CVE-2026-25643

Frigate NVR ≤ 0.16.3 Blind RCE Exploit CVE-2026-25643 PoC 📜 Description This Python exploit targets a critical configuration manipulation vulnerability in Frigate NVR versions up to 0.16.3 both authenticated and unauthenticated paths. By injecting a malicious go2rtc stream and a fake camera entry...

CVE-2024-52301-Research

CVE-2024-52301-Research A bit of research around CVE-2024-52301. I've seen the vuln and wanted to find out how Laravel is vulnerable. For this, I just diffed the 6.20.44 and 6.20.45 versions, and traced how GET parameters could end up changing the application configuration. I've written about thi...

CVE-2022-22965

Spring Boot CVE-2022-22965 Docker PoC for CVE-2022-22965 with Spring Boot version 2.6.5 🚀 Getting Started 1. Download the distribution code from https://github.com/itsecurityco/CVE-2022-22965/archive/refs/heads/master.zip and unzip it. 2. Run docker compose up --build to build and start the...

CVE-2026-119682

An improper access control vulnerability exists in the multi-factor authentication MFA functionality of ManageEngine SharePoint Manager Plus SPMP. A low-privileged authenticated user can bypass authorization checks to read and modify MFA configuration settings, enable or disable MFA for the...

CVE-2026-107051

Insecure permissions in klassm AndFHEM v2.4.1 versionCode 241, the verified build allows unauthorized attackers to arbitrarily manipulate another user's FHEM home-automation control configurations...

EUVD-2026-113262

Insecure permissions in klassm AndFHEM v2.4.1 versionCode 241, the verified build allows unauthorized attackers to arbitrarily manipulate another user's FHEM home-automation control configurations...

CVE-2026-107051

The software klassm AndFHEM version v2.4.1 (versionCode 241, verified build) is impacted by a vulnerability involving insecure permissions . This flaw allows unauthorized attackers to arbitrarily manipulate the FHEM home-automation control configurations of another user. No specific exploitation ...

Linux Distros Unpatched Vulnerability : CVE-2026-113715

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, the stdlib venv creator reads generated pyvenv.cfg with str.splitlines...

CVE-2026-101104

The Meari IoT Cloud Platform OpenAPI Service is vulnerable to an authorization flaw that allows authenticated users to manipulate the configurations of devices they do not own. This vulnerability enables attackers to perform unauthorized actions, such as altering device settings or triggering...

EUVD-2026-91746

The Meari IoT Cloud Platform OpenAPI Service is vulnerable to an authorization flaw that allows authenticated users to manipulate the configurations of devices they do not own. This vulnerability enables attackers to perform unauthorized actions, such as altering device settings or triggering...

AlmaLinux 9.2 [TuxCare] Security Update: python3-unbound / unbound / unbound-devel / unbound-libs (ALMALINUX9.2:CLSA-2025:1738170016)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1738170016 advisory. - A vulnerability was found in Unbound due to incorrect default permissions, allowing any process outside the unbound group to modify the...

CVE-2026-85983

The Auth0 AD/LDAP Connector improperly processes a configuration value during service startup. This allows a low-privileged user on the host system to modify the connector's configuration. When the service restarts, the modified configuration can lead to code execution with the privileges of the...

CVE-2026-85983

CVE-2026-85983 is a local privilege escalation in the Auth0 AD/LDAP Connector . The connector improperly processes a configuration value during service startup, allowing a low-privileged user on the host to modify the connector's configuration. Upon service restart, the altered configuration can ...

CVE-2026-84647

A flaw was found in Stapler, a web framework included in Jenkins. This vulnerability allows an attacker with 'Overall/Read' permission to instantiate objects related to configuration through form data binding. The system does not properly restrict the types of objects that can be created, enablin...

CVE-2026-84647

Stapler versions 2107.v8dfcb_e8ed317 and earlier (except 2088.2093.vd7c3e58008a_6), which are included in Jenkins 2.579 and earlier, and LTS 2.568.2 and earlier, are vulnerable to an object instantiation flaw. The root cause is that Stapler fails to restrict the types of objects instantiated via ...

CVE-2026-82078 PaperCut MF/NG: Unsafe Dynamic Class Loading in Database Connector

An unsafe dynamic class loading vulnerability exists in the database connection utilities of PaperCut MF and PaperCut NG. The application instantiates database driver classes based on configurable driver names without validating against an allowlist of approved drivers. If an attacker can...

CVE-2026-67578

FA-50 all versions miss authentication for some configuration. An attacker with access to the vessel's internal network can manipulate the product's settings screen to alter some configuration parameters...

EUVD-2026-65318

FA-50 all versions miss authentication for some configuration. An attacker with access to the vessel's internal network can manipulate the product's settings screen to alter some configuration parameters...

CVE-2026-67578

The Furuno FA-50 (all versions) has a missing authentication flaw affecting certain configuration parameters. An attacker with access to the vessel's internal network can manipulate the product's settings screen to alter configuration without authentication. The CVSS 3.1 score is 7.5 (HIGH) with ...

CVE-2026-67578

FA-50 all versions miss authentication for some configuration. An attacker with access to the vessel's internal network can manipulate the product's settings screen to alter some configuration parameters...