CVE-2026-9198

CVE-2026-9198 Causa de la vulnerabilidad: IBM Langflow OSS es un software de código abierto diseñado específicamente para construir y desplegar flujos de trabajo automatizados de agentes IBM Langflow OSS 1.0.0 a 1.10.0 tiene el inicio de sesión automático habilitado por defecto autologin es true ...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: gdm (UTSA-2026-093042)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-093042 advisory. A flaw was found in GDM in versions prior to 3.38.2.1. A race condition in the handling of session shutdown makes it possible to bypass the lock screen for a user th...

CVE-2026-3614

The AcyMailing plugin for WordPress is vulnerable to privilege escalation in all versions From 9.11.0 up to, and including, 10.8.1 due to a missing capability check on the wpajaxacymailingrouter AJAX handler. This makes it possible for authenticated attackers, with Subscriber-level access and...

EUVD-2026-23188

The AcyMailing plugin for WordPress is vulnerable to privilege escalation in all versions From 9.11.0 up to, and including, 10.8.1 due to a missing capability check on the wpajaxacymailingrouter AJAX handler. This makes it possible for authenticated attackers, with Subscriber-level access and...

CVE-2026-3614

The AcyMailing plugin for WordPress is vulnerable to privilege escalation in all versions From 9.11.0 up to, and including, 10.8.1 due to a missing capability check on the wpajaxacymailingrouter AJAX handler. This makes it possible for authenticated attackers, with Subscriber-level access and...

CVE-2026-3614 AcyMailing 9.11.0 - 10.8.1 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation

The AcyMailing plugin for WordPress is vulnerable to privilege escalation in all versions From 9.11.0 up to, and including, 10.8.1 due to a missing capability check on the wpajaxacymailingrouter AJAX handler. This makes it possible for authenticated attackers, with Subscriber-level access and...

CVE-2026-3614

The CVE-2026-3614 entry concerns the AcyMailing plugin for WordPress, affected versions 9.11.0 through 10.8.1. The root cause is a missing capability check on the wp_ajax_acymailing_router AJAX handler, enabling privilege escalation from Subscriber-level (and above) to admin-level controllers, in...

CVE-2026-3614 AcyMailing 9.11.0 - 10.8.1 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation

The AcyMailing plugin for WordPress is vulnerable to privilege escalation in all versions From 9.11.0 up to, and including, 10.8.1 due to a missing capability check on the wpajaxacymailingrouter AJAX handler. This makes it possible for authenticated attackers, with Subscriber-level access and...

Serendipity has a Host Header Injection allows authentication cookie scoping to attacker-controlled domain in functions_config.inc.php

Summary The serendipitysetCookie function uses $SERVER'HTTPHOST' without validation as the domain parameter of setcookie. An attacker can force authentication cookies — including session tokens and auto-login tokens — to be scoped to an attacker-controlled domain, facilitating session hijacking...

EUVD-2021-25588

Malware in sbrugna...

EUVD-2017-3741

Malware in sbrugna...

EUVD-2010-5043

Malware in sbrugna...

EUVD-2020-20336

Malware in sbrugna...

EUVD-2007-4551

Malware in sbrugna...

EUVD-2022-1471

Malicious code in bioql PyPI...

Linux Distros Unpatched Vulnerability : CVE-2021-39210

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GLPI is a free Asset and IT management software package. In versions prior to 9.5.6, the cookie used to store the autologin cookie when a user uses the remember...

Linux Distros Unpatched Vulnerability : CVE-2020-27837

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in GDM in versions prior to 3.38.2.1. A race condition in the handling of session shutdown makes it possible to bypass the lock screen for a us...

CVE-2025-51054

Vedo Suite 2024.17 is vulnerable to Incorrect Access Control, which allows remote attackers to obtain a valid high privilege JWT token without prior authentication via sending an empty HTTP POST request to the /autologin/ API endpoint...

Windows-Privilege-Escalation

Windows-Privilege-Escalation Here is my step-by-step windows privlege escalation methodology. This guide assumes you are starting with a very limited shell like a webshell, netcat reverse shell or a remote telnet connection. First things first and quick wins Do some basic enumeration to figure ou...

CVE-2021-39210

GLPI is a free Asset and IT management software package. In versions prior to 9.5.6, the cookie used to store the autologin cookie when a user uses the "remember me" feature is accessible by scripts. A malicious plugin that could steal this cookie would be able to use it to autologin. This issue ...