CVE-2025-14018

CVE-2025-14018: NetBT e-Fatura Privilege Escalation Vulnerability 📋 General Information Parameter| Value ---|--- CVE ID| CVE-2025-14018 Vulnerability Type| Local Privilege Escalation Unquoted Service Path CWE| CWE-428 Affected Product| NetBT e-Fatura Vulnerable Versions| 1.2.15 Exploit Author|...

Cisco Warns of New Zero-Day ISE Auth Bypass (CVSS 10.0) Exploited in Active Attacks

Cisco has warned of a fresh maximum-severity security flaw impacting Identity Services Engine ISE that has come under active exploitation. The vulnerability, tracked as CVE-2026-76460 CVSS score: 10.0, could allow an unauthenticated, remote attacker to bypass authentication. "This vulnerability i...

CVE-2025-63353

CVE-2025-63353 PoC - FiberHome HG6145F1 Predictable Default Wi-Fi PSK Educational research toolkit and multi-language PoC for CVE-2025-63353 , a critical predictable-default-PSK vulnerability affecting FiberHome HG6145F1 RP4423 GPON ONT devices. Summary The factory default Wi-Fi pre-shared key on...

Security Bulletin: A security vulnerability has been identified in IBM WebSphere Application Server shipped with Asset and Service Management

Summary IBM WebSphere Application Server is shipped as a component of Maximo Asset Management, Maximo Industry Solutions including Maximo for Nuclear Power, Maximo for Transportation, Maximo for Life Sciences, Maximo for Oil and Gas, and Maximo for Utilities, Maximo Adapter for Primavera,...

Security Bulletin: There are multiple security vulnerability in IBM Maximo Asset Management application

Summary There are multiple security vulnerability in IBM Maximo Asset Management application Vulnerability Details CVEID:CVE-2026-59901 DESCRIPTION: Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, the Bzip2Decoder handler in...

terrapod-PoC

Terrapod: security advisory CVE status: requested, pending assignment. This finding is published as GHSA-6qrc-597p-mrp9. On CVE assignment this repository is renamed CVE-YYYY-NNNNN-terrapod-PoC and this banner is replaced with the CVE link. | ---|--- Researcher| Dostxodjayev Abdullox @squeeze440...

CVE-2025-29927

CVE-2025-29927 — Next.js Middleware Authentication Bypass Overview Imagine a bouncer in front of the club, but if you tell him "I'm already in," he lets you pass without checking. That's exactly what CVE-2025-29927 is. Middleware in Next.js runs before a request is processed, making it the ideal...

CVE-2026-91015

The Master Addons for Elementor WordPress plugin before 3.1.9 does not perform an authorization check on the AJAX action that deactivates its Popup Builder popups, relying only on a nonce that is publicly output to every visitor, allowing unauthenticated attackers to permanently disable any popup...

CVE-2026-91008

The Event Booking Manager for WooCommerce WordPress plugin before 5.3.8 does not perform an ownership or authorization check before rendering booking confirmation details, allowing unauthenticated attackers to retrieve registered attendees' personal information full name, email address, phone...

CVE-2026-49042

CVE-2026-49042 — camel-langchain4j-tools Prompt-Injection → Header-Injection Runnable proof-of-concept reproducers for the same Apache Camel vulnerability, one per runtime:...

CVE-2023-27350

PaperCut NG/MG RCE CVE-2023-27350 A streamlined Bash exploit for CVE-2023-27350. This script automates authentication bypass, environment preparation, and command injection via the PaperCut printer scripting engine. Visual Proof Basic rce: Triggering a reverse shell: Quick Start root@kitploit:...

Incorrect Authorization

Overview org.jenkins-ci.plugins:script-security is a package that allows Jenkins administrators to control what in-process scripts can be run by less-privileged users. Affected versions of this package are vulnerable to Incorrect Authorization through improper handling of collection type casting...

Incorrect Authorization

Overview org.jenkins-ci.plugins:script-security is a package that allows Jenkins administrators to control what in-process scripts can be run by less-privileged users. Affected versions of this package are vulnerable to Incorrect Authorization through the execution of unintercepted operations...

RLSA-2026:67910 Important: libevent security update

The libevent packages provide an abstract asynchronous event notification library. Security Fixes: libevent: Libevent: Denial of Service via malformed RPC data CVE-2026-63383 libevent: Libevent: Off-by-one stack buffer overflow leading to denial of service or data corruption CVE-2026-63387...

firewalld security update

An update is available for firewalld. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list firewalld is a firewall service daemon that provides a dynamic customizable...

RLSA-2026:67585 Moderate: firewalld security update

firewalld is a firewall service daemon that provides a dynamic customizable firewall with a D-Bus interface. Security Fixes: firewalld: firewalld: Local unprivileged user can modify firewall state due to D-Bus setter mis-authorization CVE-2026-4948 For more details about the security issues,...

libevent security update

An update is available for libevent. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The libevent packages provide an abstract asynchronous event notification...

CVE-2026-91015 Master Addons for Elementor < 3.1.9 - Unauthenticated Popup Deactivation via jltma_popup_disable_expired

The Master Addons for Elementor WordPress plugin before 3.1.9 does not perform an authorization check on the AJAX action that deactivates its Popup Builder popups, relying only on a nonce that is publicly output to every visitor, allowing unauthenticated attackers to permanently disable any popup...

EUVD-2026-81356

The Master Addons for Elementor WordPress plugin before 3.1.9 does not perform an authorization check on the AJAX action that deactivates its Popup Builder popups, relying only on a nonce that is publicly output to every visitor, allowing unauthenticated attackers to permanently disable any popup...

CVE-2026-91015

The Master Addons for Elementor WordPress plugin before 3.1.9 lacks a proper authorization check on the AJAX action jltma_popup_disable_expired, which deactivates its Popup Builder popups. The only safeguard is a nonce that is publicly output to every visitor, making it accessible to unauthentica...