PT-2026-83579

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.8.1 Description A stored cross-site scripting issue exists in the confirmDialog function. This occurs because unescaped package names and notebook names are interpolated directly into innerHTML assignments. An attack...

Security update for gh (important)

openSUSE Security Update: Security update for gh Announcement ID: openSUSE-SU-2026:0309-1 Rating: important References: 1266618 Cross-References: CVE-2026-39821 CVE-2026-64652 CVE-2026-64653 CVE-2026-64654 CVE-2026-64655 CVSS scores: CVE-2026-39821 SUSE: 9.1...

PT-2026-83551

A weakness has been identified in Tenda HG10 300001138. Affected by this issue is the function formIPv6Routing of the file /boaform/admin/formIPv6Routing of the component Boa Web Server. This manipulation of the argument destNet causes buffer overflow. The attack is possible to be carried out...

vajra

██╗ ██╗ █████╗ ██╗██████╗ █████╗ ██║ ██║██...

cve-2017-5487

Cos'è CVE-2017-5487? : Vulnerabilità nell'implementazione della REST API in wp-includes/rest-api/endpoints/class-wp-rest-users-controller.php nelle versioni di WordPress precedenti alla 4.7.1, che non limita l'elenco degli autori, consentendo a un attaccante remoto di ottenere informazioni...

CVE-2019-19781-DFIR-Notes

Basierend auf einer Splunk -Perspektive. Die folgenden Ressourcen zeigen, dass die Aufnahme Ihrer Logs für eine ordnungsgemäße Analyse der Indicators of Compromise unerlässlich ist. Verschwende nie eine gute Krise... nimm alle Logs auf! Auswirkung / Grundursache: Remote-Befehlsausführung vor...

IonStack-S22-cve-2026-43499

IonStack-S22-cve-2026-43499 MERGED WITH ORIGINAL REPO: Find it here https://github.com/CamsShaft/IonStack-S22 Full root in the kernel domain with selinux permissive on my SM-S901W S22 5.10.168-android12-9-27760517-abS901WVLS4DWL3. NOTES: I'm not going into great detail or lengths in this one sinc...

CVE-2026-42945

CVE-2026-42945 Nginx Rift - Toolkit PoC Un toolkit proof-of-concept completo per CVE-2026-42945 Nginx Rift, una vulnerabilità critica di heap buffer overflow nel modulo ngxhttprewritemodule di Nginx. Riepilogo della Vulnerabilità Campo| Dettagli ---|--- ID CVE| CVE-2026-42945 Nome| Nginx Rift Tip...

tgscope

tgscope Telegram OSINT, scraping and archival. A local web app that runs entirely on your machine and talks only to Telegram. root@kitploit: npm install npm start Then open http://127.0.0.1:5173. The first run walks you through API credentials, a QR sign-in and loading your dialogs. Telegram is t...

CVE-2025-66470

NiceGUI XSS Scanner - CVE-2025-66470 📸 Schermata Uno scanner veloce e semplice per rilevare CVE-2025-66470 - vulnerabilità XSS nel componente ui.interactiveimage di NiceGUI. 🔍 Dettagli della vulnerabilità Campo| Valore ---|--- CVE| CVE-2025-66470 GHSA| GHSA-2m4f-cg75-76w2 Componente|...

cyberchef-recipes

CyberChef è il cosiddetto 'Cyber Swiss-Army Knife' creato dal GCHQ. È uno strumento fantastico per la trasformazione, l'estrazione e la manipolazione dei dati nel tuo browser web. Tutto il merito a @GCHQ per aver creato lo strumento. Vedi: https://gchq.github.io/CyberChef/ Consigli Generali Scari...

PT-2026-83423

Name of the Vulnerable Software and Affected Versions macrozheng mall versions prior to 1.0.4 Description A race condition exists in the Order Submission component within the '/order/submit' endpoint. This issue allows a remote attacker to manipulate the system, although the attack is characteriz...

PT-2026-83390

Name of the Vulnerable Software and Affected Versions BOSH vSphere CPI versions prior to 98.0.6 Description An issue in the communication protocol between BOSH Director and vCenter allows an attacker positioned between these two entities to intercept traffic and impersonate the vCenter REST API...

PT-2026-83409

Name of the Vulnerable Software and Affected Versions 爱采集数据采集和发布插件 WordPress plugin versions prior to 1.0.1 Description An unauthenticated endpoint relies on a hardcoded default secret instead of a per-install secret and fails to validate URLs or destination paths. This allows unauthenticated...

PT-2026-83497

The Custom User Registration Fields for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 2.2.3. This is due to the plugin accepting an attacker-controlled afreg select user role value from the unauthenticated WooCommerce Store API...

PT-2026-83435

Name of the Vulnerable Software and Affected Versions argocd-mcp version 0.8.0 Description The software binds its HTTP transport to every network interface 0.0.0.0 and accepts MCP sessions without requiring caller credentials when the ARGOCD API TOKEN variable is configured. This allows a...

PT-2026-83440

Cloud Commander before 19.20.2 contains a directory traversal vulnerability in REST file-operation and markdown endpoints that fails to properly validate path normalization. Attackers can use path traversal sequences to read, write, move, or copy files outside the configured root directory...

PT-2026-83431

rust-iot-platform through commit 5df942ab contains an authentication bypass vulnerability where most REST API routes lack authentication guards in their handler signatures. Unauthenticated attackers can create, update, list, retrieve, and delete user accounts by directly accessing unprotected...

PT-2026-83407

Name of the Vulnerable Software and Affected Versions HEL Online Classroom: AI-powered Online Classrooms versions prior to 1.0.4 Description The plugin lacks authorization and authentication checks when saving settings. This allows unauthenticated users to overwrite configuration settings and...

PT-2026-83427

Shinobi before commit 5a76c74f contains a hardcoded connection key in the child node service that allows unauthenticated attackers to execute arbitrary database queries. Attackers reaching the child node port can present the hardcoded key during WebSocket handshake, then dispatch SQL queries...