MCPwnfluence

MCPwnfluence — CVE-2026-27825 & CVE-2026-27826 Two critical vulnerabilities in mcp-atlassian, one of the most popular MCP servers in the ecosystem 4.4K+ GitHub stars, 4M+ downloads. Discovered by the team at Pluto Security. The Vulnerabilities CVE| CVSS| Type| Description ---|---|---|---...

CVE-2026-87838

The Wava Payment Plugin WordPress plugin before 0.3.10 does not perform any authorisation, nonce or origin verification on one of its public REST endpoints, allowing unauthenticated attackers to overwrite the stored credential that identifies the merchant account the store's payments are created...

CVE-2020-12753-PoC

CVE-2020-12753-PoC This repo contains a proof-of-concept for 🔋📱❄️🥾🔓, an SBL1/aboot vuln for Secure EL3 arbitrary code execution on the LG Stylo 4 AMZ/Q710ULM. This is only tested on updates 20a and 20c and with the SBL1 variant of the vulnerability. - Makefile : Builds rawresourcesamod.img given...

explo

explo explo is a simple tool to describe web security issues in a human and machine readable format. By defining a request/condition workflow, explo is able to exploit security issues without the need of writing a script. This allows to share complex vulnerabilities in a simple readable and...

-CVE-2026-26215-manga-image-translator-RCE

CVE-2026-26215 - manga-image-translator Pickle Deserialization RCE 👤 Author Mohammed Idrees Banyamer Instagram: @banyamersecurity GitHub: @mbanyamer Proof-of-Concept exploit for CVE-2026-26215 - Unauthenticated Remote Code Execution via unsafe Pickle deserialization in manga-image-translator ≤...

CVE-2024-38472

Creating a Remote Code Execution RCE Metasploit module for the SSRF vulnerability CVE-2024-38472 in Apache HTTP Server on Windows is challenging because SSRF itself doesn't directly result in RCE. However, SSRF can often be a step toward achieving RCE, especially if you can use it to interact wit...

Security Bulletin: Vulnerabilities exists in IBM Cloud Pak for Data System (Yosemite 1.0)

Summary Vulnerabilities identified in IBM Cloud Pak for Data System Yosemite 1.0 have been addressed in version 11.3.1.2-IF3 Vulnerability Details CVEID:CVE-2026-59739 DESCRIPTION: Information disclosure via SetWatches reconnect replay in Apache ZooKeeper due to missing ACL check. An attacker can...

CVE-2026-42778-POC

CVE-2026-42778 Overview Incomplete fix in Apache MINA AbstractIoBuffer.getObject method. The classname allowlist validation that restricts which classes can be deserialized is applied too late, after static initializers in classes being read may have already executed. This occurs because the...

CVE-2026-87838

The Wava Payment Plugin for WordPress (versions before 0.3.10 ) is vulnerable to an unauthenticated merchant credential overwrite. The root cause is a lack of authorisation , nonce , or origin verification on one of its public REST endpoints . This allows an unauthenticated attacker to overwrite ...

CVE-2026-87838 Wava Payment 0.3.1 - 0.3.9 - Unauthenticated Merchant Credential Overwrite via Install Webhook

The Wava Payment Plugin WordPress plugin before 0.3.10 does not perform any authorisation, nonce or origin verification on one of its public REST endpoints, allowing unauthenticated attackers to overwrite the stored credential that identifies the merchant account the store's payments are created...

EUVD-2026-107087

The Wava Payment Plugin WordPress plugin before 0.3.10 does not perform any authorisation, nonce or origin verification on one of its public REST endpoints, allowing unauthenticated attackers to overwrite the stored credential that identifies the merchant account the store's payments are created...

CVE-2026-87838 Wava Payment 0.3.1 - 0.3.9 - Unauthenticated Merchant Credential Overwrite via Install Webhook

The Wava Payment Plugin WordPress plugin before 0.3.10 does not perform any authorisation, nonce or origin verification on one of its public REST endpoints, allowing unauthenticated attackers to overwrite the stored credential that identifies the merchant account the store's payments are created...

CVE-2018-1002105

CMPT733-Group110x90 CVE-2018-1002105 Members : Abhishek Rungta, Shubham Saini, Siddhant Sood Environment Setup A linux VM Such as Ubuntu 20.04 Minikube for local deploymnet of kubernetes Any of these older versions1.0.x— 1.9.x, 1.10.0—1.10.10,1.11.0—1.11.4,1.12.0—1.12.2 Run the exploit We have...

moria

moria IoT firmware identification and extraction moria identifies files and the structures embedded inside firmware and IoT images filesystems, kernels, bootloaders, archives, keys and unpacks most of what it finds, without root. It reports each finding with a byte offset, a type, and a confidenc...

Log4Shell-CVE-2021-44228-Demo

Log4ShellCVE-2021-44228 Demo Environment Setup Client Anywhere that with ability to access the HTTP Server with curl command line Vulnerable App by Http Server with log4j Amazon Linux 2 x86 based EC2 Instance / CentOS Azure Virtual Machine $ yum install docker -y $ systemctl enable docker $...

Security Bulletin: Multiple vulnerabilities affect IBM Guardium External S-TAP

Summary Multiple vulnerabilities have been addressed in IBM Guardium External S-TAP Vulnerability Details CVEID:CVE-2026-4111 DESCRIPTION: A flaw was identified in the RAR5 archive decompression logic of the libarchive library, specifically within the archivereaddata processing path. When a...

Tomcat_PUT_GUI_EXP

TomcatPUTEXPV1.4 Tomcat PUT Method Arbitrary File Write CVE-2017-12615 Graphical Exploitation Tool Vulnerability Introduction On September 19, 2017, Apache Tomcat officially confirmed and fixed two high-risk vulnerabilities, with CVE IDs: CVE-2017-12615 and CVE-2017-12616. Among them, the remote...

ProtOSINT

ProtOSINT ProtOSINT is a Python script that helps you investigate Proton Mail accounts. Version This is ProtOSINT v2. The first version has been around for a few years, but Proton's API changed and the old checks stopped working, so this is a rewrite that brings the tool back to life. Big thanks ...

CVE-2022-47130

CVE-2022-47130 Academy LMS history.pushState'', '', '/'...

spark-connect-copy-local

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · spark-connect-copy-local spark-connect-copy-local Class: File write leftover of SPARK-58531; static on 4.3.0 only Reach: Remote Apache Spark 4.2.0 32f72996 - Apache Software Foundation...