CVE-2026-94544 Next.js: Pending `use cache` fill can leak Draft Mode content into regular responses and persisted pages

Next.js is a React framework for building full-stack web applications. From 16.3.0 until 16.3.8, pending use cache fills for the same key are shared without separating Draft Mode requests from regular requests. An overlapping regular request can receive unauthenticated unpublished content from an...

CVE-2026-94544 Next.js: Pending `use cache` fill can leak Draft Mode content into regular responses and persisted pages

Next.js is a React framework for building full-stack web applications. From 16.3.0 until 16.3.8, pending use cache fills for the same key are shared without separating Draft Mode requests from regular requests. An overlapping regular request can receive unauthenticated unpublished content from an...

CVE-2026-94544

The Next.js React framework (versions 16.3.0 through 16.3.8 ) contains a flaw where pending use cache fills for the same key do not properly separate Draft Mode requests from regular requests. Under concurrent request conditions, this lack of separation allows an unauthenticated user to receive u...

EUVD-2026-91668

Next.js is a React framework for building full-stack web applications. From 16.3.0 until 16.3.8, pending use cache fills for the same key are shared without separating Draft Mode requests from regular requests. An overlapping regular request can receive unauthenticated unpublished content from an...

CVE-2026-3844

╔════════════════════════════════════════════════════════════╗ ║ CVE-2026-3844 ║ ║ Breeze Cache = 2.4.4 Arbitrary File Upload ║ ║ Unauthenticated RCE | Authorized Lab Use Only ║ ╚════════════════════════════════════════════════════════════╝ 概述 CVE-2026-3844 是一个任意文件上传漏洞，影响存在漏洞版本的 Breeze Cache...

the-token-was-a-row-number-cve-2026-67602-phpipam-rest-api-authentication-bypass

CVE-2026-67602 — phpIPAM row id=2, appsecurity=sslcode 2 fetchobject'api','appcode','2' phpipam-token header - OBJECT cache hit! 3 $appid == $apptemp-appid - AUTHENTICATED $ php poccachecollision.php fixed 2 fetchobject'api','appcode','2' phpipam-token header - false 3 Response: 401 Unauthorized ...

CVE-2024-28000

CVE-2024-28000 - LiteSpeed Cache 权限提升 PoC !WARNING 本仓库仅供教育和研究目的使用 。 仅在您拥有的系统 上或获得明确许可 的情况下使用所提供的 PoC。 未经授权的访问 、利用或滥用本仓库中的任何材料均属违法行为 。 作者对因不当使用而导致的任何损害、滥用或法律后果不承担任何责任 。 概述 CVE-2024-28000 是一个严重的未认证权限提升漏洞 ，影响 WordPress 的 LiteSpeed Cache 插件。该漏洞源于插件爬虫角色模拟功能中基于哈希的弱认证机制 ，允许完全未认证的攻击者冒充 WordPress...

cve-2026-31431

CVE-2026-31431 — Copy Fail: Linux Kernel LPE 研究ラボ 教育目的のみ。明示的な許可なしにシステムで使用しないでください。 目次 脆弱性の説明 影響を受けるコンポーネント 動作の仕組み ラボのセットアップ（Docker） PoC — デモ 緩和策 参考文献 脆弱性の説明 フィールド| 値 ---|--- CVE| CVE-2026-31431 Alias| Copy Fail CVSS| 7.8 High タイプ| Local Privilege Escalation LPE 影響を受けるカーネル| 2017 – 2026 commit...

FlaskCache_CVE-2021-33026_POC

Pickleシリアライゼーションのリモートコード実行 - Redis Poisoning PoCエクスプロイト Redisサーバーが起動しているか確認 redis-cli -h 127.0.0.1 -p 6379 ping redis-cli keys redis-cli get Keyid ポート10001でnetcatのリスニングを開始: nc -nvlp 10001 Flask Chache の環境を設定する python -m venv venvflaskcache source venvflaskcache\scripts\activate pip install -r Fla...

CVE-2026-87920

The W3 Total Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via Output-Buffer Regex Rewrite in all versions up to, and including, 2.10.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

EUVD-2026-91335

The W3 Total Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via Output-Buffer Regex Rewrite in all versions up to, and including, 2.10.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

CVE-2026-87920 W3 Total Cache <= 2.10.6 - Unauthenticated Stored Cross-Site Scripting via Comment Content

The W3 Total Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via Output-Buffer Regex Rewrite in all versions up to, and including, 2.10.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

CVE-2026-87920

The W3 Total Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 2.10.6 . The root cause is insufficient input sanitization and output escaping within the Comment Content via Output-Buffer Regex Rewrite . This flaw allows unauthenticat...

httpd: httpd: HTTP response smuggling via crafted Transfer-Encoding response in mod_proxy_uwsgi

A flaw was found in the modproxyuwsgi module of Apache HTTP Server. This issue allows HTTP response smuggling when the server processes a crafted uWSGI response containing a Transfer-Encoding header. A remote attacker can exploit this vulnerability to desynchronize HTTP communications, potentiall...

WordPress W3 Total Cache plugin <= 2.10.6 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by theviper17y in WordPress Plugin W3 Total Cache versions = 2.10.6...

CVE-2026-11101-HTTP-Cache-Poisoning-via-Unkeyed-Query-Parameter

CVE-2026-11101 – 通过未键控查询参数的 HTTP 缓存投毒 概述 Web 缓存仅使用 URL 路径作为缓存键，而忽略查询参数。攻击者可以向未键控参数（例如 utmcampaign）附加恶意载荷并投毒缓存。后续访客将收到包含任意 JavaScript 的已投毒响应。 漏洞详情 类型： Web 缓存投毒 影响： 存储型 XSS、凭据窃取、网页篡改。 根本原因： 缓存键排除了会影响响应主体的查询字符串参数，从而允许攻击者存储精心构造的响应并将其提供给所有用户。 漏洞利用演示 1. 启动存在漏洞的缓存服务器： pip install flask python...

cve-2026-75604

CVE-2026-75604 - Next.js path traversal → RCE Windows · research lab Reproduction lab and exploit tooling for CVE-2026-75604 , an unauthenticated path-traversal in the Next.js incremental cache that affects Windows hosts. A single un-escaped backslash lets an attacker read and write files outside...

LiteSpeed Cache <= 6.4.1 - Sensitive Information Exposure

The LiteSpeed Cache plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 6.4.1 through the debug.log file that is publicly exposed. This makes it possible for unauthenticated attackers to view potentially sensitive information contained in the...

DirtyClone

DirtyClone DirtyCloneは、C言語で書かれた診断用・概念実証のローカル特権昇格ツールです。このツールは、ソース内でCVE-2026-43503として記述されているカーネル/XFRM関連のエクスプロイトパスを対象としており、管理された環境での許可されたセキュリティ研究のみを目的としています。 概要 このリポジトリには以下が含まれています: dirtyclone.c – エクスプロイトの実装全体 README.md – 使用法と環境ガイダンス 現在の実装は以下の高レベルな手順を実行します: 分離されたユーザー名前空間とネットワーク名前空間を作成...

CVE-2026-63718

A flaw was found in the modproxyuwsgi module of Apache HTTP Server. This issue allows HTTP response smuggling when the server processes a crafted uWSGI response containing a Transfer-Encoding header. A remote attacker can exploit this vulnerability to desynchronize HTTP communications, potentiall...