CVE-2026-68376

The CVE-2026-68376 issue concerns the Linux kernel SCTP implementation. A miscalculated auth_hmacs array size in struct sctp_cookie caused the HMAC-ALGO parameter (struct sctp_paramhdr plus N HMAC identifiers) to overflow the buffer when four identifiers are configured, leading to copying beyond ...

CVE-2026-68376 sctp: fix auth_hmacs array size in struct sctp_cookie

In the Linux kernel, the following vulnerability has been resolved: sctp: fix authhmacs array size in struct sctpcookie The authhmacs array in struct sctpcookie is supposed to store a complete SCTPAUTHHMACALGO parameter, which consists of a struct sctpparamhdr followed by N HMAC identifiers...

EUVD-2026-55562

In the Linux kernel, the following vulnerability has been resolved: sctp: fix authhmacs array size in struct sctpcookie The authhmacs array in struct sctpcookie is supposed to store a complete SCTPAUTHHMACALGO parameter, which consists of a struct sctpparamhdr followed by N HMAC identifiers...

CVE-2026-68300 sctp: auth: verify auth requirement when auth_chunk is NULL

In the Linux kernel, the following vulnerability has been resolved: sctp: auth: verify auth requirement when authchunk is NULL sctpauthchunkverify returns true unconditionally when chunk-authchunk is NULL, silently skipping authentication. This is incorrect when: 1. skbclone failed in the BH...

EUVD-2026-55401

In the Linux kernel, the following vulnerability has been resolved: sctp: auth: verify auth requirement when authchunk is NULL sctpauthchunkverify returns true unconditionally when chunk-authchunk is NULL, silently skipping authentication. This is incorrect when: 1. skbclone failed in the BH...

CVE-2026-68300

Summary: CVE-2026-68300 in the Linux kernel concerns SCTP authentication. The function sctp_auth_chunk_verify() incorrectly returns true when auth_chunk is NULL, allowing authentication to be bypassed under certain conditions (e.g., skb_clone() failure in BH path or absence of an AUTH before COOK...

CVE-2026-19049

The ProSolution WP Client WordPress plugin before 2.0.9 does not sanitise a cookie value before using it in SQL queries, and processes that cookie on every request without any authentication or capability check, allowing unauthenticated users to read arbitrary data from the database and to delete...

CVE-2026-13600

The AutoNetTV Relay WordPress plugin before 3.0.14 does not perform any capability or authentication check before setting a WordPress administrator authentication cookie during its scheduled content-synchronization task. On server configurations where the scheduled task executes before the HTTP...

Bash Shellshock - HTTP CGI Detection (CVE-2014-6271)

Detects Shellshock by injecting :;; id into User-Agent/Referer/Cookie against common CGI paths and matching uid=/gid=. !/usr/bin/env python3 -- coding: utf-8 -- """GNU Bash Shellshock HTTP CGI RCE CVE-2014-6271 / CVE-2014-6278.""" import re from kittysploit import from lib.protocols.http.httpclie...

CVE-2026-19049

The ProSolution WP Client WordPress plugin before 2.0.9 does not sanitise a cookie value before using it in SQL queries, and processes that cookie on every request without any authentication or capability check, allowing unauthenticated users to read arbitrary data from the database and to delete...

EUVD-2026-55010

The ProSolution WP Client WordPress plugin before 2.0.9 does not sanitise a cookie value before using it in SQL queries, and processes that cookie on every request without any authentication or capability check, allowing unauthenticated users to read arbitrary data from the database and to delete...

CVE-2026-19049 ProSolution WP Client < 2.0.9 - Unauthenticated SQLi and Plugin Data Deletion via 'removesite' Cookie

The ProSolution WP Client WordPress plugin before 2.0.9 does not sanitise a cookie value before using it in SQL queries, and processes that cookie on every request without any authentication or capability check, allowing unauthenticated users to read arbitrary data from the database and to delete...

CVE-2026-19049 ProSolution WP Client < 2.0.9 - Unauthenticated SQLi and Plugin Data Deletion via 'removesite' Cookie

The ProSolution WP Client WordPress plugin before 2.0.9 does not sanitise a cookie value before using it in SQL queries, and processes that cookie on every request without any authentication or capability check, allowing unauthenticated users to read arbitrary data from the database and to delete...

CVE-2026-19049

The ProSolution WP Client WordPress plugin (versions before 2.0.9 ) is vulnerable to unauthenticated SQL injection and plugin data deletion. The root cause is the failure to sanitize a cookie value before using it in SQL queries; the plugin processes this cookie on every request without any authe...

CVE-2026-13600

The AutoNetTV Relay WordPress plugin before 3.0.14 does not perform any capability or authentication check before setting a WordPress administrator authentication cookie during its scheduled content-synchronization task. On server configurations where the scheduled task executes before the HTTP...

CVE-2026-13600

The AutoNetTV Relay WordPress plugin (versions before 3.0.14 ) is vulnerable to unauthenticated privilege escalation due to a lack of capability or authentication checks during its scheduled content-synchronization task. On specific server configurations where the task executes before the HTTP re...

EUVD-2026-55022

The AutoNetTV Relay WordPress plugin before 3.0.14 does not perform any capability or authentication check before setting a WordPress administrator authentication cookie during its scheduled content-synchronization task. On server configurations where the scheduled task executes before the HTTP...

CVE-2026-13600 AutoNetTV Relay < 3.0.14 - Unauthenticated Privilege Escalation via Scheduled Sync Cron

The AutoNetTV Relay WordPress plugin before 3.0.14 does not perform any capability or authentication check before setting a WordPress administrator authentication cookie during its scheduled content-synchronization task. On server configurations where the scheduled task executes before the HTTP...

CVE-2026-13600 AutoNetTV Relay < 3.0.14 - Unauthenticated Privilege Escalation via Scheduled Sync Cron

The AutoNetTV Relay WordPress plugin before 3.0.14 does not perform any capability or authentication check before setting a WordPress administrator authentication cookie during its scheduled content-synchronization task. On server configurations where the scheduled task executes before the HTTP...

CVE-2026-13600: Improper Authentication

The AutoNetTV Relay WordPress plugin before 3.0.14 does not perform any capability or authentication check before setting a WordPress administrator authentication cookie during its scheduled content-synchronization task. On server configurations where the scheduled task executes before the HTTP...