CVE-2026-31431-copy-fail

Copy Fail La mayoría de los LPE de Linux necesitan una ventana de carrera o un offset específico del kernel. Copy Fail es una falla lógica de línea recta: no necesita ninguna de las dos. El mismo script de Python de 732 bytes otorga privilegios de root en todas las distribuciones de Linux lanzada...

CVE-2021-24307-all-in-one-seo-pack-admin-rce

RCE por deserialización de PHP en el panel de administración de All in One SEO Pack CVE-2021-24307 PoC simple de un RCE autenticado como administrador en AISEO = 4.1.0.1, proporcionado como ejemplo. Artículo completo aquí:...

GHSA-VV4J-M4VR-F3G6 ESPHome Device Builder Dashboard: Unauthenticated dashboard access via the HA add-on ingress site bound to all interfaces

Summary On the Home Assistant add-on, the dashboard serves a trusted ingress site that skips authentication because the supervisor authenticates the request upstream. That site was binding 0.0.0.0. The add-on runs in host network mode for mDNS, so binding all interfaces also bound the host's LAN...

CVE-2026-87827 KGUARD DVR unauthenticated remote command execution vulnerability

Certain KGUARD DVR devices running vulnerable firmware expose a system command execution service on all network interfaces without requiring authentication. A remote unauthenticated attacker with network access to the affected service can execute arbitrary system commands on the device, potential...

All-ReverseIP-MultiThreading

All-ReverseIP-MultiThreading Python 2.7 Donación : BTC : 31mtLHqhaXXyCMnT2EU73U8fwYwigiEEU1 Perfect Money : U22270614...

CVE-2026-53939

OpenIDC/cjose is a C library implementing JOSE. In versions 0.6.1 through 0.6.2.5 , when encrypting a JWE using an AES-CBC-HMAC content-encryption algorithm (A128CBC-HS256, A192CBC-HS384, or A256CBC-HS512) with any key-management algorithm that generates a fresh CEK, the CEK is all zero bytes ins...

CVE-2026-53939 OpenIDC/cjose uses all-zero Content Encryption Key for AES-CBC-HMAC JWE encryption

OpenIDC/cjose is a C library implementing the Javascript Object Signing and Encryption JOSE. In versions 0.6.1 through 0.6.2.5, when cjose encrypts a JWE using an AES-CBC-HMAC content-encryption algorithm A128CBC-HS256, A192CBC-HS384, or A256CBC-HS512 together with any key-management algorithm th...

CVE-2026-53939 OpenIDC/cjose uses all-zero Content Encryption Key for AES-CBC-HMAC JWE encryption

OpenIDC/cjose is a C library implementing the Javascript Object Signing and Encryption JOSE. In versions 0.6.1 through 0.6.2.5, when cjose encrypts a JWE using an AES-CBC-HMAC content-encryption algorithm A128CBC-HS256, A192CBC-HS384, or A256CBC-HS512 together with any key-management algorithm th...

CVE-2026-53939 OpenIDC/cjose uses all-zero Content Encryption Key for AES-CBC-HMAC JWE encryption

OpenIDC/cjose is a C library implementing the Javascript Object Signing and Encryption JOSE. In versions 0.6.1 through 0.6.2.5, when cjose encrypts a JWE using an AES-CBC-HMAC content-encryption algorithm A128CBC-HS256, A192CBC-HS384, or A256CBC-HS512 together with any key-management algorithm th...

CVE-2022-1565

WordPress Plugin WP All Import = 3.6.7 - Ejecución remota de código RCE Autenticado root@kitploit: Fecha: 05 de noviembre de 2023 Autor del exploit: Việt HÙng https://github.com/phanthibichtram12 Sitio web del proveedor: https://www.wpallimport.com/ Enlace del software:...

POC-AIOWPM-CVE-2026-19949

CVE-2026-19949 — Documented, reproducible-in-Docker proof of concept Unauthenticated second-order SQL injection in All-in-One WP Migration and Backup WordPress that escalates to leaking the ai1wmsecretkey and, with it, to remote code execution RCE. Read this in: English · Español...

CVE-2026-77968

A flaw was found in hawtio-operator. The operator's ClusterRole grants secrets: create, get, list, update, watch across all namespaces. While the operator uses a controller-runtime label-selector cache as a memory optimization, the ServiceAccount token authorizes read access to every Secret in th...

PrintNightmare

Critical Vulnerability PrintNightmare CVE-2021-1675, CVE-2021-34527 Currently no solution from Microsoft yet as of 02.07.2021 https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-34527 Affects all operating system versions server and client Options Disable Print Spooler Adjust ACL Event...

CVE-2022-24990

CVE-2022-24990 CVE-2022-24990 fuga de información + RCE todo en uno Este PoC escribe un archivo en el objetivo; aquí escribe phpinfo. Si necesitas otras funcionalidades, modifícalo tú mismo. No lo uses con fines ilegales...

CVE-2026-86441 MISP Dashboard Organisation Widgets Bypass Organisation-Index Restrictions and Expose Hidden Organisation Data

Affected versions of MISP contain inconsistent authorization checks across dashboard widgets that display organisation information. Several organisation-related widgets did not honor Security.hideorganisationindexfromusers. As a result, authenticated users without the permsharinggroup permission...

CVE-2026-86121

Cua computer-server (by Cua, GitHub: trycua/cua) versions before 0.3.42 skip authentication when the CONTAINER_NAME environment variable is unset and bind to all network interfaces by default. This allows an unauthenticated attacker to reach TCP port 8000 and execute arbitrary shell commands via ...

CVE-2026-86121 Cua computer-server before 0.3.42 Unauthenticated RCE via Desktop Control

Cua computer-server versions before 0.3.42 skip authentication when the CONTAINERNAME environment variable is unset and bind to all interfaces by default, allowing unauthenticated attackers to execute arbitrary commands. Attackers can reach TCP port 8000 to run shell commands via the runcommand...

EUVD-2026-71953

Cua computer-server versions before 0.3.42 skip authentication when the CONTAINERNAME environment variable is unset and bind to all interfaces by default, allowing unauthenticated attackers to execute arbitrary commands. Attackers can reach TCP port 8000 to run shell commands via the runcommand...

PT-2026-86392

Name of the Vulnerable Software and Affected Versions Cua computer-server versions prior to 0.3.42 Description Authentication is bypassed when the CONTAINER NAME environment variable is unset, as the server binds to all interfaces by default. This allows unauthenticated attackers to execute...

CVE-2026-52691

UNSUPPORTED WHEN ASSIGNED Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Apache Griffin Hive Metastore Module. This issue affects Apache Griffin Hive Metastore Module: all versions. As this project is retired, we do not plan to release a versio...