EUVD-2026-89685

The ReactPress – Create React App for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'permalink' parameter in all versions up to, and including, 3.4.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attacker...

cve-2025-55182-lab

CVE-2025-55182 RSC lab намеренно уязвимый Локальный Docker -лаборатория для авторизованных исследований безопасности: React Server Components / Next.js App Router со стеком в уязвимом диапазоне CVE-2025-55182 React2Shell. Используйте только на своей собственной машине. Не выставляйте этот контейн...

CVE-2025-70600---Urve-Smart-Office---Stored-XSS-in-iOS-App

URVE Smart Office iOS — Хранимая XSS через HTML-поле плитки PoC Этот репозиторий содержит доказательство концепции PoC для хранимой межсайтовой уязвимости XSS , затрагивающей iOS-приложение URVE Smart Office. Из-за недостаточной проверки входных данных злоумышленник может внедрить JavaScript в...

CVE-2024-47167-Environment-Setup

Компоненты: 1. gradiocontainer: размещает внутренний HTTP-сервер на порту 5678 2. targetinternalserver: запускает Python-приложение с использованием уязвимой версии gradio 4.40.0...

WordPress Product Designer App plugin <= 1.1.3 - Unauthenticated Arbitrary File Read vulnerability

Unauthenticated Arbitrary File Read vulnerability discovered by Sebastian Albrecht mySebbe in WordPress Plugin Product Designer App versions = 1.1.3...

Malicious code in ai-workshop-radio-app (npm)

ai-workshop-radio-app is a dependency-confusion package: it takes a name that looks like an internal project, uses an inflated version 100.0.0 so it outranks private-registry versions, and runs node setup.js || true as a preinstall script on npm install. setup.js sends the hostname, username,...

MAL-2026-17428 Malicious code in ai-workshop-radio-app (npm)

ai-workshop-radio-app is a dependency-confusion package: it takes a name that looks like an internal project, uses an inflated version 100.0.0 so it outranks private-registry versions, and runs node setup.js || true as a preinstall script on npm install. setup.js sends the hostname, username,...

Linux Distros Unpatched Vulnerability : CVE-2026-81842

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An authenticated user with edit permission on one folder can move a library panel into another folder where they only have view permission, through the library...

CVE-2026-55224: Improper Limitation of a Pathname to a Restricted Directory

MineAdmin is a ready-to-use backend management system suitable for quickly building website backends, operation platforms, permission centers, internal management systems, CMS, CRM, OA, ERP and other business applications. Prior to version 3.2.0-alpha.2, the app-store plugin service concatenates...

CVE-2026-81842

An authenticated user with edit permission on one folder can move a library panel into another folder where they only have view permission, through the library elements API or the equivalent App Platform resource. The update path did not check library panel create permission on the destination...

CVE-2026-81842

An authenticated user with edit permission on one folder can exploit an incorrect authorization flaw to move a library panel into another folder where they only possess view permission . This occurs because the update path fails to verify library panel create permissions on the destination folder...

CVE-2026-81842 Library panel can be moved into a folder without library panel create permission

An authenticated user with edit permission on one folder can move a library panel into another folder where they only have view permission, through the library elements API or the equivalent App Platform resource. The update path did not check library panel create permission on the destination...

EUVD-2026-89460

An authenticated user with edit permission on one folder can move a library panel into another folder where they only have view permission, through the library elements API or the equivalent App Platform resource. The update path did not check library panel create permission on the destination...

CVE-2021-33699_Task_Hijacking

CVE-2021-33699TaskHijacking Что это? Приложение атакующего и приложение жертвы для практики уязвимости CVE-2021-33699Task Hijacking. Ссылка https://naro-security.tistory.com/55...

Malicious code in @hrmony/app-gateway-templates (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c7d3f05113dd7daa9fac2da8187afecc751fafcf96449e7f4eb4a5d9a4878844 On require/import of @hrmony/app-gateway-templates, index.js the package main executes an exfiltration routine against a hardcoded attacker endpoint ...

CVE-2025-66478-POC

CVE-2025-66478: концептуальное доказательство 中文版本 / Chinese Version 漏洞概述 CVE-2025-66478 是一个影响 Next.js 应用程序的严重远程代码执行 RCE 漏洞，源于 React Server Components RSC 协议中的不安全反序列化问题。该漏洞的 CVSS 评分为 10.0 （最高级别），允许未经身份验证的攻击者通过特制的 HTTP 请求在易受攻击的服务器上执行任意代码。 技术细节 漏洞根源 该漏洞源于上游 React 实现中的不安全反序列化逻辑（CVE-2025-55182），并影响使用...

SafeForge

SafeForge – Где приложения создаются с доверием SafeForge — это открытый центр мобильных приложений , построенный на GitLab, который позволяет разработчикам создавать, загружать, делиться и совместно работать над мобильными приложениями в безопасной, проверенной ИИ и полностью зашифрованной...

nextjs-security-update

nextjs-security-update Есть люди, создающие OSS-инструменты для эксплуатации новых уязвимостей Next.js. Этот инструмент — ответный удар: он максимально упрощает обновление всех ваших Next.js-приложений во всех ваших GitHub-аккаунтах. Под капотом используется официальный инструмент исправления от...

Security Bulletin: IBM App Connect Enterprise is vulnerable to multiple vulnerabilities due to undici and nodemailer.

Summary IBM App Connect Enterprise Runtime is vulnerable to multiple vulnerabilities due to undici and nodemailer. Vulnerability Details CVEID:CVE-2026-13697 DESCRIPTION: undici's cache interceptor mishandles malformed Cache-Control private directives. In undici 7.0.0 up to before 7.29.0 and 8.0....

Security Bulletin: IBM App Connect Enterprise is vulnerable to multiple vulnerabilities due to Node.js module tar (CVE-2026-59871, CVE-2026-59873, CVE-2026-59874 and CVE-2026-59875)

Summary IBM App Connect Enterprise Connector Discovery and OpenAPI Editor, IBM App Connect Enterprise Discovery Connectors and IBM App Connect Enterprise runtime are vulnerable to multiple vulnerabilities due to Node.js module tar. Vulnerability Details CVEID:CVE-2026-59871 DESCRIPTION: node-tar ...