CVE-2026-106513 MISP: Site-Admin Can Repoint Redis Workers to Attacker-Controlled Server via UI/API Configuration Change

MISP exposes critical infrastructure settings—specifically the Redis host addresses used by the core application, the ZeroMQ plugin, and the SimpleBackgroundJobs plugin—through its web UI and API to site-admin users. The background job workers trust raw Redis job payloads without additional...

EUVD-2026-93666

A missing authorization vulnerability was identified in GitHub Enterprise Server that allowed a repository collaborator with write access to delete the current default branch through the GraphQL API and cause an attacker-controlled branch to become the new default. In repositories that required...

CVE-2026-103620 Missing authorization in GitHub Enterprise Server allowed repository writers to replace default branches via GraphQL

A missing authorization vulnerability was identified in GitHub Enterprise Server that allowed a repository collaborator with write access to delete the current default branch through the GraphQL API and cause an attacker-controlled branch to become the new default. In repositories that required...

CVE-2026-103620

A missing authorization vulnerability in GitHub Enterprise Server allows repository collaborators with write access to delete the current default branch using the GraphQL API . This flaw enables an attacker to set an attacker-controlled branch as the new default. In repositories requiring pull-re...

CVE-2025-0868

Отчет по проекту тестирования на проникновение: эксплуатация CVE-2025-0868 DocsGPT RCE через JSON Eval 1. Введение Критическая уязвимость удаленного выполнения кода RCE CVE-2025-0868 была раскрыта 20 февраля 2025 года в библиотеке DocsGPT с открытым исходным кодом, вызванная небезопасным...

EUVD-2026-93660

NetBox versions 2.9.5 before 4.7.0 contain a server-side template injection vulnerability that allows a low-privileged user with the "Can add custom links" permission to steal session cookies and API tokens of other users by exposing the raw Django HttpRequest object to the Jinja2 template contex...

CVE-2026-104073 NetBox 2.9.5 < 4.7.0 Session Hijacking via Custom Links

NetBox versions 2.9.5 before 4.7.0 contain a server-side template injection vulnerability that allows a low-privileged user with the "Can add custom links" permission to steal session cookies and API tokens of other users by exposing the raw Django HttpRequest object to the Jinja2 template contex...

CVE-2026-104073 NetBox 2.9.5 < 4.7.0 Session Hijacking via Custom Links

NetBox versions 2.9.5 before 4.7.0 contain a server-side template injection vulnerability that allows a low-privileged user with the "Can add custom links" permission to steal session cookies and API tokens of other users by exposing the raw Django HttpRequest object to the Jinja2 template contex...

CVE-2026-104073

NetBox versions 2.9.5 before 4.7.0 are vulnerable to a server-side template injection vulnerability. A low-privileged user with the "Can add custom links" permission can exploit this by exposing the raw Django HttpRequest object to the Jinja2 template context. An attacker can craft a custom link ...

CVE-2026-104073 NetBox 2.9.5 < 4.7.0 Session Hijacking via Custom Links

NetBox versions 2.9.5 before 4.7.0 contain a server-side template injection vulnerability that allows a low-privileged user with the "Can add custom links" permission to steal session cookies and API tokens of other users by exposing the raw Django HttpRequest object to the Jinja2 template contex...

CVE-2025-8625

CVE-2025-8625 Copypress Rest API 1.1 - 1.2 - Отсутствие настраиваемого секрета JWT и проверки типа файлов, ведущее к неаутентифицированному удалённому выполнению кода 🛡️ Copypress Rest API 1.1 - 1.2 RCE-эксплойт 📝 Описание Плагин Copypress Rest API для WordPress версии с 1.1 по 1.2 уязвим к...

EUVD-2026-93611

Incorrect authorization in API in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to bypass web origin policy via a crafted HTML page. Chromium security severity: Low...

CVE-2026-106422

Google Chrome versions prior to 155.0.8059.39 are vulnerable to an incorrect authorization flaw in an API. This vulnerability allows a remote attacker to bypass web origin policy by using a crafted HTML page. The security severity is rated as Low by Chromium. No specific exploit information is pr...

CVE-2026-106422

Incorrect authorization in API in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to bypass web origin policy via a crafted HTML page. Chromium security severity: Low...

RedditC2

RedditC2 Abuser de l'API Reddit pour héberger le trafic C2, car la plupart des membres de l'équipe bleue utilisent Reddit, cela pourrait être un excellent moyen de rendre le trafic légitime. 🚫 Avertissement : L'utilisation de ce projet est réservée à des fins éducatives/de test. L'utiliser sur de...

CVE-2026-106208

Missing authorization in API in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to leak sensitive information via a crafted Chrome extension. Chromium security severity: Medium...

CVE-2026-106420

Incorrect calculation in API in Google Chrome on on Windows prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted Chrome extension. Chromium security severity: Medium...

CVE-2026-106208

Google Chrome versions prior to 155.0.8059.39 are vulnerable to an improper authorization flaw within its API. A remote attacker can leverage social engineering to trick a user into installing a crafted Chrome extension , which can then be used to leak sensitive information . No specific exploit ...

CVE-2025-27007-OttoKit-exploit

CVE-2025-27007: OttoKit SureTriggers 권한 상승 취약점 CVE-2025-27007의 악용: WordPress용 OttoKit 플러그인이전 명칭 SureTriggers의 무단 권한 상승 취약점입니다. 이 리포지토리는 공격자가 취약한 WordPress 사이트에서 관리자 계정을 생성할 수 있는 방법을 설명합니다. 영향을 받는 버전 OttoKit SureTriggers의 모든 버전 ≤ 1.0.82. 버전 1.0.83 에서 수정됨. 악용 조건 다음 상황에서 취약점이 악용될 수 있습니다: 1. OttoKit가...

CVE-2025-25257

Содержание Обзор Детали уязвимости Доказательство концепции PoC Trolled2 Trolled3 Обзор CVE-2025-25257 — это уязвимость SQL-инъекции до аутентификации в Fortinet FortiWeb Fabric Connector версий 7.0–7.6.x. Эта ошибка позволяет злоумышленникам внедрять вредоносные SQL-команды в уязвимую конечную...