3094 يبدو أن إصدارات xz Utils 5.6.0 و5.6.1 معرّضة للاختراق. XZ Utils هو برنامج لضغط البيانات وقد يكون موجوداً في توزيعات لينكس. قد يسمح الكود الخبيث بالوصول غير المصرح به إلى الأنظمة المتأثرة. المصادر: https://vulners.com/cve/CVE-2024-3094...

Incorrect Authorization

Overview langgraph-sdk is a SDK for interacting with LangGraph API Affected versions of this package are vulnerable to Incorrect Authorization via the ResourceOn.call method in langgraphsdk/auth/init.py, where custom authorization handlers registered with resource-specific decorators fail to...

CVE-2025-67887

🛡️ إصلاح لـ"ثغرة" CVE-2025-67887/86 في وحدة Translate في 1C-Bitrix أمن 1C-Bitrix يُعلم مركز أمن المعلومات ومراقبة الحوادث في شركة «1C-Bitrix» ظهرت معلومات في قنوات Telegram عن وجود ثغرة في وحدة "الترجمة" يُزعم أنها تسمح بتحميل الأرشيفات بشكل غير مصرح به دون فحص أمني. لقد أجرينا فحوصات سريعة ولا...

CVE-2026-104991 Phproject < 1.8.7 Missing Authorization via Issues REST API

Phproject before 1.8.7 contains a missing object-level authorization vulnerability in the REST API issue endpoints singleget, singlecomments, singlecommentspost that allows authenticated API key holders to bypass the security.restrictaccess confidentiality control by never invoking the allowAcces...

CVE-2026-104991

Phproject versions prior to 1.8.7 are affected by a missing object-level authorization vulnerability within the REST API issue endpoints, specifically single_get, single_comments, and single_comments_post. The root cause is the failure to invoke the allowAccess() authorization routine, allowing a...

CVE-2026-23933

A flaw was found in Zabbix. The cryptographic key used for signing Frontend sessions was erroneously written to the database seed. In deployments that utilize both SAML authentication and guest users, an attacker could use this key to forge valid session cookies. This could potentially lead to...

CVE-2026-101104

The Meari IoT Cloud Platform OpenAPI Service is vulnerable to an authorization flaw that allows authenticated users to manipulate configurations of devices they do not own. By exploiting this flaw, an attacker can alter device settings, trigger unintended behaviors, or access sensitive informatio...

WordPress PublishPress Series plugin <= 3.1.3 - Insecure Direct Object References (IDOR) vulnerability

Insecure Direct Object References IDOR vulnerability discovered by dcs in WordPress Plugin PublishPress Series versions = 3.1.3...

CVE-2026-41940

CVE-2026-41940 - أداة فحص واستغلال تجاوز المصادقة في cPanel/WHM أداة فحص واستغلال ثغرة تجاوز المصادقة في cPanel/WHM لـ CVE-2026-41940 ⚠️ إخلاء مسؤولية تم توفير هذه الأداة لأغراض تعليمية وللاختبارات الأمنية المصرح بها فقط. باستخدامك لهذه الأداة، فإنك توافق على ما يلي: ستقوم فقط باختبار الأنظمة التي...

CVE-2018-15473

CVE-2018-15473 نسخة محدثة من هذا المستودع https://github.com/Sait-Nuri/CVE-2018-15473/tree/main تم جعله يعمل مع إصدار paramiko 3.4.0 كيفية التشغيل Clone this repo git clone https://github.com/yZ1337/CVE-2018-15473.git Install libraries pip3 install -r requirements.txt Run example list python3...

CVE-2026-103505

A flaw was found in the AWS Elastic File System EFS Container Storage Interface CSI Driver. A remote authenticated user with permissions to create persistent storage volumes can supply crafted comma-separated values within volume configuration attributes. This improper input handling allows the...

axios: axios: Unintended HTTP method override via prototype pollution gadget

A flaw was found in axios. When sending HTTP requests that omit an explicit request method, Axios can inherit properties from the JavaScript prototype chain rather than using safe internal defaults. If an attacker manipulates shared object properties through a separate vulnerability in the same...

CVE-2026-86326

An improper verification of cryptographic signature vulnerability exists in protocol gateways because the device does not properly verify the cryptographic authenticity of firmware images before installation. An attacker with high privileges and access to the firmware update interface could provi...

EUVD-2026-91373

An improper verification of cryptographic signature vulnerability exists in protocol gateways because the device does not properly verify the cryptographic authenticity of firmware images before installation. An attacker with high privileges and access to the firmware update interface could provi...

CVE-2026-86326

A vulnerability exists in protocol gateways due to an improper verification of cryptographic signatures . The device fails to verify the cryptographic authenticity of firmware images before installation. An attacker with high privileges and access to the firmware update interface can provide a sp...

axios: axios: Unintended HTTP method override via prototype pollution gadget

A flaw was found in axios. When sending HTTP requests that omit an explicit request method, Axios can inherit properties from the JavaScript prototype chain rather than using safe internal defaults. If an attacker manipulates shared object properties through a separate vulnerability in the same...

httpd: httpd: unauthorized connection to arbitrary hosts via crafted FTP PASV response

A flaw was found in httpd. When configured as a forward proxy using the modproxyftp module, the server improperly validates the network address returned in a File Transfer Protocol FTP passive mode PASV response. A malicious FTP server can exploit this flaw by returning a crafted reply, forcing t...

Exploit for CVE-2026-104356

CVE-2026-104356 — Predictable deletecode via rand in Pi...

CVE-2026-104480

Discord libdave before 1.2.0 did not reject an MLS Welcome message when the resulting group roster contained an unrecognized participant. An attacker in control of the DAVE signaling path the voice gateway, or an equivalent position able to add, alter, or withhold signaling messages to a client...