CVE-2026-105117 OpenAM before 16.1.3 Email Content Injection via Users REST Self-Service Actions

OpenAM before 16.1.3 contains an email content injection vulnerability that allows unauthenticated attackers to control notification email wording via the forgotPassword and register actions on /json/realm/users. Attackers can supply subject and message fields to send phishing mail from the...

CVE-2018-19629

CVE-2018-19629 테스트 환경 CVE-2018-19629 - Hyland Perceptive Content Server 서비스 거부Denial of Service를 위한 Docker 테스트 환경입니다. 취약점 세부 정보 필드| 값 ---|--- CVE ID| CVE-2018-19629 심각도| 높음DoS 영향받는 버전| Hyland Perceptive Content Server 7.1.5 패치 버전| 7.1.5 설명 Hyland Perceptive Content Server 7.1.5 이전 버전에는 TCP 연결을 통해...

CVE-2026-21858-and-CVE-2025-68613

Ni8mare: n8n 사전 인증 RCE CVE-2026-21858 & CVE-2025-68613 — 취약점 랩 & PoC 보고서 n8n 플랫폼에서 인증 없이 Arbitrary File ReadCVE-2026-21858에서 Remote Code ExecutionCVE-2025-68613까지 이어지는 Ni8mare 취약점 체인에 대한 실습 환경Vulnerable Lab 및 상세 익스플로잇 분석 보고서입니다. 상세 분석 및 익스플로잇 보고서 단계별로 설명된 PoC 이미지가 포함된 전체 분석 문서는 공식 보고서에서 확인하세요: 상세...

DEBIAN-CVE-2026-71888

In Bouncy Castle for Java before 1.86, the streaming CMS AuthenticatedData parser accepted a message whose digestAlgorithm and authAttrs fields disagreed about whether authenticated attributes were present. RFC 5652 sec. 9.1 pairs the two, requiring that authAttrs be present whenever...

DEBIAN-CVE-2026-71892

In Bouncy Castle for Java before 1.86, the opt-in key-size validation on CMS key-transport recipients, org.bouncycastle.cms.jcajce.JceKeyTransRecipient.setKeySizeValidationtrue, never ran for a message using RFC 9709 content-encryption key derivation id-alg-cek-hkdf-sha256. The branch that should...

CVE-2026-71888

The Bouncy Castle for Java library (versions before 1.86 ) contains a vulnerability in the streaming CMS AuthenticatedData parser. The parser incorrectly handles messages where the digestAlgorithm and authAttrs fields disagree on the presence of authenticated attributes. Because the parser makes ...

EUVD-2026-91989

In Bouncy Castle for Java before 1.86, the opt-in key-size validation on CMS key-transport recipients, org.bouncycastle.cms.jcajce.JceKeyTransRecipient.setKeySizeValidationtrue, never ran for a message using RFC 9709 content-encryption key derivation id-alg-cek-hkdf-sha256. The branch that should...

rails-forensics-CVE-2026-66066

rails-forensics-CVE-2026-66066 Tooling and method for answering two questions about a Rails application and CVE-2026-66066, the Active Storage and libvips arbitrary file read known as KindaRails2Shell: 1. Was I vulnerable, and for how long? 2. Was I exploited, and if so, what left the building? T...

CVE-2026-94505

The Nelio Content – Editorial Calendar & Social Media Auto-Posting plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.5.0 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...

CVE-2026-97660

The WPC Product Options for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via wpcpo- Array Key via Multipart Field Name in all versions up to, and including, 4.0.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticate...

CVE-2025-58179-Check

CVE-2025-58179-Check CVE-2025-58179-Check 은는 Astro 프레임워크의 /image 엔드포인트에서 SSRFServer-Side Request Forgery / 콘텐츠 스푸핑 취약점을 확인하는 간단한 Python 스크립트입니다. 이 취약점은 GHSA-qpr4-c339-7vq8 및 CVE-2025-58179로 추적됩니다. 취약점 배경 이 취약점은 output: 'server' 구성으로 @astrojs/cloudflare 어댑터를 사용하는 Astro 사이트에 영향을 미칩니다. 이미지를 최적화해야 하는...

EUVD-2026-91961

The Nelio Content – Editorial Calendar & Social Media Auto-Posting plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.5.0 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...

CVE-2026-94505 Nelio Content <= 4.5.0 - Missing Authorization to Authenticated (Contributor+) Arbitrary Reusable Message Deletion via 'id' Parameter

The Nelio Content – Editorial Calendar & Social Media Auto-Posting plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.5.0 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...

CVE-2026-94505

The Nelio Content – Editorial Calendar & Social Media Auto-Posting plugin for WordPress is vulnerable to an authorization bypass in all versions up to and including 4.5.0 . The root cause is the plugin's failure to properly verify user permissions before performing actions. This allows authentica...

CVE-2026-94505 Nelio Content <= 4.5.0 - Missing Authorization to Authenticated (Contributor+) Arbitrary Reusable Message Deletion via 'id' Parameter

The Nelio Content – Editorial Calendar & Social Media Auto-Posting plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.5.0 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...

EUVD-2026-91952

The WPC Product Options for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via wpcpo- Array Key via Multipart Field Name in all versions up to, and including, 4.0.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticate...

CVE-2026-97660

The WPC Product Options for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 4.0.5 . The root cause is insufficient input sanitization and output escaping. Unauthenticated attackers can exploit this via a guest checkout by emb...

CVE-2026-97660 WPC Product Options for WooCommerce <= 4.0.5 - Unauthenticated Stored Cross-Site Scripting via wpcpo-* Array Key via Multipart Field Name

The WPC Product Options for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via wpcpo- Array Key via Multipart Field Name in all versions up to, and including, 4.0.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticate...

CVE-2026-97660 WPC Product Options for WooCommerce <= 4.0.5 - Unauthenticated Stored Cross-Site Scripting via wpcpo-* Array Key via Multipart Field Name

The WPC Product Options for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via wpcpo- Array Key via Multipart Field Name in all versions up to, and including, 4.0.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticate...

chameleon

Chameleon Chameleon은 wappalyzer의 기술 지문 세트와 감지된 각 기술에 맞춤화된 사용자 정의 워드리스트를 함께 사용하여 더 나은 콘텐츠 검색을 제공합니다. 이 도구는 사용자 정의가 용이하며, 사용자가 자신만의 맞춤 워드리스트, 확장자, 지문을 추가할 수 있습니다. 전체 문서는 다음에서 확인할 수 있습니다: https://youst.in/posts/context-aware-conent-discovery-with-chameleon/ 설치 Linux 64-bit 및 MacOS curl -sL...