CVE-2026-67969

An issue in the HSMonitorApplications component of NASA cFS v7.0.1 allows attackers to force the processor to reset via supplying a crafted HS.AppMonTbl entry...

PT-2026-67116

The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.9 does not verify order ownership on a REST endpoint that performs bulk order-status changes, allowing users with a Dokan vendor account to modify the status of any WooCommerce order on the marketplace,...

PT-2026-76146

A flaw was found in LibRaw. A heap-buffer-overflow in raw2image ex caused by a maliciously crafted file may lead to an application crash...

CVE-2026-38447

osTicket 1.18.3 generates API keys using a predictable construction based on MD5 hashing. The use of MD5, combined with predictable inputs such as the current timestamp and client IP address, significantly reduces entropy. An attacker can approximate the key generation time and brute-force the ke...

PT-2026-67390

Authorization bypass through User-Controlled key vulnerability in Menulux Software Inc. Mobile App allows Software Integrity Attack. This issue affects Mobile App: through 12.05.2026...

CVE-2026-67969

An issue in the HS_MonitorApplications() component of NASA cFS v7.0.1 allows attackers to force a processor reset. The vulnerability is triggered by supplying a crafted HS.AppMon_Tbl entry . No specific remediation, exploit links, or MITRE ATT&CK IDs are provided in the documents.

PT-2026-67115

The Academy LMS WordPress plugin before 3.8.3 does not verify course enrollment or lesson publication status when returning a single lesson through its REST API, allowing users with a self-service student Subscriber-level account to disclose the content of arbitrary lessons, including lessons of...

offensive-security-labs

Offensive Security Labs A collection of hands-on offensive cy...

toolbox v0.2.1

-Significant%20AI%2C%20fully%20reviewed-1f77b4 MCP-based application security testing tools for your coding agent. Not a scanner — a collaborative workbench. Agents struggle with UI and stateful APIs; you're good at both. Sectool lets you explore an application through its proxy while an agent...

CVE-2026-13389

The webtoffee-cookie-consent WordPress plugin before 3.5.3 does not perform authorization checks on several of its REST API routes, allowing unauthenticated attackers to export and delete stored visitor consent records, create posts, and modify the webtoffee-cookie-consent WordPress plugin before...

Arbitrary File Read

Action Pack Active Storage is vulnerable to Arbitrary File Read. The vulnerability is due to unsafe libvips operations being permitted on untrusted image uploads, allowing attackers to craft malicious images that read arbitrary files accessible to the Rails process and expose sensitive applicatio...

pingap v0.13.8

pingap Before the pingap version is stable, no pull requests will be accepted. If you have any questions, please create a new issue first. Overview Pingap is a high-performance reverse proxy powered by the Cloudflare Pingora . It simplifies operational management by enabling dynamic, zero-downtim...

Exploit for CVE-2026-53625

CVE-2026-53625 - GLPI Privilege Escalation via authtype Manipula...

Security Bulletin: There is a vulnerability in IBM WebSphere Application Server used by IBM Maximo Manage application in IBM Maximo Application Suite (CVE-2025-14915)

Summary There is a vulnerability in IBM WebSphere Application Server used by IBM Maximo Manage application in IBM Maximo Application Suite. Vulnerability Details CVEID:CVE-2025-14915 DESCRIPTION: IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.3 IBM WebSphere Application Server...

Tianwen-ERP-Upload-PoC

Tianwen Property ERP — Unauthenticated File Upload CVE: P...

Security Bulletin: Security vulnerability has been found in IBM Application Gateway Operator

Summary Security vulnerability has been addressed in IBM Application Gateway Operator Vulnerability Details CVEID:CVE-2026-17617 DESCRIPTION: The IBM Application Gateway Operator is vulnerable to Server-Side Request Forgery SSRF due to insufficient validation of URLs specified in custom resources...

Security Bulletin: Multiple vulnerabilities have been identified in IBM WebSphere Application Server used by IBM Rational ClearQuest (CVE-2026-14974, CVE-2026-14515)

Summary IBM WebSphere Application Server is used by the IBM Rational ClearQuest server. Information about security vulnerabilities affecting IBM WebSphere Application Server has been published in a security bulletin. Vulnerability Details Refer to the security bulletins listed in the...

CVE-2026-34490

Cleartext storage of sensitive information vulnerability in Johnson Controls XAAP Application on Android allows an attacker on a jailbroken or otherwise compromised device to Retrieve Sensitive Data. This issue affects XAAP Application: before 1.53...

ricerca-tesi — Updated!

thesis-research Research resources for cve-2026-7228 Tools VirtualBox installation Installation of VirtualBox: https://www.virtualbox.org/wiki/Downloads Windows 11 ISO installation https://www.microsoft.com/it-it/software-download/windows11 Linux distro installation: Lubuntu...

CVE-2026-34490

Cleartext storage of sensitive information vulnerability in Johnson Controls XAAP Application on Android allows an attacker on a jailbroken or otherwise compromised device to Retrieve Sensitive Data. This issue affects XAAP Application: before 1.53...