CVE-2021-22201

CVE-2021-22201 CVE-2021–22201 GitLab 任意文件读取漏洞 13.9.0 = GitLab 13.9.5 使用方法 python CVE-2021-22201.py url username password 参考 CVE-2021–22201: Arbitrary file read on Gitlab | by Son Nguy3n | Jun, 2021 | tradahacking Project import/export API | GitLab 1132378 Arbitrary file read during project import...

CVE-2024-21388

🇮🇱 BringThemHome NeverAgainIsNow 🇮🇱 我们要求安全归还所有被恐怖组织哈马斯劫持为人质的公民。我们将不懈努力，直到所有人质获释并安全回家。您可以帮助他们回家。https://stories.bringthemhomenow.net/ Microsoft Edge 漏洞利用 CVE-2024-21388 此 Python 脚本利用 Microsoft Edge 中的一个漏洞 CVE-2024-21388，可通过私有 API 以提升的权限静默安装浏览器扩展。 描述 Guardio Labs 发现 Microsoft Edge 中存在一个漏洞，编号为...

CVE-2026-87918 WPBot < 8.5.7 - Unauthenticated AI Provider API Abuse via Multiple AJAX Actions

The WPBot WordPress plugin before 8.5.7 does not perform any authorization or nonce check on several AJAX actions that relay prompts to its configured AI providers, allowing unauthenticated attackers to make those third-party API calls, and consume the associated cost, using the site's own...

CVE-2026-87918

The WPBot WordPress plugin before 8.5.7 fails to perform any authorization or nonce check on several AJAX actions that relay prompts to configured AI providers. This allows unauthenticated attackers to trigger those third-party API calls using the site's own configured API keys, thereby consuming...

HTB-TwoMillion-Writeup

HTB-TwoMillion-Writeup HackTheBox TwoMillion 机器 Writeup — API滥用、命令注入与CVE-2023-0386 HackTheBox — TwoMillion Writeup HackTheBox — TwoMillion Writeup 机器信息 字段| 详情 ---|--- 名称| TwoMillion 难度| Easy 操作系统| Linux IP| 10.10.11.221 CVE| CVE-2023-0386 概述 TwoMillion 是一台 Easy 难度的 Linux 机器，主题围绕旧的 HackTheBox...

PT-2026-89365

There is an Vulnerability in some HikCentral Access Control versions. Authenticated low-privilege users can invoke API interfaces that their role is not authorized to access...

EUVD-2026-71875

The EmbedPress WordPress plugin before 4.6.4 does not have proper authorization on a public review-loading action, allowing unauthenticated users to force the site to make repeated billable third-party API requests using the site's own configured API key, and to create an unbounded number of...

CVE-2026-84962

An unauthorized user with key vault write access may cause an authorized client to issue arbitrary authenticated Google Cloud KMS API calls under the authorized user's identity, escalating database-level access into cloud key control and defeating client-side encryption...

Astra Linux – Vulnerability in Firefox

TypedArrays can be flawed, and they lack proper exception handling. This could lead to abuse in other APIs that expect TypedArrays to always succeed. This vulnerability affects Firefox versions less than 121...

PT-2026-72142

Name of the Vulnerable Software and Affected Versions bLoyal: Loyalty & Promotions by bLoyal versions prior to 3.1.611.79 Description This issue allows authenticated users with Subscriber-level access or higher to escalate their privileges to any WordPress user, including the site Administrator...

CVE-2026-58445 Cross-repository label-ID enumeration oracle via unscoped DeleteIssueLabel API

Cross-repository label-ID enumeration oracle via unscoped DeleteIssueLabel API...

CVE-2025-62314

HCL AION is affected by a vulnerability where certain endpoints lack sufficient anti-automation controls. Automated or scripted requests may be submitted without adequate rate limiting or challenge mechanisms, potentially resulting in unintended behavior or security impact under certain condition...

xss2shell

XSS2Shell — WordPress Pre-Auth XSS → RCE Chain PoC CVE-2026...

CVE-2026-57942

LibreTranslate through 1.9.7, fixed in commit 397fd22, contains an IP spoofing vulnerability in the getremoteaddress function that allows unauthenticated attackers to spoof client IP addresses by injecting arbitrary values into the X-Forwarded-For header without trusted proxy validation. Attacker...

CVE-2026-57942 LibreTranslate - IP Spoofing via X-Forwarded-For Header

LibreTranslate through 1.9.7, fixed in commit 397fd22, contains an IP spoofing vulnerability in the getremoteaddress function that allows unauthenticated attackers to spoof client IP addresses by injecting arbitrary values into the X-Forwarded-For header without trusted proxy validation. Attacker...

CVE-2026-57942 LibreTranslate - IP Spoofing via X-Forwarded-For Header

LibreTranslate through 1.9.7, fixed in commit 397fd22, contains an IP spoofing vulnerability in the getremoteaddress function that allows unauthenticated attackers to spoof client IP addresses by injecting arbitrary values into the X-Forwarded-For header without trusted proxy validation. Attacker...

Containers on fire: from container escapes to supply chain attacks

Introduction Modern infrastructures universally rely on containerization to deploy applications, scale services, and build cloud platforms. The use of Docker, Kubernetes, and similar technologies has become the corporate standard for efficient automation. However, as containers grow in popularity...

MAL-2026-4482 Malicious code in arnext (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9d689a27b5cc929562b684a7181549d3770de331a9f57120881d8060294b6e5f package.json declares "preinstall": "./vendor/setup", which runs a 976,568-byte Linux ELF binary on every npm install. The package's stated purpose i...

CVE-2026-6341

Mattermost Plugins versions =11.5 11.1.5 10.13.11 11.3.4.0 fail to have API-level checks on which groups the user can create issues or attach comments to which allows a user that is member of multiple groups to create issues to a locked group via direct API requests. Mattermost Advisory ID:...

CVE-2026-45349

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, a user just needs to use the API endpoint: /api/chat/completions with their own API key generated in OWUI and the Chat ID of another user to continue the conversation of the other...