wp-ssrf-cloud-metadata

WordPress Core SSRF via Cloud Metadata Endpoint Bypass in wp...

ANT-2026-QQ2P9M9V · openexr · Heap-buffer-overflow

heap-buffer-overflow high CVE-2026-45696 Severity Claude high · Security research firm high · Maintainer - Discovered by Claude Mythos Preview REPORT Anthropic's analysis, sealed at approval. Disclosure to the maintainer was performed by Ada Logics. ANT-2026-QQ2P9M9V: Heap-buffer-overflow in...

SecureAI-Scan v0.4.0

SecureAI-Scan The AI security scanner that proves its findings. SecureAI-Scan finds LLM, MCP, Agent Skill, and RAG vulnerabilities in TypeScript, JavaScript, and Python — and shows you the evidence: the exact source → flow → sink path for every dataflow finding, resolved through real imports, not...

pentest-storm

pentest-storm Automated penetration testing exploitation engi...

DEBIAN-CVE-2026-55833

Netty is a network application framework for development of protocol servers and clients. Prior to 4.1.136.Final and 4.2.16.Final, Netty SPDY header decoding continues inflating zlib-compressed header blocks after the raw header parser has exceeded maxHeaderSize and marked the frame truncated in...

CVE-2026-55833

Netty is a network application framework for development of protocol servers and clients. Prior to 4.1.136.Final and 4.2.16.Final, Netty SPDY header decoding continues inflating zlib-compressed header blocks after the raw header parser has exceeded maxHeaderSize and marked the frame truncated in...

UBUNTU-CVE-2026-55833

Netty is a network application framework for development of protocol servers and clients. Prior to 4.1.136.Final and 4.2.16.Final, Netty SPDY header decoding continues inflating zlib-compressed header blocks after the raw header parser has exceeded maxHeaderSize and marked the frame truncated in...

CVE-2026-55833

Netty is a network application framework for development of protocol servers and clients. Prior to 4.1.136.Final and 4.2.16.Final, Netty SPDY header decoding continues inflating zlib-compressed header blocks after the raw header parser has exceeded maxHeaderSize and marked the frame truncated in...

PT-2026-61930

Name of the Vulnerable Software and Affected Versions Grav versions 2.0.4 through 2.0.6 Description Remote code execution is possible through the Blueprint::dynamicData function in the system/src/Grav/Common/Data/Blueprint.php file. The issue occurs because a Class::method callable string and its...

PT-2026-63319

Name of the Vulnerable Software and Affected Versions accountsservice versions prior to 23.13.9-8ubuntu7 Description Ubuntu-specific language helper scripts, specifically save-to-pam-env and update-langlist, fail to properly sanitize the LANGUAGE entry within the /.pam environment file. This inpu...

PT-2026-62054

Data::DisjointSet::Shared versions before 0.02 for Perl allow out-of-bounds reads and writes via an unvalidated parent index in dsu find. The attach-time validator dsu validate header checks the header scalars and region layout against the file size, but does not validate the array contents it th...

PT-2026-62027

Name of the Vulnerable Software and Affected Versions Eclipse OpenJ9 versions prior to 0.61 Description An issue occurs when executing class files where a superclass method, which was previously concrete, has been recompiled as abstract. In this scenario, the execution is incorrectly delegated to...

EulerOS Virtualization 2.12.0 : systemd (EulerOS-SA-2026-2808)

According to the versions of the systemd packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : A flaw was found in systemd. The systemd-machined service contains an Improper Access Control vulnerability due to insufficient...

EulerOS Virtualization 2.12.1 (EulerOS-SA-2026-2766)

According to the versions of the packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : XZ Utils provide a general-purpose data-compression library plus command-line tools. Prior to version 5.8.3, if lzmaindexdecoder was used ...

PT-2026-62100

djangoSIGE through 1.10 commit a6fe7e8 contains a cross-site request forgery vulnerability that allows unauthenticated attackers to cancel sales or purchase orders on behalf of authenticated users by exploiting order-cancellation logic implemented inside HTTP GET method handlers in...

PT-2026-62091

SQL Injection vulnerability in aiflowy = 2.1.2 allows a remote attacker to obtain sensitive information via the getPageData method in the DatacenterQuery.java file...

📄 WordPress JSON API User 3.9.2 Unauthenticated Privilege Escalation

WordPress JSON API User plugin version 3.9.2 contains an unauthenticated privilege escalation to administrator vulnerability through Mass-Assignment. A remote attacker can elevate privileges to the administrator role and take control of the affected site. This proof of concept exploit demonstrate...

PT-2026-63317

Impact If this library is used to implement a WebSocket server on top of a TCP server, by using the WebSocket::Driver.server method, then a client can cause the server to crash by sending a Host header that is not a valid host:port string. When this happens, a URI::InvalidURIError exception is...

PT-2026-63043

Name of the Vulnerable Software and Affected Versions Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0 Description An issue exists in the Experience Manager component that allows an unauthenticated attacker with network access via RMI Remote Method Invocation, a...

Twin Agent: Context Residual Compression for Privilege Separated Agents

Large language model LLM agents are vulnerable to security risks, such as prompt injection attacks from untrusted context that manipulate downstream reasoning and tool use. Existing secure-by-design approaches mitigate this risk by separating untrusted observations from privileged execution and...