CVE-2025-65669

CVE-2025-65669 Un problème a été découvert dans classroomio 0.1.13. Les comptes étudiants peuvent supprimer des cours depuis la page Explore sans aucune vérification d'autorisation ou d'authentification, contournant la restriction de suppression normalement réservée aux administrateurs. Découvert...

Flowise-CVE-2025-58434-PasswordReset

CVE-2025-58434 - Flowise AI Unauthenticated Password Reset Overview CVE ID: CVE-2025-58434 Affected Software: Flowise AI Vulnerable Versions: = 3.0.5 Fixed Version: 3.0.6 and later Severity: Critical Author: arensballiu Date: 2025 Description Flowise AI versions up to and including 3.0.5 contain ...

Linux Distros Unpatched Vulnerability : CVE-2026-71886

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In Bouncy Castle for Java before 1.86, the high-level OpenPGP certificate API accepted a third-party certification or trust delegation from any component key of...

CVE-2026-39717 WordPress LearnPress plugin <= 4.4.9.1 - Broken Access Control vulnerability

Missing Authorization vulnerability in ThimPress LearnPress learnpress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LearnPress: from n/a through 4.4.9.1...

WordPress LearnPress plugin <= 4.4.9.1 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin LearnPress versions = 4.4.9.1...

WordPress WDS MCP Content Manager plugin <= 3.10.4 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin WDS MCP Content Manager versions = 3.10.4...

CVE-2026-39439 WordPress WebSamurai plugin <= 1.0.7 - Broken Access Control vulnerability

Missing Authorization vulnerability in Kiera Howe WebSamurai websamurai allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WebSamurai: from n/a through 1.0.7...

WordPress WebSamurai plugin <= 1.0.7 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin WebSamurai versions = 1.0.7...

CVE-2026-32585 WordPress Airano MCP Bridge plugin <= 2.11.0 - Broken Access Control vulnerability

Missing Authorization vulnerability in airano Airano MCP Bridge airano-mcp-bridge allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Airano MCP Bridge: from n/a through 2.11.0...

WordPress Airano MCP Bridge plugin <= 2.11.0 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Airano MCP Bridge versions = 2.11.0...

WordPress IATO MCP plugin <= 1.11.0 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin IATO MCP versions = 1.11.0...

CVE-2026-94432

The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 5.7.1 via the OsPaypalConnectController::createorderfortransaction action registered as a public unauthenticate...

WordPress Forminator plugin <= 1.57.2 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Forminator versions = 1.57.2...

CVEs

Rhino CVE Proof-of-Concept Exploits A collection of proof-of-concept exploit scripts written by the team at Rhino Security Labs for various CVEs. CVE-2026-46546: Frappe LMS Header Tag Injection Leading to Open Redirect CVE-2026-39405: Frappe LMS Path Traversal in SCORM Package Upload Leading to...

vajra

An automated web hacking framework for web applications Table of Content About Vajra What is Vajra Key Feaures What Vajra does Installation Running with docker-compose Tools Used by Vajra Contributing License Future Plans/Under Development Credits Disclaimer FAQ Detailed insight about Vajra can b...

CVE-2026-72001-Pangolin-Cross-Org-Auth-Bypass

CVE-2026-72001 — Обход аутентификации при доступе к ресурсам между организациями в Pangolin Proof-of-concept для CVE-2026-72001 — уязвимости нарушенной авторизации на уровне объектов в Pangolin 1.22.0, которая позволяет владельцу одной share-ссылки на ресурс создать действительную сессию ресурса...

socialhunter

socialhunter !IMPORTANT Cet outil ne fonctionne plus et nous ne pourrons pas le réparer car il est devenu difficile de contourner les protections des réseaux sociaux. Parcourt l'URL donnée et trouve les liens cassés vers les réseaux sociaux qui peuvent être détournés. Les liens sociaux cassés...

socialhunter

socialhunter !IMPORTANT This tool is no longer working, and we won't be able to fix it as it has become difficult to bypass social media protections. Crawls the given URL and finds broken social media links that can be hijacked. Broken social links may allow an attacker to conduct phishing attack...

CVE-2025-15260

CVE-2025-15260 : Autorisation manquante / Contrôle d'accès brisé dans le plugin MyRewards – Points de fidélité et récompenses pour WooCommerce Avertissement : Ce dépôt est créé à des fins éducatives et de divulgation éthique uniquement. La vulnérabilité a été signalée de manière responsable au...

CVE-2026-51899

In SuperAGI v0.0.14 and prior, controller endpoints /api/agents/create, /api/agents/schedule, /api/agents/delete, /api/agents/editschedule, /api/agents/stopschedule allow authenticated users from one organization to create, schedule, edit, stop, and delete agents belonging to a different...