CVE-2026-81766

The Really Simple Security WordPress plugin (aka Really Simple SSL) before 9.8.0 contains a missing permission check in the rsp_upgrade_install_plugin function, which allows a subsite administrator on a WordPress multisite network to install and execute arbitrary code from a user-supplied URL int...

CVE-2026-19722

WPvivid — Backup, Migration & Staging is a WordPress plugin affected by a Zip Slip vulnerability prior to version 0.9.133 . During backup restoration, the plugin does not validate the destination path of files extracted from a backup package, allowing an authenticated user with high privileges (e...

EUVD-2026-68160

The Really Simple Security WordPress plugin before 9.8.0 does not check that the user is allowed to install Really Simple Security WordPress plugin before 9.8.0 before installing one from a user-supplied URL, allowing an administrator of a subsite on a multisite network to install and execute...

EUVD-2026-68156

The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.133 does not validate the destination of files extracted from a backup package during restoration, allowing high privilege users such as administrators to write arbitrary files outside the intended restore directory, which can...

UnRaid <=6.80 - Remote Code Execution

UnRaid =6.80 allows remote unauthenticated attackers to execute arbitrary code. id: CVE-2020-5847 info: name: UnRaid =6.80 - Remote Code Execution author: madrobot severity: critical description: UnRaid =6.80 allows remote unauthenticated attackers to execute arbitrary code. impact: |...

D-Link - Unauthenticated Remote Code Execution

OS command injection vulnerability in soap.cgi soapcgimain in cgibin in D-Link DIR-880L DIR-880LREVAFIRMWAREPATCH1.08B04 and previous versions, DIR-868L DIR868LA1FW112b04 and previous versions, DIR-65L DIR-865LREVAFIRMWAREPATCH1.08.B01 and previous versions, and DIR-860L DIR860LA1FW110b04 and...

ElasticSearch - Remote Code Execution

ElasticSearch before 1.3.8 and 1.4.x before 1.4.3 allows remote attackers to bypass the sandbox protection mechanism and execute arbitrary shell commands via a crafted script to the Groovy scripting engine. id: CVE-2015-1427 info: name: ElasticSearch - Remote Code Execution author: pikpikcu...

Microsoft SharePoint Server - Authentication Bypass (ToolShell)

Microsoft Office SharePoint Server contains an improper authentication vulnerability that allows unauthorized attackers to perform spoofing over a network. By crafting a POST request to /layouts/15/ToolPane.aspx with a forged Referer header /layouts/SignOut.aspx, attackers can bypass authenticati...

ForgeRock OpenAM <7.0 - Remote Code Execution

ForgeRock AM server before 7.0 has a Java deserialization vulnerability in the jato.pageSession parameter on multiple pages. The exploitation does not require authentication, and remote code execution can be triggered by sending a single crafted /ccversion/ request to the server. The vulnerabilit...

PaperCut - Unauthenticated Remote Code Execution

This vulnerability allows remote attackers to bypass authentication on affected installations of PaperCut NG 22.0.5 Build 63914. Authentication is not required to exploit this vulnerability. The specific flaw exists within the SetupCompleted class. The issue results from improper access control. ...

yolo-cage

yolo-cage: autonomous coding agents that do no harm You're a responsible engineer. You'd never just let an AI run roughshod through your most sensitive systems and codebases. That's why you'd never just shut off the safeguards for a tool like Claude Code. It asks permission for every dangerous...

Malicious code in opiumbest (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 32d3c33077e46f79b1a53edad20c8cb8c7fc67c5cbedd8406257cb5ce9581097 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in quesoeducation (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1c428c1658948c78d2e7323de16bf1f37dced0bcd770cd73fd2b3c0855f6aa7b The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-15576 Malicious code in quesoeducation (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1c428c1658948c78d2e7323de16bf1f37dced0bcd770cd73fd2b3c0855f6aa7b The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-15575 Malicious code in opiumbest (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 32d3c33077e46f79b1a53edad20c8cb8c7fc67c5cbedd8406257cb5ce9581097 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

gf

gf Un envoltorio alrededor de grep para evitar escribir patrones comunes. ¿Qué? ¿Por qué? Uso grep un montón. Cuando audito bases de código, reviso la salida de meg, o simplemente trato con grandes cantidades de datos. A menudo termino usando patrones bastante complejos como este: root@kitploit: ...

cfn_nag

Antecedentes La herramienta cfn-nag busca patrones en las plantillas de CloudFormation que puedan indicar infraestructura insegura. En términos generales, buscará: Reglas de IAM demasiado permisivas comodines Reglas de grupos de seguridad demasiado permisivas comodines Registros de acceso que no...

red-clippy

Red Clippy Tus pruebas de agente. Red Clippy lleva el registro. Gestión de pentesting de código abierto diseñada para ser operada por un agente de IA. Conéctalo a Claude Code mediante MCP y ejecutará el compromiso junto a ti: alcance y activos, observaciones de reconocimiento, cobertura de...

langflow-exploit

CVE-2025-3248 - Langflow कोड सत्यापन एंडपॉइंट RCE Langflow के कोड सत्यापन एंडपॉइंट में रिमोट कोड निष्पादन भेद्यता को प्रदर्शित करने वाला एक प्रूफ-ऑफ-कॉन्सेप्ट एक्सप्लॉइट। यह भेद्यता Langflow के 1.3.0 से पहले के संस्करणों को प्रभावित करती है, जिससे बिना प्रमाणीकरण के हमलावर क्राफ्टेड HTTP अनुरोधों...

EXPLOIT-CVE-2026-9198

CVE-2026-9198 — IBM Langflow OSS RCE Não Autenticado Prova de conceito de exploit e um laboratório Docker autocontido para CVE-2026-9198 , uma vulnerabilidade de execução remota de código não autenticada em IBM Langflow OSS. O exploit encadeia dois endpoints — autologin que entrega um token...