133779 matches found
π WordPress 7.0.2 Code Execution / Cross Site Scripting
A proof of concept exploit for a reflected cross site scripting vulnerability in WordPress version 7.0.2. The vulnerability results from a parser differential between PHP striptags and WordPress KSES processing of usernames supplied to wp-login.php, allowing attacker-controlled markup to survive...
Linux Distros Unpatched Vulnerability : CVE-2026-69184
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Debian Linux - c-ares - None Ubuntu Linux - GHSA-pjmc-gx33-gc76: CPU-exhaustion denial of service via unbounded DNS name compression pointer chains CVE-2026-691...
RHEL 9 : mod_http2 (RHSA-2026:50572)
The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:50572 advisory. The modh2 Apache httpd module implements the HTTP2 protocol h2+h2c on top of libnghttp2 for httpd 2.4 servers. Security Fixes: modhttp2:...
RHEL 10 : nodejs-nodemon (RHSA-2026:52841)
The remote Redhat Enterprise Linux 10 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:52841 advisory. Simple monitor script for use during development of a node.js app. For use during development of a node.js based application. nodemon will watch th...
Never Stop Speaking: A Denial-Of-Service Attack on End-To-End Speech Language Models
Many studies have shown that specially crafted inputs can induce large language models LLMs to generate excessively long outputs, resulting in significant computational overhead and resource consumption. While most existing denial-of-service DoS attacks target text-only LLMs, end-to-end E2E speec...
CorgetGpsDget 2_3.2 - OS Command Injection
Exploit Title: CorgetGpsDget 23.2 - OS Command Injection Date: 2026-07-05 Exploit Author: Bytetobreach Fofa server: "PTTServer" Vendor Homepage: http://corget.com Version: GpsDget 23.2, build 2020-09-01 dget.version; product line Gps2.0 Tested on Ubuntu. Binary reversed on Ghidra Debian. Sink is ...
RHEL 8 : java-1.8.0-ibm (RHSA-2026:52949)
The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:52949 advisory. IBM Java SE version 8 includes the IBM Java Runtime Environment and the IBM Java Software Development Kit. Security Fixes: Little CMS: lcms...
...[ More ]
A proof of concept exploit for an authorization bypass vulnerability in Traefik version 3.7.9. The vulnerability affects the Kubernetes Gateway API provider and results from ambiguous dynamic configuration object identifiers constructed by joining namespace and object names with hyphens. Differen...
Vulnerability of the prepare_form() function in the acfe_module_form_front.render plugin: This vulnerability allows a hacker to execute arbitrary code.
Vulnerability of the prepareform function in the acfemoduleformfront.render method of the Advanced Custom Fields plugin: This vulnerability is related to improper handling of code generation. Exploiting this vulnerability could allow an attacker to execute arbitrary code...
RHEL 10 : java-21-ibm-semeru-certified-jdk (RHSA-2026:52948)
The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:52948 advisory. The IBM Semeru Runtime Certified Edition 21 runtime environment. Security Fixes: Little CMS: lcms2: mm2/Little-CMS: Little CMS: Informatio...
Mida eFramework <=2.9.0 - Remote Command Execution
Mida eFramework through 2.9.0 allows an attacker to achieve remote code execution with administrative root privileges. No authentication is required. id: CVE-2020-15920 info: name: Mida eFramework =2.9.0 - Remote Command Execution author: dwisiswant0 severity: critical description: Mida eFramewor...
Exploit for Code Injection in Flowiseai Flowise
CVE-2025-59528 Educational PoC Educational use only. Th...
Exploit for CVE-2026-64638
π₯ XSS2Shell β CVE-2026-64638 Scanner & PoC Toolkit Behav...
Nightmare-Windows-0-day-exp
Windows Zero-Day Exploit Collection !Research Use Onlyhtt...
HermesPentBox
HermesPentBox β AI Pentest Workbench Language: English...
Diversity Matters: Distributional Feature Coverage Sample Selection for Data-Efficient Backdoor Attacks
Backdoor attacks compromise training data so that a model retains clean accuracy but predicts an attacker-chosen target on triggered inputs. At very low poisoning rates, only a few samples convey the trigger--target association, making poison-sample selection critical. Existing methods typically...
From Noise to Meaning: Meaningful Secret Sharing with Tamper Detection for Facial Recognition
Popularity of AI-based face recognition system directly demands protection of sensitive biometric data used for training. Visual secret sharing is an interesting idea, as it splits facial images into secret shares that look random and spread across many institutions. However, these shares look li...
SUSE CVE-2026-46405
OpenBao is an open source identity-based secrets management system. Prior to version 2.5.4, in OpenBao's Kerberos auth method on the GET handler, or when an Authorization: Negotiate header is supplied, the response is includes a logical.Auth object in addition to an error message. This results in...
SUSE CVE-2026-68082
In the Linux kernel, the following vulnerability has been resolved: libceph: fix two unsafe bare decodes in decodelockers decodelockers in clslockclient.c contains two bare decode operations that allow a malicious or compromised OSD to trigger slab-out-of-bounds reads: 1. cephdecode32p at the...
PSA: Supply Chain Compromise in BdThemes Ecosystem via Poisoned API Response
The Wordfence Threat Intelligence Team was notified on August 7th, 2026 of a supply chain compromise affecting BdThemes, a WordPress plugin vendor whose plugins are available in the official WordPress plugins directory. Currently, all the affected plugins are temporarily closed pending a full...