PT-2026-61221

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description USB Test and Measurement Class USBTMC devices may use an optional interrupt endpoint for notification messages. These messages usually include two-byte headers that define the payload...

PT-2026-61044

A vulnerability was found in newpanjing simpleui 2026.01.13. This affects the function self.get action of the file simpleui/admin.py of the component AjaxAdmin AJAX Endpoint. Performing a manipulation results in missing authentication. Remote exploitation of the attack is possible. The exploit ha...

PT-2026-61245

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description Memory corruption occurs in the USB serial omninet driver when a malicious device reports a smaller endpoint max packet size than expected. This can lead to user-controlled slab...

PT-2026-61215

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A memory corruption issue exists in the mct u232 USB serial driver. The driver overrides the maximum transfer size for a specific device that accepts 16 byte packets for its 32 byte...

CVE-2026-12228

A stored cross-site scripting XSS vulnerability exists in the POST /api/prompts/share endpoint of parisneo/lollms latest version. The endpoint stores attacker-controlled promptcontent into DBDirectMessage.content without server-side sanitization. When a victim opens the direct message DM thread,...

Exploit for CVE-2026-60137

wp2shell-detect Blackbox, non-intrusive detector for wp...

EUVD-2026-45401

A stored cross-site scripting XSS vulnerability exists in the POST /api/prompts/share endpoint of parisneo/lollms latest version. The endpoint stores attacker-controlled promptcontent into DBDirectMessage.content without server-side sanitization. When a victim opens the direct message DM thread,...

CVE-2026-12228

The CVE describes a stored XSS in parisneo/lollms via POST /api/prompts/share where attacker-controlled prompt_content is saved to DBDirectMessage.content and later rendered with v-html in the DM UI. The frontend regex-based sanitizer fails to fully sanitize HTML, enabling malicious payloads to r...

Exploit for CVE-2026-63030

wp2shell-scan A scanner and proof-of-concept toolkit for CVE-202...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization in the ToolsInvokeHandler.ServeHTTP process. An attacker can gain unauthorized access to the Invoke Endpoint by sending crafted requests remotely. Remediation There is no fixed version for...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization in the ToolsInvokeHandler.ServeHTTP process. An attacker can gain unauthorized access to the Invoke Endpoint by sending crafted requests remotely. Remediation There is no fixed version for...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization in the ToolsInvokeHandler.ServeHTTP process. An attacker can gain unauthorized access to the Invoke Endpoint by sending crafted requests remotely. Remediation There is no fixed version for...

wp2shell

wp2shell WordPress REST batch route-confusion blind SQL injec...

Exploit for CVE-2026-63030

wp2r00t - WordPress REST Batch Route-Confusion SQLi PoC A sel...

CVE-2026-16123 nextlevelbuilder GoClaw Invoke Endpoint tools_invoke.go ToolsInvokeHandler.ServeHTTP authorization

A weakness has been identified in nextlevelbuilder GoClaw up to 3.13.2. Affected by this issue is the function ToolsInvokeHandler.ServeHTTP of the file internal/http/toolsinvoke.go of the component Invoke Endpoint. This manipulation causes missing authorization. The attack can be initiated...

EUVD-2026-45384

A weakness has been identified in nextlevelbuilder GoClaw up to 3.13.2. Affected by this issue is the function ToolsInvokeHandler.ServeHTTP of the file internal/http/toolsinvoke.go of the component Invoke Endpoint. This manipulation causes missing authorization. The attack can be initiated...

CVE-2026-16123

The vulnerability CVE-2026-16123 affects nextlevelbuilder GoClaw up to version 3.13.2. It resides in ToolsInvokeHandler.ServeHTTP (internal/http/tools_invoke.go, Invoke Endpoint) and is caused by a manipulation that leads to missing authorization. This allows remote exploitation, with a public ex...

CVE-2026-16123 nextlevelbuilder GoClaw Invoke Endpoint tools_invoke.go ToolsInvokeHandler.ServeHTTP authorization

A weakness has been identified in nextlevelbuilder GoClaw up to 3.13.2. Affected by this issue is the function ToolsInvokeHandler.ServeHTTP of the file internal/http/toolsinvoke.go of the component Invoke Endpoint. This manipulation causes missing authorization. The attack can be initiated...

CVE-2026-11826

OpenPLCv3 contains a heap-based buffer overflow in the getData function in webserver/core/modbusmaster.cpp. getData reads characters between two delimiters into a caller-supplied buffer with no size parameter and no bounds check. In parseConfig the function is invoked with the 100-byte...

CVE-2025-71391

SurrealDB versions before 2.2.2 contain an uncaught exception vulnerability in the net module that allows authenticated users to crash the database. Attackers can send crafted HTTP queries containing null bytes to the /sql endpoint, causing an unhandled exception that crashes the SurrealDB instan...