CVE-2026-126282

NocoDB versions 2026.04.0 before 2026.08.0 are susceptible to an improper privilege management vulnerability in org-users.service.ts. The root cause is that updating a user's legacy organization role incorrectly rewrites their default-workspace role . This flaw allows revoked users to silently re...

CVE-2026-126371

Vvveb versions through 1.0.8.6 are vulnerable to an SQL injection flaw in the Admin_Auth_TokenSQL::update() function. The root cause is the interpolation of admin_auth_token array keys into an INSERT column list without utilizing a column whitelist or backtick escaping. Authenticated admin-panel ...

CVE-2026-126383

The n8n workflow automation tool is vulnerable to a NoSQL injection in the MongoDB node's Update and Find And Replace operations. The root cause is insufficient validation of the update key value when processed from incoming items. Affected versions include before 1.123.89 , 2.x before 2.45.5 , 2...

CVE-2026-126414

Frappe HRMS versions 15.0.0 before 15.64.2 and 16.0.0 before 16.20.0 are vulnerable to a missing authorization flaw (CWE-862) in specific record update endpoints. The root cause is a lack of ownership checks , which allows authenticated users with the Employee role to modify records belonging to ...

CVE-2026-127093

Rustrak versions prior to 0.26.0 are vulnerable to a Server-Side Request Forgery (SSRF) . The flaw exists within the Alert Integration Test functionality, where users with integrations update permissions can trigger requests to arbitrary destinations by providing a routing_override.url parameter ...

ROOT-APP-PYPI-CVE-2026-34518 CVE-2026-34518 in aiohttp - Patched by Root

Root has patched CVE-2026-34518 in the aiohttp package for Root:PyPI. Multiple fixed versions available...

CVE-2026-123097

The WP Remote Users Sync WordPress plugin, in versions before 2.2.1 , contains a vulnerability where it fails to restrict which account fields a synchronized site can set during user creation or updates. An attacker possessing shared synchronization keys can exploit this to bypass role and metada...

CVE-2026-123097 WP Remote Users Sync < 2.2.1 - Privilege Escalation to Administrator via 'create' and 'update' Sync Actions

The WP Remote Users Sync WordPress plugin before 2.2.1 does not restrict which account fields a synchronised site may set when it creates or updates users, allowing a site holding the shared synchronisation keys to assign the administrator role, modify any existing account and write arbitrary use...

CVE-2026-38751

CVE-2026-38751 — OpenSTAManager Module Upload RCE Authenticated RCE via unvalidated ZIP upload in the module update endpoint. Affected: OpenSTAManager = 2.10.x Requirements pip install requests Usage Reverse shell Penelope or any listener python3 exploit.py -u http://TARGET -U admin -P admin...

fsociety

fsociety A Modular Penetration Testing Framework Install pip install fsociety Update pip install --upgrade fsociety Usage usage: fsociety -h -i -s A Penetration Testing Framework optional arguments: -h, --help show this help message...

routersploit

RouterSploit - Exploitation Framework for Embedded Devices Community Join community on Embedded Exploitation Discord. Description The RouterSploit Framework is an open-source exploitation framework dedicated to embedded devices. It consists of various modules that aid penetration testing...

bettercap

Join the project community on our server! bettercap is a powerful, easily extensible and portable framework written in Go which aims to offer to security res...

PloitKit

PloitKit The Hacker's ToolBox PloitKit is a Python based GUI tool designed as one-stop for all other softwares. I was facing these kinds of problem, when I need to switch to different system, or I lost my pen-drive. I have to go to google, and search every tool and download every tool and so on. ...

Blackash-CVE-2025-4322

CVE-2025-4322 : Unauthenticated Privilege Escalation via Password Update "Account Takeover 🔥" Description : The Motors theme for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 5.6.67. This is due to the theme not properly validating a...

OpenSTAManager_RCE_Exploit-CVE-2026-38751-

OpenSTAManager RCE Exploit CVE-2026-38751 Overview This Python script exploits a Remote Code Execution vulnerability in OpenSTAManager version 2.10, identified as CVE-2026-38751. The exploit allows authenticated users to upload a malicious module and execute arbitrary commands on the target syste...

Windows Update Orchestrator Service Privilege Escalation

The vulnerability of the Windows Update Orchestrator Service on Windows operating systems is related to the improper handling of symbolic links before accessing the file. Exploiting this vulnerability can allow an attacker to elevate their privileges to the SYSTEM level...

Windows Update Orchestrator Service Privilege Escalation

The vulnerability of the Windows Update Orchestrator Service on Windows operating systems is related to incorrect handling of symbolic links before accessing the file. Exploiting this vulnerability can allow an attacker to elevate their privileges to the SYSTEM level and gain unauthorized access ...

CVE-2024-42642

CVE-2024-42642 Introduction The device in question is any MX500-series SSD. These SSDs are controlled by a Sillicon-Motion SM2259 controller older batches had an older controller, Sillicon-Motion SM2258, but the main focus of this document is the newer one. SM2259 is a 4-channel SATA 6Gb/s...

wphardening

WPHardening Fortify the security of any WordPress installation. ❮ NOTE ❯ This tool releases new versions on a regular basis. Make sure to update your dependencies frequently to get the latest version. Check out the changelog or CHANGELOG.md to learn about the new features. Installation Installing...

Tutor LMS <= 2.1.10 - SQL Injection

Tutor LMS – eLearning and online course solution plugin for WordPress all versions up to 2.6.1 contains a time-based SQL Injection caused by insufficient escaping on the questionid parameter in SQL queries, letting authenticated attackers with subscriber or higher access extract sensitive...