CVE-2026-86218

CVE-2026-86218 - Эксплойт Pre-Auth RCE в N-able N-central Обзор Это proof-of-concept эксплойт на Python 3 для CVE-2026-86218 — критической уязвимости удалённого выполнения кода до аутентификации в N-able N-central. Сведения об уязвимости: CVE: CVE-2026-86218 Оценка CVSS: 10.0 Критическая CWE:...

CVE-2026-1769-WriteUp

CVE-2026-1769 — Хранимый XSS в Xerox CentreWare Web Хронология раскрытия и техническое описание для CVE-2026-1769 , уязвимости хранимого межсайтового скриптинга, которую я выявил и ответственно раскрыл компании Xerox. Запись CVE: cve.org/CVERecord?id=CVE-2026-1769 Бюллетень безопасности...

CVE-2026-93349-frictionless-command-injection

CVE-2026-93349: Инъекция команд ОС в frictionless = 5.20.0rc1 explore Уровень опасности: Высокий, CVSS 3.1 8.8 Вектор: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Затронуто: все версии Frictionless = 5.20.0rc1 Компонент: frictionless.console.commands.explore CWE: CWE-78 Инъекция команд ОС, CWE-2...

CVE-2026-35196

CVE-2026-35196 · Chamilo LMS · Внедрение команд ОС → RCE Исследователь: K Тип раскрытия: Ответственное раскрытие Статус: Исправлено Затронутый продукт: Chamilo LMS 2.0 подтверждено на v1.11.32 📋 Сводка об уязвимости Поле| Сведения ---|--- Продукт| Chamilo LMS Затронутая версия| 2.0 подтверждено н...

CVE-2026-54519

CVE-2026-54519 ai-agent-automation des vérifications de propriété manquantes dans les API mémoire ont permis la lecture et la suppression de mémoire entre utilisateurs. Avis principal : GHSA-qv97-83w4-ff86 Crédit du chercheur : @chaitanyagarware En un coup d'œil Champ| Valeur ---|--- CVE|...

CVE-2025-26198

CVE-2025-26198 - SQL Injection Demonstration Projet académique ENSIMAG - Sécurité 3A Auteurs : Wail Yacoubi, Mohammed-Yassine Akhmari Date : Janvier 2026 Avertissement Ce code est intentionnellement vulnérable à des fins éducatives. Ne jamais déployer en production. Description Reproduction de...

CVE-2025-57392

CVE-2025-57392 🔒 Rapport de vulnérabilité de sécurité Produit : BenimPOS Desktop V3.0 Type de vulnérabilité : Permissions de fichiers non sécurisées Composants concernés : BenimPOS.exe, unins000.exe, System.Data.SQLite.dll Classe de vulnérabilité : CWE-276 : Permissions par défaut incorrectes...

CVE-2026-39275

CVE-2026-39275 - XSS stocké menant à la prise de contrôle de compte dans Cockpit CMS Note: Divulgué de manière responsable et corrigé par les mainteneurs de Cockpit CMS avant publication. | ---|--- Identifiant CVE| CVE-2026-39275 Vulnérabilité| Cross-Site Scripting stocké XSS → Prise de contrôle ...

SEOWON INTECH SLC-130 & SLR-120S - Unauthenticated Remote Code Execution

SEOWON INTECH SLC-130 and SLR-120S devices allow remote code execution via the ipAddr parameter to the systemlog.cgi page. id: CVE-2020-17456 info: name: SEOWON INTECH SLC-130 & SLR-120S - Unauthenticated Remote Code Execution author: gy741,edoardottt severity: critical description: SEOWON INTECH...

Session-Persistence-After-Enabling-2FA-CVE-2025-60425

Сохранение сеансов после включения 2FA Обзор Приложение Nagios Fusion версии 2024R1.2 и 2024R2 содержит серьёзную уязвимость, из-за которой существующие сеансы остаются действительными даже после включения двухфакторной аутентификации 2FA. В частности, при включении 2FA для учётной записи...

AuraForge: Scaling Security Supervision for Training Coding Agents

Coding agents are now proficient enough to generate complex software applications from a single prompt. As their capabilities have grown, human oversight has increasingly shifted from line-by-line code review toward hands-off evaluation of outcomes. However, recent studies have shown that such a...

Linux Distros Unpatched Vulnerability : CVE-2026-84784

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Issue summary: A malicious remote peer may flood the local QUIC stack with NEWCONNECTIONID frames by avoiding a limit check on how many connection IDs the remot...

CentOS Linux 8.5 [TuxCare] Security Update: openssl / openssl-devel / openssl-libs / openssl-perl / etc Multiple Vulnerabilities (CENTOS8.5:CLSA-2026:1788264701)

The CentOS Linux 8.5 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.5:CLSA-2026:1788264701 advisory. - Issue summary: Receiving a DTLS record for a future epoch while a handshake is in progress causes OpenSSL to buffer far more memor...

OpenSSL 1.0.2 < 1.0.2zs Multiple Vulnerabilities

The version of OpenSSL installed on the remote host is prior to 1.0.2zs. It is, therefore, affected by multiple vulnerabilities as referenced in the 1.0.2zs advisory. - Issue summary: The DTLS retransmission logic does not correctly handle a handshake message write that is suspended part-way...

Elasticsearch 8.x < 8.19.22 / 9.0.x < 9.4.7 / 9.5.x < 9.5.4 DoS (ESA-2026-180)

The version of Elasticsearch installed on the remote host is 8.x prior to 8.19.22, or 9.0.x prior to 9.4.7, or 9.5.x prior to 9.5.4. It is, therefore, affected by a vulnerability as referenced in the ESA-2026-180 advisory. - Uncontrolled Resource Consumption CWE-400 in Elasticsearch can lead deni...

Elasticsearch 8.x < 8.19.21 / 9.0.x < 9.4.6 / 9.5.x < 9.5.3 DoS (ESA-2026-170)

The version of Elasticsearch installed on the remote host is 8.x prior to 8.19.21, or 9.0.x prior to 9.4.6, or 9.5.x prior to 9.5.3. It is, therefore, affected by a vulnerability as referenced in the ESA-2026-170 advisory. - Uncontrolled Resource Consumption CWE-400 in Elasticsearch can lead to...

Security Bulletin: IBM Maximo Application Suite - Location Service for Esri Component is vulnerable to CVE-2026-18513, CVE-2026-18537, CVE-2026-18529, CVE-2026-18533, CVE-2026-18517 and CVE-2026-88029

Summary IBM Maximo Application Suite - Location Service for Esri Component is vulnerable to CVE-2026-18513, CVE-2026-18537, CVE-2026-18529, CVE-2026-18533, CVE-2026-18517 and CVE-2026-88029 because of CR author can redirect arcgis-admin RoleBinding to own ServiceAccount, CR author can override...

Oauthlib: Timing Attack Vulnerability in PKCE code_verifier Comparison (CWE-208)

Summary A timing side-channel vulnerability exists in the PKCE RFC 7636 implementation of the Authorization Code Grant flow. The codechallengemethodplain function uses Python's standard == operator for string comparison instead of a constant-time comparison function, potentially allowing...

CVE-2022-0482_exploit

Эксплуатация уязвимости CVE-2022-0482 Введение В этом документе представлен подробный анализ CVE-2022-0482, критической уязвимости безопасности, выявленной в программном обеспечении для планирования Easy!Appointments. Этот недостаток, связанный с неверной авторизацией по CWE-863, позволяет...

CVE-2026-46394-haxcms-git-command-injection

CVE-2026-46394 - Injection de commandes OS CWE-78 dans Git.php de HAXcms Preuve de concept pour tests de sécurité autorisés et recherche uniquement. La vulnérabilité décrite ici est corrigée dans la dernière version de HAXcms. Cette PoC est publiée afin que les défenseurs et les chercheurs puisse...