CVE-2024-57373

CSRF Vulnerability in LifestyleStore v1.0 📌 Overview This repository documents a Cross-Site Request Forgery CSRF vulnerability identified in the LifestyleStore v1.0 project. The flaw allows attackers to perform unauthorized actions on behalf of authenticated users, posing risks to data integrity...

CVE-2023-7028-Docker

CVE-2023-7028 with Docker 🎯 Want to practice with the new gitlab CVE ? Follow the instructions Build the lab 1. Install Docker : https://docs.docker.com/get-docker/ 2. Clone the project : git clone https://github.com/Trackflaw/CVE-2023-7028-Docker.git. 3. Go to the project : cd CVE-2023-7028-Dock...

Microweber < 1.2.17 - Cross-Site Scripting

Cross-site Scripting XSS vulnerability in the /demo/editortools/module endpoint via the 'type' parameter. id: CVE-2022-2130 info: name: Microweber 1.2.17 - Cross-Site Scripting author: ritikchaddha severity: medium description: | Cross-site Scripting XSS vulnerability in the...

SuperWebMailer - Cross-Site Scripting

An issue was discovered in SuperWebMailer 9.00.0.01710 that allows keepalive.php XSS via a GET parameter. id: CVE-2023-38194 info: name: SuperWebMailer - Cross-Site Scripting author: ritikchaddha severity: medium description: | An issue was discovered in SuperWebMailer 9.00.0.01710 that allows...

kirki-wordpress-account-security-assessment

CVE-2026-8206 - Kirki WordPress Plugin Unauthenticated Account Takeover Consultant-Style Cybersecurity Report Professional vulnerability assessment report for Kirki WordPress account security risk, including technical impact, remediation, and mitigation strategy. 📍 Report Snapshot Field| Details...

TeamFiltration Campaign Compromises Seven Microsoft 365 Accounts Using Default Passwords

Cybersecurity researchers have disclosed details of an active TeamFiltration campaign codenamed UNKCondorFiltration that has targeted over 5,700 accounts across 28 Microsoft 365 tenants. According to Proofpoint, the activity has primarily focused on Chilean retail and financial institutions. It...

Linux Distros Unpatched Vulnerability : CVE-2026-84990

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ntopng is a web-based network traffic monitoring application. Prior to 6.7.260718, scripts/lua/rest/v2/get/system/configurations/listavailablebackups.lua and...

AZL-103401 CVE-2026-84990 affecting package ntopng 5.2.1-6

ntopng is a web-based network traffic monitoring application. Prior to 6.7.260718, scripts/lua/rest/v2/get/system/configurations/listavailablebackups.lua and scripts/lua/rest/v2/get/system/configurations/downloadbackup.lua allow any authenticated non-admin user to list and download...

CVE-2026-84990

ntopng is a web-based network traffic monitoring application. Prior to 6.7.260718, scripts/lua/rest/v2/get/system/configurations/listavailablebackups.lua and scripts/lua/rest/v2/get/system/configurations/downloadbackup.lua allow any authenticated non-admin user to list and download...

CVE-2026-84990

ntopng is a web-based network traffic monitoring application. Prior to 6.7.260718 , two REST endpoint scripts (list_available_backups.lua and download_backup.lua) lack an administrator authorization check , allowing any authenticated non-admin user to list and download system-configuration backup...

CVE-2026-84990 ntopng: Missing Authorization on System Configuration Backup Download and Listing

ntopng is a web-based network traffic monitoring application. Prior to 6.7.260718, scripts/lua/rest/v2/get/system/configurations/listavailablebackups.lua and scripts/lua/rest/v2/get/system/configurations/downloadbackup.lua allow any authenticated non-admin user to list and download...

EUVD-2026-83984

ntopng is a web-based network traffic monitoring application. Prior to 6.7.260718, scripts/lua/rest/v2/get/system/configurations/listavailablebackups.lua and scripts/lua/rest/v2/get/system/configurations/downloadbackup.lua allow any authenticated non-admin user to list and download...

CVE-2026-84990: Exposure of Sensitive Information to an Unauthorized Actor

ntopng is a web-based network traffic monitoring application. Prior to 6.7.260718, scripts/lua/rest/v2/get/system/configurations/listavailablebackups.lua and scripts/lua/rest/v2/get/system/configurations/downloadbackup.lua allow any authenticated non-admin user to list and download...

CVE-2026-55549

Yamcs is a mission control framework. Prior to 5.9.4, Yamcs reflects an attacker-controlled redirecturi parameter from GET /auth/authorize into yamcs-core/src/main/resources/auth/templates/authorize.html without adequate HTML escaping by yamcs-core/src/main/java/org/yamcs/http/auth/AuthHandler.ja...

CVE-2026-55549 Yamcs: Reflected XSS in the URL of the Authorize Endpoint

Yamcs is a mission control framework. Prior to 5.9.4, Yamcs reflects an attacker-controlled redirecturi parameter from GET /auth/authorize into yamcs-core/src/main/resources/auth/templates/authorize.html without adequate HTML escaping by yamcs-core/src/main/java/org/yamcs/http/auth/AuthHandler.ja...

CVE-2026-55549 Yamcs: Reflected XSS in the URL of the Authorize Endpoint

Yamcs is a mission control framework. Prior to 5.9.4, Yamcs reflects an attacker-controlled redirecturi parameter from GET /auth/authorize into yamcs-core/src/main/resources/auth/templates/authorize.html without adequate HTML escaping by yamcs-core/src/main/java/org/yamcs/http/auth/AuthHandler.ja...

CVE-2026-55549 Yamcs: Reflected XSS in the URL of the Authorize Endpoint

Yamcs is a mission control framework. Prior to 5.9.4, Yamcs reflects an attacker-controlled redirecturi parameter from GET /auth/authorize into yamcs-core/src/main/resources/auth/templates/authorize.html without adequate HTML escaping by yamcs-core/src/main/java/org/yamcs/http/auth/AuthHandler.ja...

CVE-2026-55549

Yamcs , an open-source mission control framework, is vulnerable to reflected cross-site scripting (XSS) in the redirect_uri parameter of the GET /auth/authorize endpoint. The parameter is reflected into authorize.html without adequate HTML escaping by AuthHandler.java and HandlerContext.java , al...

CVE-2026-55549: Improper Neutralization of Input During Web Page Generation

Yamcs is a mission control framework. Prior to 5.9.4, Yamcs reflects an attacker-controlled redirecturi parameter from GET /auth/authorize into yamcs-core/src/main/resources/auth/templates/authorize.html without adequate HTML escaping by yamcs-core/src/main/java/org/yamcs/http/auth/AuthHandler.ja...

Trojanized pantheon-agents 0.6.1 and 0.6.2 on PyPI ship a credential stealer (supply-chain account compromise)

Summary The PyPI account that publishes pantheon-agents was compromised in the June 2026 "Hades" PyPI supply-chain attack Mini Shai-Hulud / Miasma lineage. The attacker used a stolen, long-lived PyPI API token to upload trojanized releases pantheon-agents 0.6.1 and 0.6.2 directly to PyPI. Only th...