CVE-2026-114437

A flaw was found in chi. The ClientIPFromXFF middleware evaluates IP addresses in the X-Forwarded-For XFF HTTP header, but fails to verify that the direct incoming network connection originates from a trusted IP address range. A remote attacker who can connect directly to the server can exploit...

http2-bomb-detector

http2-bomb-detector HTTP/2 Bomb CVE-2026-49975 Non-destructive vulnerability detection tool — for Nginx / Apache httpd Vulnerability Background CVE-2026-49975 is a widespread remote denial-of-service vulnerability in the HTTP/2 protocol layer, discovered by security researcher Quang Luong. This...

CVE-2026-25253

CVE-2026-25253 OpenClaw 1-Click RCE ★ CVE-2026-25253 OpenClaw 1-Click Remote Code Execution PoC ★ https://github.com/user-attachments/assets/e6957c61-7549-4e68-831e-a05436504a3e Description CVE-2026-25253 : OpenClaw Authentication Token Exfiltration Vulnerability description: OpenClaw aka clawdbo...

EUVD-2026-108110

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Elated-Themes Academist Core academist-core allows PHP Local File Inclusion.This issue affects Academist Core: from n/a through 1.4.1...

CVE-2026-112820

The Elated-Themes Academist Core WordPress plugin is vulnerable to PHP Local File Inclusion (LFI) due to improper control of filenames in include/require statements. This flaw affects versions up to and including 1.4.1 . While the vulnerability is confirmed, specific exploit details and remediati...

CVE-2026-112820 WordPress Academist Core plugin <= 1.4.1 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Elated-Themes Academist Core academist-core allows PHP Local File Inclusion.This issue affects Academist Core: from n/a through 1.4.1...

CVE-2026-112820 WordPress Academist Core plugin <= 1.4.1 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Elated-Themes Academist Core academist-core allows PHP Local File Inclusion.This issue affects Academist Core: from n/a through 1.4.1...

thm-cybersec-portfolio

TryHackMe Notes — Cybersecurity Portfolio Personal notes and summaries of completed TryHackMe rooms. Built as a study reference and portfolio for IT security roles. Completed Rooms | Room| Topic ---|---|--- 01| Linux Privilege Escalation| Linux privesc techniques 02| Sudo Buffer Overflow|...

CVE-2026-20127

🛡️ CVE-2026-20127 — Cisco Catalyst SD-WAN Authentication Bypass 📌 Overview CVE-2026-20127 is a critical authentication bypass vulnerability affecting Cisco Catalyst SD-WAN components, including controllers and management systems. A remote unauthenticated attacker can exploit improper authenticatio...

CVE-2026-114696

Missing Authorization vulnerability in miniOrange Page Restriction WordPress WP page-and-post-restriction allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Page Restriction WordPress WP: from n/a through 1.6.0...

CVE-2026-114699

Missing Authorization vulnerability in yoomoney ЮKassa для WooCommerce yookassa allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ЮKassa для WooCommerce: from n/a through 2.17.3...

CVE-2026-114698

Authorization Bypass Through User-Controlled Key vulnerability in myCred myCred mycred allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects myCred: from n/a through 4.0.0-beta.1...

CVE-2026-112312

Missing Authorization vulnerability in ACF Extended ACF Extended acf-extended allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ACF Extended: from n/a through 0.9.2.7...

CVE-2026-112218

Missing Authorization vulnerability in Ahmad Majestic Support majestic-support allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Majestic Support: from n/a through 1.2.1...

CVE-2026-110893

Missing Authorization vulnerability in Brainstorm Force SureDash suredash allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SureDash: from n/a through 1.12.2...

CVE-2026-110894

Missing Authorization vulnerability in Brainstorm Force SureDash suredash allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SureDash: from n/a through 1.12.2...

CVE-2026-111842

Missing Authorization vulnerability in WP Sunshine Sunshine Photo Cart sunshine-photo-cart allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sunshine Photo Cart: from n/a through 3.7.5...

CVE-2026-49975

CVE-2026-49975 HTTP/2 Bomb PoC HTTP/2 Remote Denial of Service Vulnerability Replication Tool Vulnerability Overview CVE-2026-49975 is an HTTP/2 denial of service vulnerability affecting major web servers. The vulnerability was discovered by security company Calif using OpenAI Codex in early June...

CVE-2026-35029-PoC

CVE-2026-35029 — LiteLLM /config/update Broken Access Control LiteLLM 's /config/update endpoint does not check the caller's role privileges. Any authenticated user with a valid API Key without admin privileges can modify the proxy configuration, register malicious Pass-Through endpoints to achie...

CVE-2026-44277

🚨 CVE-2026-44277 - FortiAuthenticator Unauthenticated RCE Critical Unauthenticated Remote Code Execution in Fortinet FortiAuthenticator 📋 Overview CVE-2026-44277 is a critical vulnerability in Fortinet FortiAuthenticator that allows unauthenticated attackers to achieve Remote Code Execution RCE v...