WordPress Modern Events Calendar <6.1.5 - Blind SQL Injection

WordPress Modern Events Calendar plugin before 6.1.5 is susceptible to blind SQL injection. The plugin does not sanitize and escape the time parameter before using it in a SQL statement in the mecloadsinglepage AJAX action. An attacker can possibly obtain sensitive information, modify data, and/o...

CVE-2026-78006-POC

CVE-2026-78006-POC POC para CVE-2026-78006 The Events Calendar = 6.17.4 - Inyección de Objetos PHP No Autenticada a Ejecución Remota de Código CONTACTO telegram para cualquier consulta : @soldout0O 💙 Apoya el Proyecto Si aprecias mi trabajo, considera apoyar el proyecto vía USDT TRC20:...

memhunter

Memhunter Automated hunting of memory resident malware at scale This project is WORK IN PROGRESS. Expect feature changes and binary releases on the upcoming weeks. Overview Memhunter is an endpoint sensor tool that is specialized in detecing resident malware, improving the threat hunter analysis...

Hunt-Weird-ImageLoads

Hunt-Weird-ImageLoads Este proyecto fue creado para jugar con diferentes IOCs causados por eventos ImageLoad. Aprovecha ETW para monitorear eventos ImageLoad y recorre el callstack para identificar algunos posibles IOCs, tales como: Página RWX en el callstack Módulo stomped en el callstack Module...

whids

IMPORTANTE: este README y otra documentación no están actualizados para reflejar los cambios realizados en las últimas versiones beta ya que ocurrieron muchos cambios. Todo esto se actualizará a su debido tiempo cuando se lance una versión estable consulte Hoja de ruta hasta la próxima versión...

CVE-2026-75157

Apache Airflow's asset queued-events DELETE endpoints checked the caller's Dag-axis permission with READ instead of EDIT. Any authenticated user who could read a Dag could therefore delete that Dag's queued asset events, silently suppressing asset-triggered scheduling for it — a state-changing...

CVE-2026-75157

Apache Airflow contains an authorization flaw in its asset queued-events DELETE endpoints , which checked the caller's Dag-axis permission as READ instead of EDIT. Any authenticated user with read access to a Dag could delete that Dag's queued asset events, silently suppressing asset-triggered sc...

CVE-2026-75157 Apache Airflow: Asset queued-events DELETE endpoints gated on Dag READ instead of Dag EDIT (asset-triggered scheduling suppression)

Apache Airflow's asset queued-events DELETE endpoints checked the caller's Dag-axis permission with READ instead of EDIT. Any authenticated user who could read a Dag could therefore delete that Dag's queued asset events, silently suppressing asset-triggered scheduling for it — a state-changing...

EUVD-2026-82766

Apache Airflow's asset queued-events DELETE endpoints checked the caller's Dag-axis permission with READ instead of EDIT. Any authenticated user who could read a Dag could therefore delete that Dag's queued asset events, silently suppressing asset-triggered scheduling for it — a state-changing...

CVE-2026-75157 Apache Airflow: Asset queued-events DELETE endpoints gated on Dag READ instead of Dag EDIT (asset-triggered scheduling suppression)

Apache Airflow's asset queued-events DELETE endpoints checked the caller's Dag-axis permission with READ instead of EDIT. Any authenticated user who could read a Dag could therefore delete that Dag's queued asset events, silently suppressing asset-triggered scheduling for it — a state-changing...

santa

Santa !NOTE As of 2025, Santa is no longer maintained by Google. We encourage existing users to migrate to an actively maintained fork of Santa, such as https://github.com/northpolesec/santa. Santa is a binary and file access authorization system for macOS. It consists of a system extension that...

usbrip

usbrip inherited from "USB Ripper", not "USB R.I.P." is a simple forensics tool with command line interface that lets you keep track of USB device artifacts i.e., USB event history on Linux machines. Table of Contents: Description Quick Start Showcase System Log Structure Dependencies deb pip...

CVE-2026-16582

The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to unauthorized modification of data in all versions up to, and including, 2.4.5. This is due to the plugin accepting a client-supplied package-redemption identifier as proof of payment without validating...

Axiom-protocol

Axiom：去中心化与抗审查通信协议 🚀 线上部署详情 网络： Arbitrum One（主网 L2） 链 ID： 42161 RPC 端点： https://arb1.arbitrum.io/rpc（或任何自定义的 Alchemy/Infura 端点） Axiom 代理合约地址： 0xc11CFf8111e8b1F055eba095Efb679a38Abe6b63 （注意：Axiom 采用 UUPS 可升级代理架构。所有客户端交互必须始终 指向此代理地址，而绝不能指向底层实现合约。） 📖 如何读取数据（索引器/客户端） 客户端绝不应...

CVE-2026-78070

Inyección SQL mediante Shortcode ORDER BY en plgcontentdpcalendar DPCalendar Free ≤ 10.11.2 — Un usuario con rol Autor extrae la base de datos completa mediante inyección ciega basada en tiempo RESUMEN El plugin de contenido plgcontentdpcalendar analiza los shortcodes events order="..."/events...

CVE-2026-93295

MISP contains a vulnerability in its background job dispatch mechanism that allows remote code execution as the web user. Background job arguments are passed directly as the argv of the CakePHP console process. CakePHP's ShellDispatcher::parsePaths scans the entire argv for path switches -app,...

EUVD-2026-82314

MISP contains a vulnerability in its background job dispatch mechanism that allows remote code execution as the web user. Background job arguments are passed directly as the argv of the CakePHP console process. CakePHP's ShellDispatcher::parsePaths scans the entire argv for path switches -app,...

CVE-2026-93295

CVE-2026-93295 affects MISP (Malware Information Sharing Platform) in its background job dispatch mechanism. The root cause is that CakePHP's ShellDispatcher::_parsePaths() scans the entire argv of the console process for path switches (-app, --working, --root, etc.) and treats the following elem...

CVE-2026-93295 MISP Background Job Argument Injection via Console Path Switches Enables Remote Code Execution

MISP contains a vulnerability in its background job dispatch mechanism that allows remote code execution as the web user. Background job arguments are passed directly as the argv of the CakePHP console process. CakePHP's ShellDispatcher::parsePaths scans the entire argv for path switches -app,...

CVE-2026-47890

A flaw was found in Spring Framework, affecting its MVC and WebFlux applications. When these applications use Server-Sent Events SSE with view fragments, a vulnerability allows for stream corruption. This can lead to unreliable data delivery and potential disruption of services. Mitigation Disabl...