CVE-2026-106109 Quasar Framework: App Vite build cleanup can recursively remove unsafe configured output directories

Quasar Framework is a framework for building high-performance Vue.js user interfaces. From 1.0.0 until 3.3.0, @quasar/app-vite recursively removed the resolved build.distDir before building without rejecting the project root, user home directory, filesystem roots, or symlink-resolved external...

dovecot: Dovecot: MySQL multi-byte escaping wrong

A flaw was found in Dovecot. A remote attacker with high attack complexity could exploit this vulnerability to gain access to sensitive information and modify data without requiring any user interaction or privileges...

CVE-2026-105865

Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, an authenticated user who can update or delete uploads stored locally can cause file cleanup to remove unintended files outside the configured upload...

CVE-2014-160

CVE-2014-160 exploit Utilizzo: ./cve-2014-160 dvwa.local https && strings datadump.bin...

siphondns

SiphonDNS Una PoC per le tecniche descritte in questa ricerca. Implementa l'esfiltrazione di dati tramite sezioni non standard del DNS. Server: $ ./siphondns-server -method ecs Starting DNS server cmd id Command received Receiving...

CVE-2022-22965

Spring4ShellCVE-2022-22965 Spring Framework RCE tramite Data Binding su JDK 9+ / spring4shell / CVE-2022-22965 Spring4ShellCVE-2022-22965 Demo dell'exploit https://user-images.githubusercontent.com/57348147/161458377-44ab2f76-f947-4599-aa0a-92cbaac819f8.mp4 Compilazione docker pull...

Vulnerability handling in Atlassian Data Center products

The vulnerability exists in several products within the Atlassian Data Center platform, including Jira Software, Jira Service Management, Confluence, Bitbucket, Bamboo, Crowd, Crucible, and Fisheye. The vulnerability is an Arbitrary File Access issue, allowing unauthorized attackers to access...

CVE-2026-105865 Payload: Incomplete validation during the upload file lifecycle

Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, an authenticated user who can update or delete uploads stored locally can cause file cleanup to remove unintended files outside the configured upload...

CVE-2026-105865

The Payload headless content management system is vulnerable to a path traversal issue in versions before 3.90.0 and canary versions before 4.0.0-canary.34 . An authenticated user with permissions to update or delete locally stored uploads can trigger a file cleanup process that removes unintende...

CVE-2026-105865 Payload: Incomplete validation during the upload file lifecycle

Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, an authenticated user who can update or delete uploads stored locally can cause file cleanup to remove unintended files outside the configured upload...

CVE-2026-105865 Payload: Incomplete validation during the upload file lifecycle

Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, an authenticated user who can update or delete uploads stored locally can cause file cleanup to remove unintended files outside the configured upload...

cve-2025-1323

cve-2025-1323 WP-Recall Plugin SQL Injection ⚠️ Legal Disclaimer This tool is intended for authorized security testing and educational use only. Do not use against systems without explicit permission. Misuse may be illegal. ✅ Requirements Python 3.x requests module Install dependencies: pip instal...

FBI Removes Accenture Contractor Over ShinyHunters Job Site Data Breach

The FBI removed a contractor over a ShinyHunters-linked breach. Reuters sources identified Accenture and an unpatched Oracle PeopleSoft system...

CVE-2026-105861 Payload external upload trust validation issue

Payload is a free and open source headless content management system. In versions after 3.0.0 and before 3.90.0, authenticated external URL-based upload retrieval can forward authentication data to a redirected destination that was not verified as trusted, potentially exposing a valid session to ...

WordPress MainWP Child plugin <= 6.2.1 - Deserialization of untrusted data vulnerability

Deserialization of untrusted data vulnerability discovered by Rafie Muhammad in WordPress Plugin MainWP Child versions = 6.2.1...

aisecplus-week01-danielossai

🔐 AISec Plus — Week 1: Map the Threat Researcher: Daniel Ossai Repo: aisecplus-week01-danielossai Submitted: Week 1 · AISec Plus Bootcamp 📌 Incident Name & Date EchoLeak CVE-2025-32711 Discovered: January 2025 · Disclosed: June 2025 · Patched: June 2025 📝 What Happened Researchers at Aim Security...

cacti-rce-cve-2022-46169-vulnerable-application

Applicazione vulnerabile di Cacti v1.2.22 con comandi injection CVE-2022-46169 Questa è un'applicazione vulnerabile per testare l'exploit per la vulnerabilità Cacti CVE-2022-46169. ATTENZIONE! Questa applicazione contiene gravi vulnerabilità di sicurezza. Eseguila a tuo rischio! Si consiglia di...

SnipRecover-CLI

SnipRecover CLI Detection and restoration of Windows Snipping Tool PNG captures vulnerable to CVE-2023-28303 SnipRecover CLI is a minimal, dependency-free command-line utility designed to: Detect PNG files modified by the Windows Snipping Tool vulnerability CVE‑2023‑28303. Restore the original...

grafana: Grafana Auth Proxy: Unauthorized access due to incorrect IPv6 allow-list default

A flaw in Grafana's Auth Proxy IPv6 allow-list incorrectly defaults to a broad /32 subnet mask instead of a strict /128. This misconfiguration allows remote attackers to bypass access restrictions, potentially leading to unauthorized access and data manipulation...

grafana: Grafana Auth Proxy: Unauthorized access due to incorrect IPv6 allow-list default

A flaw in Grafana's Auth Proxy IPv6 allow-list incorrectly defaults to a broad /32 subnet mask instead of a strict /128. This misconfiguration allows remote attackers to bypass access restrictions, potentially leading to unauthorized access and data manipulation...