PT-2026-84388

Name of the Vulnerable Software and Affected Versions Elasticsearch affected versions not specified Description Deserialization of untrusted data in the machine learning component allows remote code execution through object injection. An attacker can use a specially crafted trained model artifact...

PT-2026-84425

Name of the Vulnerable Software and Affected Versions HPE Networking Fabric Composer affected versions not specified Description Authenticated remote attackers can perform SQL injection attacks against the API of the HPE Networking Fabric Composer. This flaw allows the attacker to retrieve and...

PT-2026-84427

Name of the Vulnerable Software and Affected Versions HPE Networking Fabric Composer affected versions not specified Description A privilege escalation issue exists in the web-based management interface. This flaw allows an authenticated user with low-privilege operator permissions to perform...

PT-2026-84426

Name of the Vulnerable Software and Affected Versions HPE Networking Fabric Composer affected versions not specified Description Command injection flaws in the web-based management interface allow an authenticated remote attacker to execute arbitrary commands as a privileged user on the underlyin...

CVE-2026-77353 Wallos: iCalendar Injection via CRLF in Subscription Name/Notes Export

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 5.0.0, Wallos allows authenticated users to inject arbitrary iCalendar properties and events into their exported .ics feed by embedding raw CRLF sequences in subscription names or notes. Because the input...

CVE-2026-82882 Devtron through 2.2.0 Missing Authorization via webhook API token endpoint

Devtron through 2.2.0 fails to enforce authorization checks on the GET /orchestrator/api-token/webhook endpoint, allowing authenticated users to retrieve admin API tokens. Attackers with any authenticated account can query the endpoint with arbitrary project, environment, and application paramete...

CVE-2026-61638 Wallos: SSRF via Test Email Notification - unvalidated SMTP host/port

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.6, POST /endpoints/notifications/testemailnotifications.php accepts smtpaddress and smtpport from POST body with zero SSRF validation. PHPMailer connects to attacker-supplied host:port. Every other...

CVE-2026-61638

CVE-2026-61638 affects Wallos , an open-source, self-hostable personal subscription tracker. Prior to version 4.9.6 , the endpoint POST /endpoints/notifications/testemailnotifications.php accepts smtpaddress and smtpport from the request body with no SSRF validation , allowing PHPMailer to connec...

CVE-2026-2005

CVE-2026-2005 — Переполнение кучи в pgcrypto PostgreSQL Целевой коммит: 4b324845ba5d24682b9b3708a769f00d160afbd7 PostgreSQL 18.1 — уязвимая версия Сводка Поле| Детали ---|--- CVE| CVE-2026-2005 Тип| Переполнение буфера в куче Компонент| contrib/pgcrypto/pgp-pubdec.c — pgpparsepubencsesskey...

WordPress Charitable plugin <= 1.8.12.1 - Authenticated (Contributor+) SQL Injection via 'order' Shortcode Attribute vulnerability

Authenticated Contributor+ SQL Injection via 'order' Shortcode Attribute vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin Charitable versions = 1.8.12.1...

CVE-2019-5475-EXP

CVE-2019-5475-EXP CVE-2019-5475-EXP 【Nexus Repository Manager 2.x ثغرة تنفيذ الأوامر عن بُعد】 اسم الثغرة: Nexus Repository Manager 2.x ثغرة تنفيذ الأوامر عن بُعد وصف الثغرة: يوجد في Nexus Repository Manager 2.X ثغرة تنفيذ أوامر عن بُعد؛ إذ تتضمن هذه الثغرة افتراضيًا حسابًا بصلاحيات نشر، وبعد تسجي...

CVE-2023-34468

CVE-2023-34468: Apache NiFi में DB घटकों के माध्यम से रिमोट कोड निष्पादन Apache NiFi 0.0.2 से 1.21.0 में DBCPConnectionPool और HikariCPConnectionPool कंट्रोलर सेवाएँ एक प्रमाणित और अधिकृत उपयोगकर्ता को H2 ड्राइवर के साथ डेटाबेस URL कॉन्फ़िगर करने की अनुमति देती हैं, जो कस्टम कोड निष्पादन सक्षम कर...

CVE-2022-30023

CVE-2022-30023 Tenda HG9 राउटर पर प्रमाणित कमांड इंजेक्शन उपयोग root@kitploit: git clone https://github.com/Haniwa0x01/CVE-2022-30023 cd CVE-2022-30023 python exploit.py -u http://target -U "user" -P "password" उदाहरण root@kitploit: pc@pc-note:/CVE-2022-30023/$ python3 exploit.py -u...

CVE-2023-20273

CVE-2023-20273 CVE-2023-20273 शोषण PoC उपयोग root@kitploit: usage: exploit.py -h -t URL -u Username -p Password -c Command | -r -dest Outfile -www | -tcp | -null -ip LocalIP -port LocalPort -fs filesystem -path filepath -operation operationtype -v -q CVE-2023-20273 Exploit PoC options: -h, --help...

CVE-2026-82877 ILIAS Arbitrary File Read via SOAP addFile

ILIAS before versions 9.22, 10.10, and 11.3 contains an arbitrary file read vulnerability in the SOAP addFile method that allows authenticated users to read server files by supplying crafted XML with COPY-mode imports. Attackers can construct absolute file paths through an unsandboxed import...

CVE-2026-40463

WaveSuite (Nokia) is affected by an insufficient role-based access control vulnerability in the CPB Log Files feature. An authenticated low-privilege user can load pages restricted to higher-privilege roles by requesting the corresponding URL directly in the browser, resulting in a CVSS 3.1 score...

CVE-2026-34197

CVE-2026-34197 - Apache ActiveMQ Jolokia रिमोट कोड निष्पादन RCE CVE-2026-34197 एक उच्च गंभीरता वाली रिमोट कोड निष्पादन RCE भेद्यता है जो Apache ActiveMQ Classic को प्रभावित करती है। यह समस्या Jolokia JMX-HTTP ब्रिज में मौजूद है, जो /api/jolokia/ एंडपॉइंट के माध्यम से HTTP पर प्रबंधन संचालन को उजा...

CVE-2018-14714-RCE-exploit

CVE-2018-14714 RCE PoC ثغرة RCE في راوتر ASUS اللاسلكي إثبات المفهوم هذا لأغراض التعلم والبحث فقط. لا تستخدمه في أنشطة غير قانونية؛ أنت وحدك المسؤول عن أي عواقب قانونية. هذا اختبار تم إجراؤه بعد تعديلات الكود بناءً على إثبات المفهوم هذا، حيث أن إثبات المفهوم الأصلي قد فشل بسبب عدم وجود صلاحيات...

Linux Distros Unpatched Vulnerability : CVE-2026-18702

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue in MongoDB Server could allow an authenticated user with limited, database-scoped privileges to modify diagnostic logging settings that affect the enti...

Linux Distros Unpatched Vulnerability : CVE-2026-18705

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue in MongoDB Server's Atlas Vector Search feature could allow an authenticated user with read access to one view to retrieve documents from a different,...