WordPress Kali Forms plugin <= 2.4.23 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by sungbyeongchan in WordPress Plugin Kali Forms versions = 2.4.23...

ir-rescue

ir-rescue ir-rescue is composed of two sister scripts that collect a myriad of forensic data from 32-bit and 64-bit Windows systems ir-rescue-win and from Unix systems ir-rescue-nix. The scripts respect the order of volatility and artifacts that are changed with the execution e.g. , prefetch file...

WordPress Ditty plugin <= 3.1.67 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by sungbyeongchan in WordPress Plugin Ditty versions = 3.1.67...

WordPress FluentPlayer Pro plugin <= 1.3.2 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin FluentPlayer Pro versions = 1.3.2...

cookie_crimes

Chrome Cookie Extraction Without Root This will print out a user's Chrome cookies. You don't need to have their password or be root to use it. nice nice nice nice nice. If you are not the kind of person who regularly gets the ability to execute code on other people's computers, you probably don't...

CVE-2026-79276

A flaw was found in Google Chrome's FileSystem component. This improper privilege management vulnerability allows a remote attacker, leveraging social engineering, to bypass system access restrictions. The exploitation occurs when a user interacts with a specially crafted HTML page...

CVE-2026-79077

A flaw was found in WebProtect in Google Chrome. This incorrect authorization vulnerability allows a remote attacker to bypass system access restrictions. By crafting a malicious HTML page, the attacker can exploit this flaw to gain unauthorized access to restricted parts of the system...

CVE-2026-79060

A flaw was found in Google Chrome. Incorrect authorization in the StorageAccessAPI could allow a remote attacker, who has already compromised the renderer process, to bypass the web origin policy. This bypass is achieved by using a specially crafted HTML page, potentially leading to unauthorized...

CVE-2026-79225

A flaw was found in chromium-browser. This incorrect authorization vulnerability allows a remote attacker to bypass system access restrictions. The attacker can achieve this by leveraging social engineering techniques through user interface UI interaction...

CVE-2026-79021

A flaw was found in chromium-browser. This vulnerability, related to missing authorization in the InterestGroups component, allows a remote attacker to bypass system access restrictions. The attacker must first compromise the browser's rendering engine and then use a specially crafted PDF file to...

CVE-2026-79177

A flaw was found in the Media component of Google Chrome on Windows. Incorrect authorization allows a remote attacker, who has already compromised the renderer process, to bypass system access restrictions. This can be achieved by crafting a malicious HTML page, leading to unauthorized access...

CVE-2026-79089

A flaw was found in Google Chrome's Transactions Platform on Android. A race condition vulnerability allows a remote attacker, through social engineering and a specially crafted HTML page, to bypass system access restrictions. This could lead to unauthorized access to sensitive system functions...

git-all-secrets

git-all-secrets About git-all-secrets is a tool that can: Clone multiple public/private github repositories of an organization and scan them, Clone multiple public/private github repositories of a user that belongs to an organization and scan them, Clone a single public/private repository of an...

CVE-2026-79237

A flaw was found in Google Chrome's Navigation component. This incorrect authorization vulnerability allows a remote attacker to bypass the web origin policy by enticing a user to visit a specially crafted HTML page. This could lead to unauthorized access to sensitive information or actions acros...

CVE-2026-35445

Winter CMS versions prior to 1.2.13 contained an authorization bypass in the backend's form postback handler dispatch. The _handler POST field was passed directly to the handler dispatcher without validation, unlike AJAX requests which enforced the on[A-Z][\w+]* pattern. This allowed any authenti...

EUVD-2026-66631

Winter CMS is a content management system built on the Laravel PHP framework. In versions prior to 1.2.13, the backend did not validate the handler name submitted through the form postback handler POST field, allowing an authenticated backend user to invoke arbitrary controller methods, including...

instantbox

En | 简 | 繁 instantbox Get a clean, ready-to-go Linux box in seconds. Introduction What is instantbox? It's a project that spins up temporary Linux systems with instant webshell access from any browser. What can an instantbox do?...

CVE-2026-79259

A flaw was found in Google Chrome. Improper input validation in the Safebrowsing component allows a remote attacker to bypass system access restrictions. This vulnerability can be exploited by providing a specially crafted file, leading to unauthorized access...

Binding to an Unrestricted IP Address

Overview github.com/cli/cli/cmd/gh is a GitHub on the command line. It brings pull requests, issues, and other GitHub concepts to the terminal next to where you are already working with git and your code. Affected versions of this package are vulnerable to Binding to an Unrestricted IP Address...

CVE-2026-79003

A flaw was found in Google Chrome. A remote attacker, by leveraging social engineering tactics, could exploit an incorrect authorization vulnerability in the Device component. This could allow the attacker to bypass system access restrictions through a specially crafted HTML page...