CVE-2026-19056

The ProSolution WP Client WordPress plugin before 2.0.11 does not sanitise and escape a parameter before reflecting it into an HTML attribute on one of its administrative pages, leading to reflected Cross-Site Scripting that runs in the session of an administrator induced to submit a crafted...

CVE-2026-16950

The Product Shortlist WordPress plugin through 1.0.4 does not properly sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated attackers to perform SQL injection attacks...

PyMemoryEditor v2.1.0

PyMemoryEditor A pure-Python library built on ctypes that lets you inspect, modify and search the memory of any running process in a few lines of Python — Cheat Engine workflows on Windows, Linux and macOS! Read, write and scan the memory of any process — straight from Python. One unified API...

CVE-2026-19056

The ProSolution WP Client WordPress plugin (versions before 2.0.11) fails to sanitise and escape the page parameter before reflecting it into an HTML attribute on an admin page, enabling reflected XSS in an administrator's session via a crafted request. CVSS 7.1 (HIGH). Remediation: update to ver...

EUVD-2026-62287

The ProSolution WP Client WordPress plugin before 2.0.11 does not sanitise and escape a parameter before reflecting it into an HTML attribute on one of its administrative pages, leading to reflected Cross-Site Scripting that runs in the session of an administrator induced to submit a crafted...

CVE-2026-19056 ProSolution WP Client < 2.0.11 - Reflected XSS via 'page' Parameter

The ProSolution WP Client WordPress plugin before 2.0.11 does not sanitise and escape a parameter before reflecting it into an HTML attribute on one of its administrative pages, leading to reflected Cross-Site Scripting that runs in the session of an administrator induced to submit a crafted...

CVE-2026-19056 ProSolution WP Client < 2.0.11 - Reflected XSS via 'page' Parameter

The ProSolution WP Client WordPress plugin before 2.0.11 does not sanitise and escape a parameter before reflecting it into an HTML attribute on one of its administrative pages, leading to reflected Cross-Site Scripting that runs in the session of an administrator induced to submit a crafted...

EUVD-2026-62273

The Product Shortlist WordPress plugin through 1.0.4 does not properly sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated attackers to perform SQL injection attacks...

CVE-2026-16950

The Product Shortlist WordPress plugin (≤1.0.4) exposes an unauthenticated SQL injection flaw in the get_shortlisted_products function. A parameter is passed unsanitised into a SQL query, enabling remote attackers to extract database contents. CVSS 3.1 scores this HIGH (8.6, AV:N/AC:L/PR:N/UI:N)....

CVE-2026-16950 Product Shortlist <= 1.0.4 - Unauthenticated SQL Injection via get_shortlisted_products

The Product Shortlist WordPress plugin through 1.0.4 does not properly sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated attackers to perform SQL injection attacks...

Titanis v0.9.333

Introduction Titanis is a library of protocol implementations and command line utilities, written in C, for interacting with Windows environments. It uses .NET 8 and is cross-platform Windows and Linux. Some of the protocols implemented: SMB2 MS-SMB2 SMB 2.x and 3.x up to 3.1.1 Message security...

Clop-Linked Windchill Web Shell Decrypts Credentials and Maps Engineering Data

A JavaServer Pages JSP web shell deployed following the exploitation of a critical security flaw in PTC Windchill and FlexPLM servers is specifically designed for the enterprise Product Lifecycle Management PLM software, according to new findings from ReliaQuest. The cybersecurity company...

Redis_Pwn

Redis Rogue PWN Enhanced Redis rogue server exploit for CTF...

CVE-2026-72165

A flaw was found in the mtd: rawnand component of the Linux kernel. The nandselecttarget function contains an incorrect condition check for the 'cs' chip select parameter, allowing it to go out of its intended range. This out-of-bounds access could potentially lead to a system crash, resulting in...

Exploit for CVE-2026-16723

🚨 CVE-2026-16723 — fastjson 1.2.83 @JSONType resource detect...

CVE-2026-72155

A flaw was found in the Linux kernel's mtd: spi-nor: swp component. When a user attempts to unlock specific blocks on a Serial Peripheral Interface SPI NOR flash device, particularly those at the beginning of the device, the operation may fail. This occurs due to an incorrect calculation of the...

Exploit for Use After Free in Linux Linux_Kernel

S26 SM-S942U1 / m1q GhostLock CVE-2026-43499 — Achieved SELi...

Malicious code in dxrs-dos (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1634fc433b5cd1e5e4baa139e8795b6b6ef51bb80fdbdc5183fb7fed419aee33 Package is an openly-advertised DDoS/booter toolkit L4/L7 flood methods, SSH brute force, C2 panel builder with keywords such as "ddos attack script"...

MAL-2026-14241 Malicious code in dxrs-dos (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1634fc433b5cd1e5e4baa139e8795b6b6ef51bb80fdbdc5183fb7fed419aee33 Package is an openly-advertised DDoS/booter toolkit L4/L7 flood methods, SSH brute force, C2 panel builder with keywords such as "ddos attack script"...

Malicious code in dxr-dos (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3bad9a4bf59f5c59d899f7be2c655adaba56f8ce65f284519d9778ea1bcaff1f bin/dxr.js unconditionally requires the external npm package 'deathoffather-project' pinned to the mutable 'latest' tag and immediately invokes an...