CVE-2026-15229

The CVE concerns the PinPoint Booking System WordPress plugin (versions up to 2.9.9.7.1). The issue is that server-side validation of the booking price is missing, enabling unauthenticated users to create bookings at arbitrary prices (including zero). By selecting a specific payment method, an in...

Important: Red Hat Security Advisory: nodejs-nodemon security update

An update for nodejs-nodemon is now available for Red Hat Enterprise Linux 10.0 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

📄 Sonatype Nexus Repository 3.94.1 Repository Format Authorization Bypass

A proof of concept exploit for an authorization bypass vulnerability in Sonatype Nexus Repository version 3.94.1. The vulnerability exists because the coreuiRepository.create method performs authorization against the caller-controlled repository format field while constructing the repository usin...

Linux Distros Unpatched Vulnerability : CVE-2026-12570

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A vulnerability in keras-team/keras versions = 3.15.0 allows for a denial of service DoS attack when loading malicious .keras model files via the...

ALSA-2026:52841 Important: nodejs-nodemon security update

Simple monitor script for use during development of a node.js app. For use during development of a node.js based application. nodemon will watch the files in the directory in which nodemon was started, and if any files change, nodemon will automatically restart your node application. nodemon does...

RHEL 10 : nodejs-nodemon (RHSA-2026:52394)

The remote Redhat Enterprise Linux 10 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:52394 advisory. Simple monitor script for use during development of a node.js app. For use during development of a node.js based application. nodemon will watch th...

OrkesConductor 3.30.2 - Unauthenticated Remote Code Execution

!/usr/bin/env python3 Exploit Title: OrkesConductor 3.30.2 - Unauthenticated Remote Code Execution CVE: CVE-2026-58138 Date: 2026-07-10 Exploit Author: Mohammed Idrees Banyamer Author Country: Jordan Instagram: @banyamersecurity Author GitHub: https://github.com/mbanyamer Author Blog :...

Never Stop Speaking: A Denial-Of-Service Attack on End-To-End Speech Language Models

Many studies have shown that specially crafted inputs can induce large language models LLMs to generate excessively long outputs, resulting in significant computational overhead and resource consumption. While most existing denial-of-service DoS attacks target text-only LLMs, end-to-end E2E speec...

You Are Not My Teammate: Behavioral Fingerprint-Based Detection of Suspicious Account Misuse

Online games have been continuously affected by cyber threats such as game bots and gold farming. Game bots, which are automated programs that play on behalf of human users, significantly accelerate character progression and reduce the engagement of legitimate players, potentially leading to user...

RHEL 10 : nodejs-nodemon (RHSA-2026:52841)

The remote Redhat Enterprise Linux 10 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:52841 advisory. Simple monitor script for use during development of a node.js app. For use during development of a node.js based application. nodemon will watch th...

...[ More ]

A proof of concept exploit for a server-side request forgery vulnerability in Gitea version 1.26.4. The vulnerability affects repository migration functionality and results from insufficient validation of pull request patch URLs. Although Gitea validates the original migration URL against its...

PT-2026-80175

Name of the Vulnerable Software and Affected Versions c-ares versions prior to 1.34.8-1.1 Description A CPU-exhaustion denial of service occurs due to unbounded DNS name compression pointer chains. This issue allows an attacker to cause excessive CPU usage by providing specially crafted DNS...

📄 WordPress 7.0.2 Code Execution / Cross Site Scripting

A proof of concept exploit for a reflected cross site scripting vulnerability in WordPress version 7.0.2. The vulnerability results from a parser differential between PHP striptags and WordPress KSES processing of usernames supplied to wp-login.php, allowing attacker-controlled markup to survive...

RHEL 9 : mod_http2 (RHSA-2026:50572)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:50572 advisory. The modh2 Apache httpd module implements the HTTP2 protocol h2+h2c on top of libnghttp2 for httpd 2.4 servers. Security Fixes: modhttp2:...

Linux Distros Unpatched Vulnerability : CVE-2026-69184

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Debian Linux - c-ares - None Ubuntu Linux - GHSA-pjmc-gx33-gc76: CPU-exhaustion denial of service via unbounded DNS name compression pointer chains CVE-2026-691...

CorgetGpsDget 2_3.2 - OS Command Injection

Exploit Title: CorgetGpsDget 23.2 - OS Command Injection Date: 2026-07-05 Exploit Author: Bytetobreach Fofa server: "PTTServer" Vendor Homepage: http://corget.com Version: GpsDget 23.2, build 2020-09-01 dget.version; product line Gps2.0 Tested on Ubuntu. Binary reversed on Ghidra Debian. Sink is ...

RHEL 8 : java-1.8.0-ibm (RHSA-2026:52949)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:52949 advisory. IBM Java SE version 8 includes the IBM Java Runtime Environment and the IBM Java Software Development Kit. Security Fixes: Little CMS: lcms...

...[ More ]

A proof of concept exploit for an authorization bypass vulnerability in Traefik version 3.7.9. The vulnerability affects the Kubernetes Gateway API provider and results from ambiguous dynamic configuration object identifiers constructed by joining namespace and object names with hyphens. Differen...

RHEL 10 : java-21-ibm-semeru-certified-jdk (RHSA-2026:52948)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:52948 advisory. The IBM Semeru Runtime Certified Edition 21 runtime environment. Security Fixes: Little CMS: lcms2: mm2/Little-CMS: Little CMS: Informatio...

Vulnerability of the prepare_form() function in the acfe_module_form_front.render plugin: This vulnerability allows a hacker to execute arbitrary code.

Vulnerability of the prepareform function in the acfemoduleformfront.render method of the Advanced Custom Fields plugin: This vulnerability is related to improper handling of code generation. Exploiting this vulnerability could allow an attacker to execute arbitrary code...