CVE-2026-76454

A vulnerability in the Cisco Smart Licensing Utility API of Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem SSM On-Prem, could allow an unauthenticated, remote attacker to write arbitrary files to the system or cause a DoS condition on an affected application. This...

CVE-2026-62253

Homer is open source telecom observability software. Prior to version 11.0.283, both JWT middleware functions JWTMiddleware and JWTMiddlewareV4 immediately return nextc when jwtSecret == "". The JWT secret defaults to an empty string. On a default installation, all protected API endpoints under...

CVE-2026-20321

A vulnerability in the web-based management API for Cisco Application Policy Infrastructure Controller APIC could allow an authenticated, remote attacker to execute arbitrary commands as the root user. To exploit this vulnerability, the attacker must have valid administrative credentials. This...

Exploit for Interpretation Conflict in Wordpress

wp2shell-PoC ⚠ This tool is created solely for education...

DRUPAL-CONTRIB-2026-207

This module enables you to add an extra layer of verification for user login flow. The Two Factor Authentication - TFA / Passwordless Login module for Drupal contains a vulnerability in the headless login endpoint that can disclose the site's stored miniOrange customer API key to unauthenticated...

qemu

QEMU 自述文件 QEMU 是一个通用且开源的全机器与用户空间模拟器及虚拟化器。 QEMU 能够在不依赖硬件虚拟化支持的情况下，通过软件模拟完整机器。借助动态翻译技术，它能获得非常好的性能。QEMU 还可以与 Xen 和 KVM 虚拟机监控器集成，在提供模拟硬件的同时，让虚拟机监控器管理 CPU。借助虚拟机监控器支持，QEMU 可以在 CPU 方面达到接近原生的性能。当 QEMU 直接模拟 CPU 时，它能够在一台机器（例如 x8664 PC 主板）上运行专为另一台机器（例如 ARMv7 开发板）设计的操作系统。 QEMU 还能够为 Linux 和 BSD 内核接口提供用户空间 API...

CVE-2026-107273

Gophish 0.11.0 through 0.12.1 contains a server-side request forgery vulnerability that allows authenticated low-privileged users to reach loopback and private hosts via POST /api/import/site. Attackers can submit internal URLs, which the default dialer deny list does not block, to read service...

CVE-2026-107270

Gophish through 0.12.1 contains an insecure direct object reference vulnerability that allows authenticated users to take over other users' groups, templates, landing pages and sending profiles. Attackers can supply another user's sequential id in POST requests to /api/groups/, /api/templates/,...

CVE-2026-107272

Gophish through 0.12.1 contains stored and reflected cross-site scripting vulnerabilities that allow attackers to inject script by returning malicious SMTP server error messages. Attackers controlling or intercepting a sending profile's SMTP server can execute script when administrators view...

CVE-2026-107207

LMCache through 0.5.5 contains a server-side request forgery vulnerability in its frontend monitoring service that allows unauthenticated attackers to bypass the proxy allowlist by registering arbitrary hosts. Attackers can add entries via POST /api/proxies and then use /proxy or /proxy2 to reach...

CVE-2026-107205

LMCache through 0.5.5 contains a missing authentication vulnerability in the multiprocess coordinator that allows remote unauthenticated attackers to access its HTTP fleet control API listening on all interfaces by default. Attackers can register or deregister instances via /instances, overwrite...

CVE-2026-76471 Cisco NX-OS Software NX-API Remote Code Execution Vulnerability

A vulnerability in the NX-API feature of Cisco NX-OS Software could allow an unauthenticated, remote attacker to execute arbitrary code with root privileges or cause a denial of service DoS condition on an affected device. The vulnerability is due to insufficient input validation of data that is...

CVE-2026-76471

A vulnerability in the NX-API feature of Cisco NX-OS Software allows an unauthenticated, remote attacker to execute arbitrary code with root privileges or cause a denial of service (DoS) . The root cause is insufficient input validation of data sent to the NX-API. An attacker can exploit this by ...

EUVD-2026-94461

A vulnerability in the NX-API feature of Cisco NX-OS Software could allow an unauthenticated, remote attacker to execute arbitrary code with root privileges or cause a denial of service DoS condition on an affected device. The vulnerability is due to insufficient input validation of data that is...

CVE-2026-76471 Cisco NX-OS Software NX-API Remote Code Execution Vulnerability

A vulnerability in the NX-API feature of Cisco NX-OS Software could allow an unauthenticated, remote attacker to execute arbitrary code with root privileges or cause a denial of service DoS condition on an affected device. The vulnerability is due to insufficient input validation of data that is...

Homer: Authenticated SQL Injection via Unvalidated rawquery Field in /api/v4/statistics/query

Summary The V4StatisticsQuery handler passes the user-supplied rawquery field directly to DuckDB without calling the sqlvalidator.ValidateRawSQL function used throughout the rest of the codebase. Any authenticated user can execute arbitrary SQL statements against all data accessible through the...

GHSA-F46Q-3V67-FMM4 Homer: Authenticated SQL Injection via Unvalidated rawquery Field in /api/v4/statistics/query

Summary The V4StatisticsQuery handler passes the user-supplied rawquery field directly to DuckDB without calling the sqlvalidator.ValidateRawSQL function used throughout the rest of the codebase. Any authenticated user can execute arbitrary SQL statements against all data accessible through the...

CVE-2026-76454

A vulnerability exists in the Cisco Smart Licensing Utility API of Cisco License On-Prem (formerly Cisco Smart Software Manager On-Prem). Due to improper input validation and a lack of authentication in the management API, an unauthenticated remote attacker can send a crafted request to write arb...

CVE-2026-76454 Cisco Smart Software Manager On-Prem Unauthenticated API Vulnerability

A vulnerability in the Cisco Smart Licensing Utility API of Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem SSM On-Prem, could allow an unauthenticated, remote attacker to write arbitrary files to the system or cause a DoS condition on an affected application. This...

CVE-2026-76454 Cisco Smart Software Manager On-Prem Unauthenticated API Vulnerability

A vulnerability in the Cisco Smart Licensing Utility API of Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem SSM On-Prem, could allow an unauthenticated, remote attacker to write arbitrary files to the system or cause a DoS condition on an affected application. This...