CVE-2026-106765

An issue in @rog0x/mcp-docker-tools 1.0.1 allows a remote attacker to execute arbitrary code via the handleImageList function...

CVE-2026-106764

An issue in @rog0x/mcp-git-tools 1.0.1 allows a remote attacker to execute arbitrary code via the resolveBaseBranch function...

Security Bulletin: Vulnerability in prox-addr Node.js module

Summary Vulnerability in prox-addr Node.js module Vulnerability Details CVEID:CVE-2026-90711 DESCRIPTION: proxy-addr is a Node.js module that determines a request's client address behind trusted reverse proxies, and it backs Express req.ip and req.ips. In versions 1.1.0 through 2.0.7, a trust...

retrokit

retro-kit – reverse engineering old games headless Ghidra A toolkit for decompiling 32-bit games from roughly 1993–2010 with headless Ghidra: DOS LE/LX DOS/4GW, DOS/32A, PMODE/W, CauseWay, DOS/4G bind; also OS/2 LX and VxD built with Watcom C/C++ – with its own LE/LX loader for Ghidra and Watcom...

Cross-site Scripting (XSS)

Overview serialize-javascript is a package to serialize JavaScript to a superset of JSON that includes regular expressions and functions. Affected versions of this package are vulnerable to Cross-site Scripting XSS via escapeFunctionBody, which escapes each function body in isolation. When a...

geoserver-CVE-2023-25157

geoserver CVE-2023-25157 White Hat 3rd Cohort Class 30 Kim Jeong-woo github link - https://github.com/custiya/geoserver-CVE-2023-25157 Vulnerability Summary CVE-2023-25157 is an SQLi vulnerability that occurred in GeoServer, an open-source map data service web application. Occurs in some versions...

Exploit for Improperly Controlled Sequential Memory Allocation in Php

php2shell — CVE-2026-109618 / CVE-2026-109619 Pre-auth Remote...

CVE-2026-101110

CVE-2026-101110 — OrdaSoft Book Library Free unauthenticated SQL injection Python 3 PoC for CVE-2026-101110 — OrdaSoft Book Library Free for Joomla ≤ 6.4.6. Upgrade to 6.4.7+. | ---|--- PoCbit| https://pocbit.org/pocs/cve-2026-101110 Catalog| https://pocbit.org/pocs/ Component| combooklibrary Fil...

DEBIAN-CVE-2026-115754

serialize-javascript from 7.0.1 before 7.1.3 contains a cross-site scripting vulnerability that allows attackers to break out of HTML script elements by ending serialized function source text with an unescaped /script. Attackers controlling a function's source via a spoofed toString can combine...

CVE-2026-115754

serialize-javascript from 7.0.1 before 7.1.3 contains a cross-site scripting vulnerability that allows attackers to break out of HTML script elements by ending serialized function source text with an unescaped /script. Attackers controlling a function's source via a spoofed toString can combine...

CVE-2026-114357

Missing authentication for a critical function in the Android Debug Bridge daemon adbd in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 allows an attacker to obtain an unauthenticated shell uid 2000, a foothold for privilege escalation to root. The device ships with ro.adb.secure=0 no...

Exploit for Improperly Controlled Sequential Memory Allocation in Php

php2shell Exploit Tools and Fingerprint Database CVE-2026-109...

kernel: netfs: Fix early put of sink folio in netfs_read_gaps()

A flaw was found in the Linux kernel's network file system netfs. This use-after-free vulnerability occurs when the netfsreadgaps function prematurely releases a memory page during network read operations. A remote attacker could exploit this by sending specially crafted network traffic, leading ...

CVE-2026-114357 DJI CrystalSky ZS600C ships ADB without authentication (ro.adb.secure=0)

Missing authentication for a critical function in the Android Debug Bridge daemon adbd in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 allows an attacker to obtain an unauthenticated shell uid 2000, a foothold for privilege escalation to root. The device ships with ro.adb.secure=0 no...

CVE-2026-114357

The DJI CrystalSky ZS600C (firmware v0.3.9.7 through v0.6.6.9 ) is vulnerable to an unauthenticated shell access due to the Android Debug Bridge daemon (adbd) shipping with ro.adb.secure=0 , meaning it lacks host key authorization. Attackers can obtain a shell with uid 2000 , providing a foothold...

EUVD-2026-108990

Missing authentication for a critical function in the Android Debug Bridge daemon adbd in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 allows an attacker to obtain an unauthenticated shell uid 2000, a foothold for privilege escalation to root. The device ships with ro.adb.secure=0 no...

CVE-2026-115754 serialize-javascript 7.0.1 before 7.1.3 XSS via unescaped </script in function body

serialize-javascript from 7.0.1 before 7.1.3 contains a cross-site scripting vulnerability that allows attackers to break out of HTML script elements by ending serialized function source text with an unescaped /script. Attackers controlling a function's source via a spoofed toString can combine...

CVE-2026-115754 serialize-javascript 7.0.1 before 7.1.3 XSS via unescaped </script in function body

serialize-javascript from 7.0.1 before 7.1.3 contains a cross-site scripting vulnerability that allows attackers to break out of HTML script elements by ending serialized function source text with an unescaped /script. Attackers controlling a function's source via a spoofed toString can combine...

CVE-2026-115754

serialize-javascript from 7.0.1 before 7.1.3 contains a cross-site scripting vulnerability that allows attackers to break out of HTML script elements by ending serialized function source text with an unescaped /script. Attackers controlling a function's source via a spoofed toString can combine...

CVE-2026-115754

The serialize-javascript library (versions 7.0.1 before 7.1.3 ) is vulnerable to a cross-site scripting (XSS) flaw. The root cause is the failure to escape the 삡cript tag within serialized function source text. Attackers who control a function's source—for example, through a spoofed toString() me...