CVE-2026-106208

Google Chrome versions prior to 155.0.8059.39 are vulnerable to a missing authorization flaw in an API. A remote attacker can leverage social engineering to leak sensitive information by utilizing a crafted Chrome extension . This issue was addressed in the stable channel update, and specific rem...

CVE-2026-106208

Missing authorization in API in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to leak sensitive information via a crafted Chrome extension. Chromium security severity: Medium...

Elasticsearch 8.19.19, 9.3.8, 9.4.4 Security Update (ESA-2026-188)

Incorrect Authorization in Elasticsearch Leading to Unauthorized Data Stream Modification Incorrect Authorization CWE-863 in Elasticsearch can lead to unauthorized data stream modification via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. An authenticated user with sufficient...

AuroraStore

Aurora Store Aurora Store позволяет вам искать и скачивать приложения из официального магазина Google Play. Вы можете просматривать описания приложений, скриншоты, обновления, отзывы и загружать APK напрямую с Google Play на ваше устройство. Чтобы использовать Aurora Store, войдите в систему с...

CVE-2017-5487

PoC - CVE-2017-5487 - Перечисление пользователей WordPress через REST Установка git clone https://github.com/ndr-repo/CVE-2017-5487.git powershell -noexit -ExecutionPolicy Bypass -File .ps1 Использование .\Enumerate-WordPressOrgMembersREST.ps1 Альтернативный путь 1 для обхода WAF...

CVE-2020-12593

CVE-2020-12593 CVE-2020-12593 POC Symantec EDR on-prem версии ниже "4.5" подвержен уязвимости раскрытия информации через следующий URL: https://@IPEDR/atpapi/v2/policies/blacklist Ссылка...

POC_CVE-2026-46716

CVE-2026-46716 — Межарендное RCE в Nezha Monitoring через обход авторизации API Cron Лабораторная среда для воспроизведения и обнаружения CVE-2026-46716 , критической уязвимости в Nezha Monitoring, где конечная точка POST /api/v1/cron не проверяет права администратора, позволяя пользователям с...

WordPress Core <= 7.1.2 - Author+ Broken Access Control to Sticky Posts via REST API vulnerability

Author+ Broken Access Control to Sticky Posts via REST API vulnerability discovered by Anthropic in WordPress core versions = 7.1.2...

CVE-2026-105849

Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.90.0 and canary versions before 4.0.0-canary.34, users with ordinary read access to other authentication documents in a collection with useAPIKey enabled can obtain active API keys and exercise t...

CVE-2025-71384

Dbit WIFI4 N300 1.0.0 devices allows administrators from the local Wi-Fi network to execute OS commands by leveraging a stack-based buffer overflow via the /api/addStaticDHCP comment field,...

CVE-2025-71383

Dbit WIFI4 N300 1.0.0 devices allow the management interface to be crashed via a request from the local Wi-Fi network that lacks a /api/login username or password field. This occurs because of an error in a JSON parser...

windows-api-function-cheatsheets

Шпаргалки по функциям Windows API Контакты 🌨️ Snowcrash: [email protected] Оглавление Шпаргалки по функциям Windows API Файловые операции Управление процессами Управление памятью Управление потоками Управление динамически подключаемыми библиотеками DLL Синхронизация Межпроцессное...

AV-EDR-Lab-Environment-Setup

Настройка лабораторной среды AV/EDR Изначально взято из Discord-сообщества Maldev Academy и дополнено другими ресурсами. Заметки в Notion : https://an0nud4y.notion.site/AV-EDR-Lab-Env-Setup-130bc870022d8071935cc682d3eb34b9?pvs=4 Пример того, что можно использовать для эмуляции некоторых функций,...

CVE-2026-41179

CVE-2026-41179 — rclone RC API 인증 없는 RCE ⚠️ 교육 목적으로만 제공 이 저장소는 보안 연구, 교육 및 인가된 실습 환경에서만 사용하도록 엄격히 제한됩니다. PSSec 및 이 저장소의 기여자들은 본 저장소에 포함된 정보, 코드 또는 기술의 무단, 불법 또는 악의적 사용을 묵인하거나 지지하지 않으며 이에 대한 어떠한 책임도 지지 않습니다. 이 저장소를 사용함으로써 귀하는 자신의 행동에 전적으로 책임이 있으며, 소유한 시스템 또는 명시적 서면 허가를 받은 시스템에 대해서만 테스트를 수행할 것에...

NPM: Payload vulnerable to API key disclosure through ordinary document reads

NPM: Payload vulnerable to API key disclosure through ordinary document reads vulnerability discovered by ? in WordPress Npm payload versions = 3.0.0, 3.90.0...

GHSA-238X-W2J9-GWWR Payload vulnerable to API key disclosure through ordinary document reads

Impact Users with read access to other user documents could access their active API keys. An exposed key grants the target account’s permissions until rotated or disabled. You are affected if: - An authentication collection enables useAPIKey. - Users have read access to other user documents...

Payload vulnerable to API key disclosure through ordinary document reads

Impact Users with read access to other user documents could access their active API keys. An exposed key grants the target account’s permissions until rotated or disabled. You are affected if: - An authentication collection enables useAPIKey. - Users have read access to other user documents...

CVE-2026-105806

Payload is a free and open source headless content management system. In @payloadcms/plugin-mcp versions from 3.61.0 until 3.88.0, an authenticated user can manage MCP API keys outside the intended account, enabling privilege escalation through account takeover. This issue is fixed in version...

CVE-2026-105849 Payload: API key disclosure through ordinary document reads

Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.90.0 and canary versions before 4.0.0-canary.34, users with ordinary read access to other authentication documents in a collection with useAPIKey enabled can obtain active API keys and exercise t...

CVE-2026-105849 Payload: API key disclosure through ordinary document reads

Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.90.0 and canary versions before 4.0.0-canary.34, users with ordinary read access to other authentication documents in a collection with useAPIKey enabled can obtain active API keys and exercise t...