The vulnerability of the pg_dump utility in the PostgreSQL database management system allows a hacker to execute arbitrary code.

The vulnerability of the pgdump utility in the PostgreSQL database management system is related to the inclusion of functions from an unverified and uncontrolled area. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code remotely...

sslnuke

sslnuke -- SSL بدون التحقق ليس آمنًا! لقد سمعنا جميعًا مرارًا وتكرارًا أن SSL بدون التحقق ليس آمنًا. إذا لم يتم التحقق من اتصال SSL بشهادة مخزنة مؤقتًا، فيمكن لأي مهاجم اختطافه بسهولة. لذا في عام 2013، قد يظن المرء أننا تخلّصنا تمامًا من هذه المشكلة. تخزّن المتصفحات الشهادات مؤقتًا وتحذّر المستخد...

CVE-2024-48887-Exploit

CVE-2024-48887 - تغيير كلمة مرور غير مُتحقَّق منه CWE-620 نظرة عامة ثغرة تغيير كلمة مرور غير مُتحقَّق منه في واجهة Fortinet FortiSwitch الرسومية تسمح لمهاجم بعيد غير مُصادَق عليه بتغيير كلمات مرور المسؤول عبر طلب مُصمَّم خصيصًا الاستغلال: حمّله من هنا التفاصيل معرف CVE : CVE-2024-48887 تاريخ النش...

nuclei-templates-ai

قوالب Nuclei المُنشأة بالذكاء الاصطناعي 👾 هذا المشروع هو تنفيذ لرؤيتنا المفصلة في من CVE إلى قالب: مستقبل أتمتة قوالب Nuclei بالذكاء الاصطناعي يُظهر هذا المستودع قوة الذكاء الاصطناعي في أتمتة إنشاء قوالب الأمان لاكتشاف الثغرات. باستخدام ProjectDiscoveryAI API، نقوم تلقائيًا بإنشاء قوالب Nuclei لـ...

CVE-2023-7028

CVE-2023-7028 Un problème a été découvert dans GitLab CE/EE affectant toutes les versions de 16.1 avant 16.1.6, 16.2 avant 16.2.9, 16.3 avant 16.3.7, 16.4 avant 16.4.5, 16.5 avant 16.5.6, 16.6 avant 16.6.4 et 16.7 avant 16.7.2, dans lequel les e-mails de réinitialisation de mot de passe de compte...

CVE-2022-23131

CVE-2022-23131 Zabbix - تجاوز مصادقة SAML SSO الوصف في الحالات التي يتم فيها تمكين مصادقة SAML SSO غير الافتراضية، يمكن تعديل بيانات الجلسة بواسطة جهة خبيثة، لأن تسجيل دخول المستخدم المخزن في الجلسة لم يتم التحقق منه. Dork: shodan-query: http.favicon.hash:892542951 fofa-query: app="ZABBIX-监控系统" &...

CVE-2026-106488

A flaw was found in plugin-auth-backend-module-oidc-provider. In deployments using email-based identity resolution with an OpenID Connect OIDC provider that allows unverified email addresses, an authenticated attacker can achieve privilege escalation by assuming another catalog identity. This...

EUVD-2026-44646

PraisonAI: Plugin Auto-Discovery Executes Arbitrary Python Files Without Verification...

CVE-2026-22004-Git-LFS-Pointer-Poisoning-Supply-Chain-

CVE-2026-22004 – Empoisonnement du pointeur Git LFS Chaîne d'approvisionnement Code du programme Bash + Python createmaliciousrepo.sh - Sets up a repo with poisoned LFS pointer git init git lfs track ".bin" echo "version https://git-lfs.github.com/spec/v1 oid...

InfraTest

لا تنشر إلا للتعلم عن AWS!!! حاليًا عرضة لثغرة CVE-2024-39689. نحتاج إلى تحديث Certifi. تحقق من dependabot قبل النشر. الوثوق بسلطة شهادات غير موثّقة قد يسبب خسارة كبيرة في ثقة العملاء...

CVE-2026-105818

Vault's PKI secrets engine ACME server did not restrict certificate identities that ACME challenges do not validate when issuing certificates under the default directory policy. This may allow an ACME client to obtain a certificate containing unverified identity claims, potentially enabling...

PT-2026-107710

Vault's PKI secrets engine ACME server did not restrict certificate identities that ACME challenges do not validate when issuing certificates under the default directory policy. This may allow an ACME client to obtain a certificate containing unverified identity claims, potentially enabling...

cve-2026-105221-gist-tls

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · cve-2026-105221-gist-tls cve-2026-105221-gist-tls gist RubyGem 6.1.0 - defunkt httpconnection définit OpenSSL::SSL::VERIFYNONE. HTTPS vers GitHub chiffre toujours, mais n'importe quel certificat est accepté. Un pair...

CVE-2026-4885

CVE-2026-4885 – Exploitation massive de Piotnet Addons for Elementor Pro Téléchargement arbitraire de fichier sans authentification menant à une exécution de code à distance RCE dans Piotnet Addons for Elementor Pro ≤ 7.1.70. Cet outil est conçu pour l'exploitation massive – fournissez-lui une...

CVE-2026-94271 Deema Payment Gateway <= 1.1.2 - Unauthenticated Payment Confirmation Forgery via Unverified Success Return

The Deema Payment Gateway WordPress plugin through 1.1.2 does not verify the payment with the payment provider when handling the return from the hosted checkout, and does not check the payment status or amount, allowing unauthenticated users to have orders marked as paid without any payment being...

CVE-2026-94271 Deema Payment Gateway <= 1.1.2 - Unauthenticated Payment Confirmation Forgery via Unverified Success Return

The Deema Payment Gateway WordPress plugin through 1.1.2 does not verify the payment with the payment provider when handling the return from the hosted checkout, and does not check the payment status or amount, allowing unauthenticated users to have orders marked as paid without any payment being...

CVE-2026-105640

Plane is an open-source project management tool. Prior to 1.4.0, Plane trusts email addresses returned by Gitea OAuth and by self-managed GitLab OAuth deployments where email confirmation is disabled, without verifying that the provider authenticated ownership of the address. An attacker can set ...

EUVD-2026-92596

Plane is an open-source project management tool. Prior to 1.4.0, Plane trusts email addresses returned by Gitea OAuth and by self-managed GitLab OAuth deployments where email confirmation is disabled, without verifying that the provider authenticated ownership of the address. An attacker can set ...

CVE-2026-93317

The buildkit software (referenced via the Moby project) is vulnerable to a flaw where an unauthenticated attacker controlling a registry or OCI-layout blob source can provide blob contents that do not match the claimed digest. This allows the resulting snapshot to be cached under the incorrect di...

CVE-2026-93317 Container blob cache can accept unverified content

An unauthenticated attacker controlling a registry or OCI-layout blob source could provide blob contents that did not match the claimed digest. The resulting snapshot could be cached under that digest and reused by a later victim build, compromising build-input integrity...