PT-2026-107117

MultiversX's multisig-improved repository: mx-multisig-and-modules reference implementation of their on-chain multisig smart contract system contains a vulnerability where a missing independent authorization check allows any account with the Proposer role to perform explicitly barred actions. Thi...

Linux Distros Unpatched Vulnerability : CVE-2026-98171

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - smb: client: fix nextbuffer UAF and NextCommand bounds in compound PDUs Fix several related bounds checking and pointer lifecycle issues in...

Linux Distros Unpatched Vulnerability : CVE-2026-98221

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - KEYS: trusted: Fix tpm2loadcmd boundary check tpm2loadcmd does boundary checks against the ASN.1 size i.e., payload-bloblen. Address this by passing the decoded...

Missing Role-Based Access Control (RBAC) and Logical Switch Isolation on Brocade Fabric OS MAPS Violation Data API Endpoint

: A missing authorization check in Brocade Fabric OS versions before 10.0.1 REST API interface of affected platform releases allows an authenticated user, regardless of their assigned role or administrative scope, to retrieve complete Monitoring and Alerting Policy Suite MAPS violation data acros...

CVE-2019-14287-

CVE-2019-14287 sudoのセキュリティバイパス（CVE-2019-14287）をチェックするスクリプトです。 このスクリプトは、脆弱性のあるsudoバージョンをチェックし、それを悪用しようとします。 単独で実行することも、LinEnum.shのような列挙スキャナーに統合することもできます。...

CVE-2026-66908

CVE-2026-66908 — camel-platform-http-main 未校验 JWT iss/aud 针对 Apache Camel 漏洞的可运行 PoC 复现工具：当未配置 jwtIssuer 或 jwtAudience 时，camel-main 内嵌 HTTP 服务器 仅凭密钥库构建其 JWT 认证器，因此入站令牌仅检查签名和过期时间 ——iss 和 aud 声明从未被校验。 运行时| 目录| 技术栈 ---|---|--- Camel Main （独立运行）| camel-main/| camel-main 4.21.0 +...

CVE-2026-50751

CVE-2026-50751 Check Point IKEv1 スキャナー CVE-2026-50751 用のマルチスレッド脆弱性スキャナー。Check Point Quantum Security Gateways に影響を与える重大なIKEv1認証バイパスの脆弱性です。 概要 IKEv1が有効なCheck Point Remote Access VPNシステムは、認証バイパス攻撃に対して脆弱です。このツールは、ターゲットシステムでIKEv1が有効かどうかを検出します。 CVE-2026-50751 詳細: CVSSスコア : 9.8 重大 脆弱性 : Check...

EUVD-2026-92870

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.13, when Joplin Desktop is running with the opt-in Web Clipper server enabled, the server in packages/lib/ClipperServer.ts sends Access-Control-Allow-Origin: and allows an...

CVE-2026-105783 Joplin Web Clipper pairing allows cross-origin theft of a permanent API token

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.13, when Joplin Desktop is running with the opt-in Web Clipper server enabled, the server in packages/lib/ClipperServer.ts sends Access-Control-Allow-Origin: and allows an...

CVE-2026-105783 Joplin Web Clipper pairing allows cross-origin theft of a permanent API token

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.13, when Joplin Desktop is running with the opt-in Web Clipper server enabled, the server in packages/lib/ClipperServer.ts sends Access-Control-Allow-Origin: and allows an...

CVE-2026-105783

The Joplin note-taking application (prior to version 3.7.13 ) is vulnerable to cross-origin theft of a permanent API token when the optional Web Clipper server is enabled. The root cause is located in packages/lib/ClipperServer.ts, where the server sends Access-Control-Allow-Origin: * and fails t...

CVE-2024-5326-Poc

CVE-2024-5326 CVE-2024-5326 Post Grid Gutenberg Blocks and WordPress Blog Plugin – PostX = 4.1.2 - 任意のオプション更新に対する認可の欠落 説明 WordPress 用 Post Grid Gutenberg Blocks and WordPress Blog Plugin – PostX プラグインは、バージョン 4.1.2 までの全バージョンにおいて、'postxpresetscallback'...

grafana: grafana: Dashboard modification lockout via forged file-provisioning metadata

A flaw was found in Grafana. An authenticated user with Editor permissions can set file-provisioning metadata when creating a dashboard through the dashboard API due to a missing authorization check. Consequently, the dashboard is treated as externally managed by configuration files, preventing...

CVE-2026-23111

CVE-2026-23111 PoC Linuxカーネル nftablesのUse-After-Free（ローカル権限昇格） poc by baba01hacker 脆弱性の概要 CVE : CVE-2026-23111 タイプ : Use-After-Free CWE-416 CVSS : 7.8 HIGH コンポーネント : net/netfilter/nftablesapi.c — nftmapcatchallactivate 根本原因 : 反転したgenmaskチェックにより、トランザクションアボート中にチェーン参照カウンタがリークする 影響を受けるカーネルバージョン...

CVE_2024_1086_vulnerability_check

このリポジトリには README がありません。...

CVE-2023-43208

CVE-2023-43208 Mirth Connect 远程代码执行概念验证 针对 Mirth Connect 中 CVE-2023-43208 的概念验证 Python 脚本。 免责声明 仅限在您拥有或明确授权测试的环境中使用。此仓库用于安全研究、验证和防御性测试。作者不对因使用此工具造成的任何误用或损害承担责任。 概述 exp.py 是 PoC 的一个最小依赖版本，它能够： 检测目标是否看起来是 Mirth Connect 实例 通过 /api/server/version 请求 Mirth Connect 版本 检查版本是否低于 4.4.1 如果目标看似存在漏洞，则向...

CVE-2026-105688

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, create-team-invitations and the invitation acceptance path allow a non-owner team administrator to assign the owner role because invitation roles are persisted and applied without the role-ceiling check used by...

CVE-2026-100506

Deserialization of Untrusted Data vulnerability in WP Spell Check WP Spell Check wp-spell-check allows Object Injection.This issue affects WP Spell Check: from n/a through 12.1...

CVE-2024-7135

CVE-2024-7135 WordPress 的 Tainacan 插件在 0.21.7 及之前的所有版本中，由于 'getfile' 函数缺少权限检查，存在未授权访问数据的漏洞。该函数还存在目录遍历漏洞。这使得经过身份验证的攻击者（具有订阅者（Subscriber）级别及以上的访问权限）能够读取服务器上任意文件的内容，其中可能包含敏感信息。 用法 WordPress CVE-2024-7135 Wordpress Tainacan 0.21.7 Arbitrary File Read options: -h, --help show this help message and exi...

CVE-2026-58865

In multiple functions of PduParser.java, there is a possible persistent denial of service due to a missing bounds check. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation...