CVE-2026-46438

wger is a free, open-source workout and fitness manager. Prior to version 2.6, an authenticated attacker can inject arbitrary workout log entries into any other user's SlotEntry by supplying the victim's slotentry ID in a POST /api/v2/workoutlog/ request. The slotentry foreign key is not included...

CVE-2026-46438

In versions prior to 2.6 , the wger fitness manager is vulnerable to a cross-user data corruption flaw. An authenticated attacker can inject arbitrary workout log entries into another user's SlotEntry by submitting a POST /api/v2/workoutlog/ request with a victim's slot_entry ID. This is possible...

EUVD-2026-94335

wger is a free, open-source workout and fitness manager. Prior to version 2.6, an authenticated attacker can inject arbitrary workout log entries into any other user's SlotEntry by supplying the victim's slotentry ID in a POST /api/v2/workoutlog/ request. The slotentry foreign key is not included...

CVE-2026-46438 wger: Cross-User Data Corruption via Missing Ownership Check on WorkoutLog.slot_entry

wger is a free, open-source workout and fitness manager. Prior to version 2.6, an authenticated attacker can inject arbitrary workout log entries into any other user's SlotEntry by supplying the victim's slotentry ID in a POST /api/v2/workoutlog/ request. The slotentry foreign key is not included...

wger: Cross-User Data Corruption via Missing Ownership Check on WorkoutLog.slot_entry

Summary An authenticated attacker can inject arbitrary workout log entries into any other user's SlotEntry by supplying the victim's slotentry ID in a POST /api/v2/workoutlog/ request. The slotentry foreign key is not included in the ownership verification performed by...

MAD-CAT

MAD-CAT 喵攻击数据损坏自动化工具 概述 MAD-CAT（喵攻击数据损坏自动化工具）是一款全面的安全工具，旨在模拟针对多种数据库系统的数据损坏攻击。该工具支持单目标攻击和基于CSV的批量攻击，同时支持凭据认证和非凭据认证的攻击场景。 支持的数据库服务 该工具目前支持以下数据库服务： MongoDB （端口 27017） Elasticsearch （端口 9200） Cassandra （端口 9042） Redis （端口 6379） CouchDB （端口 5984） Hadoop HDFS （端口 9870） 安装 克隆仓库 git clone...

kernel: dm cache policy smq: fix missing locks in invalidating cache blocks

A flaw was found in the Linux kernel's device-mapper dm cache policy, specifically within the smq module. In passthrough mode, the invalidatemapping operation lacks proper locking, allowing for concurrent access. This can lead to data races, resulting in data corruption or use-after-free issues,...

CVE-2026-90049

A flaw was found in the Linux kernel's networking subsystem. When the skbzerocopy function fails to orphan fragments, it incorrectly calls skbtxerror on the source skbuff skb. This premature completion of the zerocopy user argument and clearing of the SKBFLSHAREDFRAG flag can lead to a condition...

CVE-2026-90008

A flaw was found in the Linux kernel's megaraidsas component. The megasasmakeprpnvme function, which constructs a list of memory pages for data transfers, fails to verify the allocated buffer's boundaries. This can result in a buffer overrun, potentially leading to a system crash Denial of Servic...

openssh: OpenSSH: Information disclosure and data corruption via use-after-free in ssh client

A flaw was found in OpenSSH. A use-after-free vulnerability exists in the ssh client when handling concurrent remote-forwarding operations. This can occur if a remote forwarding is added via the local session multiplexing socket while a remote forwarding open request is pending with the server. A...

Important: Red Hat Security Advisory: openssh security update

An update for openssh is now available for Red Hat Enterprise Linux 10.0 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available fo...

EUVD-2026-93300

In the Linux kernel, the following vulnerability has been resolved: ntfs: protect runlist updates with the runlist lock ntfsnonresidentattrshrink calls runlist helpers that require the runlist write lock, but did not hold it while freeing clusters and truncating the runlist. Serialize those...

CVE-2026-98315 ntfs: protect runlist updates with the runlist lock

In the Linux kernel, the following vulnerability has been resolved: ntfs: protect runlist updates with the runlist lock ntfsnonresidentattrshrink calls runlist helpers that require the runlist write lock, but did not hold it while freeing clusters and truncating the runlist. Serialize those...

CVE-2026-94278

The File Media Renamer WordPress plugin through 1.3 does not verify that the requesting user is authorised to modify a given media attachment, allowing any user with file-upload privileges to rename attachments belonging to other users, including administrators, and to corrupt unrelated stored si...

EUVD-2026-92968

The File Media Renamer WordPress plugin through 1.3 does not verify that the requesting user is authorised to modify a given media attachment, allowing any user with file-upload privileges to rename attachments belonging to other users, including administrators, and to corrupt unrelated stored si...

CVE-2026-94278 File Media Renamer <= 1.3 - Author+ Arbitrary File Rename via save-attachment-compat

The File Media Renamer WordPress plugin through 1.3 does not verify that the requesting user is authorised to modify a given media attachment, allowing any user with file-upload privileges to rename attachments belonging to other users, including administrators, and to corrupt unrelated stored si...

CVE-2026-90015

A flaw was found in the Linux kernel's xHCI eXtensible Host Controller Interface driver. This vulnerability occurs when the driver processes large, fragmented USB data transfers, leading to incorrect handling of memory buffers. An attacker with local access or a malicious USB device could exploit...

kernel: gfs2: add some missing log locking

A flaw was found in the Linux kernel's Global File System 2 GFS2 component. The gfs2logd function, responsible for log flushing, calls several log flushing functions without holding the required lock. This omission allows concurrent transactions to access shared resources without proper exclusion...

CVE-2024-36971

CVE-2024-36971 — 概念验证（仅限研究与分析） ⚠️ 免责声明 — 使用本仓库前请阅读 本仓库仅 用于防御性研究、分析和负责任的报告 。 它包含一个不可利用的概念验证文件，名为 CVE-2024-36971，以及一个公开可用的 Android 内核头文件片段（sock.h），用于说明受影响的区域。 不提供任何漏洞利用代码、复现命令或逐步操作说明。 请不要 在正式设备、第三方系统或非您控制的网络上运行本仓库中的任何文件。作者对误用不承担任何责任。 目录 1. 概述 2. 仓库内容 3. 高级技术摘要 4. 关于包含的 sock.h 片段 5. 研究环境（高级，不可操作） 6...

CVE-2021-22555-Poc

堆溢出 CVE CVE-2021-22555 漏洞列表 堆越界写入（核心漏洞） 数据损坏（即时影响） 内存泄漏 / 信息泄露 权限提升（最终目标） 1. 安装编译工具（不要运行 apt upgrade） 下载 ISO wget http://old-releases.ubuntu.com/releases/20.04.2/ubuntu-20.04.2-live-server-amd64.iso 下载所需的库 sudo apt update sudo apt install build-essential gcc-multilib 下载所需的内核 sudo apt install...