CVE-2026-93960

A vulnerability was identified in Pixelfed up to 0.12.11. Impacted is the function instancePeers of the file app/Http/Controllers/Api/ApiV1Controller.php of the component OAuth Scope Handler. Such manipulation of the argument ID leads to missing authentication. The attack may be performed from...

CVE-2026-86553

SmartLife app dynamically generates fresh SmartLife application authentication parameters inside its runtime process. Using the acquired SmartLife application authentication parameters, an attacker can directly call the backend interface /account/verify.serv to obtain the real account ID...

CVE-2026-86552

SmartLife app dynamically generates brand‑new SmartLife application authentication parameters at runtime. With the acquired SmartLife application authentication credentials, an attacker can directly complete registration using any arbitrary email address via the backend interface...

hexstrike-ai

HexStrike AI MCP Agents v6.0 AI-Powered MCP Cybersecurity Automation Platform Advanced AI-powered penetration testing MCP framework with 150+ security tools and 12+ autonomous AI agents 📋 What's New • 🏗️ Architecture • 🚀 Installation • 🛠️ Features • 🤖 AI Agents • 📡 API Reference Follow Our Social...

CVE-2026-86553 A password reset vulnerability in ZTE SmartLife APP

SmartLife app dynamically generates fresh SmartLife application authentication parameters inside its runtime process. Using the acquired SmartLife application authentication parameters, an attacker can directly call the backend interface /account/verify.serv to obtain the real account ID...

CVE-2026-86553

CVE-2026-86553 is a password reset vulnerability in the ZTE SmartLife mobile application. The root cause lies in how the app dynamically generates fresh authentication parameters within its runtime process. An attacker who acquires these parameters can directly call the backend endpoint /account/...

EUVD-2026-83649

SmartLife app dynamically generates fresh SmartLife application authentication parameters inside its runtime process. Using the acquired SmartLife application authentication parameters, an attacker can directly call the backend interface /account/verify.serv to obtain the real account ID...

CVE-2026-86552

CVE-2026-86552 affects the ZTE SmartLife APP , where the app dynamically generates new authentication parameters at runtime. An attacker possessing valid SmartLife authentication credentials can complete account registration with any arbitrary email address via the backend endpoint /account/perso...

EUVD-2026-83648

SmartLife app dynamically generates brand‑new SmartLife application authentication parameters at runtime. With the acquired SmartLife application authentication credentials, an attacker can directly complete registration using any arbitrary email address via the backend interface...

CVE-2026-86552 A vulnerability that skips email ownership verification for account registration in ZTE SmartLife APP

SmartLife app dynamically generates brand‑new SmartLife application authentication parameters at runtime. With the acquired SmartLife application authentication credentials, an attacker can directly complete registration using any arbitrary email address via the backend interface...

CVE-2026-93960 Pixelfed OAuth Scope ApiV1Controller.php instancePeers missing authentication

A vulnerability was identified in Pixelfed up to 0.12.11. Impacted is the function instancePeers of the file app/Http/Controllers/Api/ApiV1Controller.php of the component OAuth Scope Handler. Such manipulation of the argument ID leads to missing authentication. The attack may be performed from...

EUVD-2026-83647

A vulnerability was identified in Pixelfed up to 0.12.11. Impacted is the function instancePeers of the file app/Http/Controllers/Api/ApiV1Controller.php of the component OAuth Scope Handler. Such manipulation of the argument ID leads to missing authentication. The attack may be performed from...

CVE-2026-93960

A vulnerability in Pixelfed (up to version 0.12.11 ) affects the OAuth Scope Handler component, specifically the instancePeers function in app/Http/Controllers/Api/ApiV1Controller.php. Manipulation of the ID argument leads to missing authentication , enabling a remote attacker with low privileges...

CVE-2026-94083

Suricata before 8.0.7 has a DoH2 type confusion that can cause an invalid free, because cleanup code for the HTTP2 state is executed even though the actual state is HTTP1 when there is a DoH2 request with an HTTP1 to HTTP2 upgrade. This requires app-layer.protocols.doh2 to be enabled, which is th...

CVE-2026-94083

Suricata before 8.0.7 has a DoH2 type confusion that can cause an invalid free, because cleanup code for the HTTP2 state is executed even though the actual state is HTTP1 when there is a DoH2 request with an HTTP1 to HTTP2 upgrade. This requires app-layer.protocols.doh2 to be enabled, which is th...

CVE-2026-94083

Suricata before 8.0.7 is affected by a DoH2 type confusion vulnerability. When a DoH2 request includes an HTTP/1 to HTTP/2 upgrade, the HTTP/2 state cleanup code is executed even though the actual connection state is HTTP/1, leading to an invalid free . The issue requires app-layer.protocols.doh2...

EUVD-2026-83638

Suricata before 8.0.7 has a DoH2 type confusion that can cause an invalid free, because cleanup code for the HTTP2 state is executed even though the actual state is HTTP1 when there is a DoH2 request with an HTTP1 to HTTP2 upgrade. This requires app-layer.protocols.doh2 to be enabled, which is th...

AirStrike

root@kitploit: / \ / | | | | | / \ | || '|\ \ | || '|| || |/ / / \ / \ | || | || | | | | || | / // \|||| |/ ||| ||||\ | AirStrike is a Flask + Socket.IO web interface for orchestrating Wi-Fi assessment tools from a browser. This build intentionally focuses on the three most stable attacks in...

The vulnerability of the Webasyst content management framework and the Shop-Script CMS system lies in the lack of measures to protect the SQL query structure, allowing attackers to execute arbitrary SQL code.

The vulnerability of the Webasyst framework for designing content management systems and the Shop-Script CMS system lies in the lack of protective measures for the SQL query structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary SQL code remotely...

The vulnerability of the Webasyst content management framework and the Shop-Script CMS system lies in the lack of measures to protect the SQL query structure, allowing attackers to execute arbitrary SQL code.

The vulnerability of the Webasyst framework for designing content management systems and the Shop-Script CMS system lies in the lack of protective measures for the SQL query structure. Exploiting this vulnerability allows an attacker operating remotely to execute arbitrary SQL code...