hybris Commerce - medias context LFI Detection (CVE-2014-8871)

Detects CVE-2014-8871 by requesting /medias/?context= with a base64-encoded master|root|...|../../../../../../etc/passwd| payload. !/usr/bin/env python3 -- coding: utf-8 -- """hybris Commerce context= base64 path traversal CVE-2014-8871.""" import base64 import re from kittysploit import from...

hybris Commerce - medias context File Read (CVE-2014-8871)

Reads arbitrary files via CVE-2014-8871 base64 context parameter on /medias/. !/usr/bin/env python3 -- coding: utf-8 -- """hybris Commerce medias context file read CVE-2014-8871.""" import base64 from kittysploit import from lib.protocols.http.httpclient import Httpclient from...

EUVD-2026-54995

The s2Member WordPress plugin before 260805 does not escape several shortcode attributes before outputting them inside an inline script context, allowing users with contributor-level access to inject arbitrary JavaScript that executes when a viewer opens the post stored XSS...

PT-2026-69347

Name of the Vulnerable Software and Affected Versions s2Member WordPress plugin versions prior to 260805 Description The plugin fails to escape several shortcode attributes before they are output within an inline script context. This allows users with contributor-level access to perform a stored...

RHEL 9 : xorg-x11-server-Xwayland (RHSA-2026:52398)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:52398 advisory. Xwayland is an X server for running X clients under Wayland. Security Fixes: xorg: X11: xserver: X.org: glamor Font Atlas Heap Buffer...

PT-2026-69878

Name of the Vulnerable Software and Affected Versions Dokploy versions prior to 0.29.13 Description An authenticated member with backup-restore permissions can execute arbitrary operating-system commands in the host context via execAsync or execAsyncRemote. This occurs because the...

PT-2026-69643

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A NULL pointer dereference occurs in the drm/i915/gem component. This happens when a context engine slot N is set to I915 ENGINE CLASS INVALID or I915 ENGINE CLASS INVALID NONE, and an...

CVE-2026-48158: Embedded Malicious Code

use-context-selector is a React useContextSelector hook in userland Between 2026-05-18 15:57:18 and 2026-05-19 15:24:34, the default branch contained malicious commits 9d8481a513b7b0d1c0941b220c69b25de748641b through 6f2dae054ca014068bdbbb4db96006424d674124 that executed remote attacker-controlle...

CVE-2026-68223: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: media: meson: vdec: Fix memory leak in error path of vdecopen The vdecopen function previously jumped directly to errm2mrelease when vdecinitctrls failed, skipping release of the m2m context. This caused a resource leak. Fix it b...

PT-2026-69488

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A scheduling while atomic bug exists in the Linux kernel. The function wacom wac queue flush is called through the .raw event callback sequence wacom raw event → wacom wac pen serial...

PT-2026-69642

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A NULL dereference occurs in the IOCTL path when a sched engine allocation fails. This happens because intel context put is called before intel context init within the execlists create...

CVE-2026-72865: Improper Neutralization of Special Elements used in an OS Command

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, the compose.update operation stores an unvalidated composePath that packages/server/src/utils/builders/compose.ts and packages/server/src/services/compose.ts interpolate into docker compose -f, docker stack deploy -c,...

PT-2026-69857

Name of the Vulnerable Software and Affected Versions use-context-selector affected versions not specified Description Between 2026-05-18 15:57:18 and 2026-05-19 15:24:34, the default branch contained malicious commits that executed remote attacker-controlled code on developer machines during npm...

PT-2026-69623

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A resource leak occurs in the Linux kernel within the meson vdec component. The vdec open function fails to release the m2m context when the vdec init ctrls function fails, as it jumps...

PT-2026-69644

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the drm/i915/gem component where a memory leak occurs during proto context error handling. Specifically, after a successful BALANCE/PARALLEL SUBMIT extension during...

MINI-W9GH-RQH8-V7QW

Bulletin has no description...

MINI-2592-W78V-765R

Bulletin has no description...

mcp-injection-poc

MCP Transparent Proxy Injection — Proof of Concept CVE: pe...

Not an A11y: How Android Accessibility Exposes Mobile AI Agents to Indirect Prompt Injection

The rise of autonomous AI agents represents a major paradigm shift in how users interact with mobile devices. Frameworks such as MobileRun and Mobile-Use can autonomously navigate Android applications and execute complex multi-step tasks. To interpret user interfaces, these frameworks rely...

CVE-2026-71502

CTI-Transmute contains a stored cross-site scripting vulnerability caused by insufficient neutralization of Vue template expression delimiters in server-rendered user-controlled data. An unauthenticated attacker can create a public conversion whose name or description contains a malicious Vue...