DLLHijackHunter

DLLHijackHunter By ProjectMerai Automated DLL hijacking discovery, validation, and confirmation for Windows From "this DLL might be hijackable" to "a standard user can make SYSTEM load this — here is the proof." Contents Overview Quick start How it works What it detects Reducing false positives...

XSSYA

XSSYA-V2.0 has been Released - check https://github.com/yehia-mamdouh/XSSYA-V-2.0 XSSYA is a Cross Site Scripting Scanner & Vulnerability Confirmation Working in two Methods • Method number 1 for Confirmation Request and Response • Method number 2 for Confirmation Execute encoded payload and sear...

Profile Builder <= 3.11.8 - Unauthenticated Privilege Escalation

Profile Builder and Profile Builder Pro WordPress plugins up to and including 3.11.8 compare the submitted registration email against existing users and pending signups without trimming whitespace. Because MySQL string equality ignores trailing spaces but PHP does not, and a leading space desyncs...

XWiki DeleteApplication - Cross-Site Scripting

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Versions 6.2-milestone-1 through 16.10.9 and 17.0.0-rc-1 through 17.4.1 of both XWiki Platform Flamingo Skin Resources and XWiki Platform Web Templates are vulnerable to a reflected XSS attack...

GHSA-736F-C93Q-9FWX russh try_sign: asynchronous confirmation can sign after agent lock

Summary In russh 0.65.0, a sign request for a confirmation-constrained key can retain and use the private key after another connection locks the agent. trysign snapshots an Arc before awaiting Agent::confirm and does not revalidate the shared lock state after the await. An agent-forwarding peer c...

russh try_sign: asynchronous confirmation can sign after agent lock

Summary In russh 0.65.0, a sign request for a confirmation-constrained key can retain and use the private key after another connection locks the agent. trysign snapshots an Arc before awaiting Agent::confirm and does not revalidate the shared lock state after the await. An agent-forwarding peer c...

EUVD-2026-125722

russh is a Rust SSH client and server library that includes an SSH agent protocol implementation. Prior to version 0.65.1, trysign captures an Arc before awaiting Agent::confirm and does not revalidate the shared lock state or key presence after the await. This is a distinct residual defect in th...

CVE-2026-128088 russh try_sign: asynchronous confirmation can sign after agent lock

russh is a Rust SSH client and server library that includes an SSH agent protocol implementation. Prior to version 0.65.1, trysign captures an Arc before awaiting Agent::confirm and does not revalidate the shared lock state or key presence after the await. This is a distinct residual defect in th...

CVE-2026-128047 OpenMage magento-lts before 20.18.2 Account Takeover via Predictable Confirmation Key

OpenMage magento-lts before 20.18.2 and 21.0.0-beta pre-releases before 21.0.0-beta3 generate customer email-confirmation keys with md5uniqid and customer and administrator password-reset tokens with the non-cryptographic uniqHash. Unauthenticated attackers can brute-force the roughly 20-bit...

CVE-2026-128047

The OpenMage magento-lts platform versions before 20.18.2 and 21.0.0-beta pre-releases before 21.0.0-beta3 are vulnerable to an account takeover due to predictable confirmation keys . The root cause is the use of insufficiently random values, specifically generating customer email-confirmation ke...

CVE-2023-36644

== Affected Software %hardbreaks Vendor: ITB-GmbH Affected Products: TradePro v9.5 Component: Printmail Plugin Confirmed: yes == Attack Vector %hardbreaks Type: Incorrect Access Control Access-Type: Remote Impact: Information Disclosure Incorrect Access Control in the printmail plugin in ITB-GmbH...

PT-2026-146530

Name of the Vulnerable Software and Affected Versions OpenMage magento-lts versions prior to 20.18.2 OpenMage magento-lts versions prior to 21.0.0-beta3 Description Customer email-confirmation keys are generated using md5uniqid, while customer and administrator password-reset tokens use the...

CVE-2025-43929

CVE-2025-43929 Proof-of-concept for CVE-2025-43929, a high-severity vulnerability in KiTTY allowing for local executables to be ran without user confirmation under certain circumstances Vulnerability Type CWE-346: CWE-346 Origin Validation Error Vulnerability Description openactions.py in kitty...

CVE-2026-126198

pgEdge Postgres MCP Server enables SQL queries against PostgreSQL databases through Model Context Protocol compatible clients. Prior to 1.1.0, the bundled clients, including the CLI and web client, decided whether to request write confirmation by checking only for the querydatabase tool name...

CVE-2026-126199 pgEdge Postgres MCP Server write confirmation skipped for writes that begin with a reading keyword

pgEdge Postgres MCP Server enables SQL queries against PostgreSQL databases through Model Context Protocol compatible clients. Prior to 1.1.0, the bundled CLI and web clients classified querydatabase statements only by their first keyword before deciding whether to display a write confirmation...

CVE-2026-126199 pgEdge Postgres MCP Server write confirmation skipped for writes that begin with a reading keyword

pgEdge Postgres MCP Server enables SQL queries against PostgreSQL databases through Model Context Protocol compatible clients. Prior to 1.1.0, the bundled CLI and web clients classified querydatabase statements only by their first keyword before deciding whether to display a write confirmation...

CVE-2026-126199

The pgEdge Postgres MCP Server (prior to version 1.1.0 ) contains a vulnerability where the bundled CLI and web clients fail to request user confirmation for specific write operations. The root cause is that the application classifies query_database statements based only on the first keyword. Con...

CVE-2026-126198 pgEdge Postgres MCP Server custom tools performed writes without user confirmation

pgEdge Postgres MCP Server enables SQL queries against PostgreSQL databases through Model Context Protocol compatible clients. Prior to 1.1.0, the bundled clients, including the CLI and web client, decided whether to request write confirmation by checking only for the querydatabase tool name...

EUVD-2026-124569

pgEdge Postgres MCP Server enables SQL queries against PostgreSQL databases through Model Context Protocol compatible clients. Prior to 1.1.0, the bundled clients, including the CLI and web client, decided whether to request write confirmation by checking only for the querydatabase tool name...

CVE-2026-126198 pgEdge Postgres MCP Server custom tools performed writes without user confirmation

pgEdge Postgres MCP Server enables SQL queries against PostgreSQL databases through Model Context Protocol compatible clients. Prior to 1.1.0, the bundled clients, including the CLI and web client, decided whether to request write confirmation by checking only for the querydatabase tool name...