waf-bypass

WAF Bypass Tool WAF Bypass Tool is an open source tool to analyze the security of any WAF for False Positives and False Negatives using predefined and customizable payloads. Check your WAF before an attacker does. WAF Bypass Tool is developed by Nemesida WAF team with the participation of...

subfinder

Fast passive subdomain enumeration tool. Features • Install • Usage • API Setup • Library • Join Discord subfinder is a subdomain discovery tool that returns valid subdomains for websites, using passive online sources. It has a simple, modular architecture and is optimized for speed. subfinder is...

gf

gf A wrapper around grep to avoid typing common patterns. What? Why? I use grep a lot. When auditing code bases, looking at the output of meg, or just generally dealing with large amounts of data. I often end up using fairly complex patterns like this one: ▶ grep -HnrE...

CVE-2026-11349

Modern Events Calendar Lite = 7.33.0 — Unauthenticated SQL Injection via meclistloadmore attsinclude / attsexclude Summary Detail| Value ---|--- Plugin| Modern Events Calendar Lite Slug| modern-events-calendar-lite Author| Webnus Affected| = 7.33.0 the current vendor-distributed Lite release. Bug...

WordPress Core 6.9-7.0.1 - Pre-Auth Batch-Route Confusion

WordPress core versions 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1 are vulnerable to a pre-authentication route confusion issue in the REST API batch endpoint /?restroute=/batch/v1. A malformed nested batch request desynchronizes the batch router, allowing unauthenticated requests to reach...

PT-2026-122008

In the Linux kernel, the following vulnerability has been resolved: net: bridge: avoid recursive multicast port cleanup br multicast sg del exclude ports removes automatically added STAR EXCL port groups by calling br multicast del pg. For S,G entries, that deletion calls back into br multicast s...

Gitmails

Development - IMPORTANT This Gitmails version is no longer maintained. Check out the Gitmails Shell port if you want to use a version that is maintained and, hopefully, developed. If you do not want to use the shell port and prefer the Python version, feel free to fork Gitmails and direct it to...

PT-2026-109485

The Fastcache by Host.it plugin for WordPress is vulnerable to Code Injection in all versions up to, and including, 1.7.4 via the fastcache settingscache cookie exclude parameter. This is due to the plugin registering the cache cookie exclude setting via register setting without a sanitize...

PT-2026-95079

Name of the Vulnerable Software and Affected Versions Valhalla versions prior to 3.7.1 Description A POST request to the '/sources to targets' endpoint containing an exclude polygons ring formed by three collinear points can cause unbounded memory growth in the worker. This occurs because zero-ar...

CLSA-2026-1786468462 python-setuptools: Fix of CVE-2026-59890

CVE-2026-59890: normalize Unicode form NFC on both the MANIFEST.in pattern and the candidate path before matching, so an exclude directive cannot be bypassed by a decomposed NFD file name...

CVE-2026-68116

In the Linux kernel, the following vulnerability has been resolved: vxlan: mdb: Fix source list corruption on a failed replace When replacing the source list of an MDB remote entry, all existing sources are first marked for deletion and vxlanmdbremotesrcsadd is then called to add the new source...

PT-2026-69516

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the vxlan mdb component where replacing the source list of an MDB remote entry can lead to source list corruption if the process fails. During a replace operation,...

Exploit for SQL Injection in Wordpress

CVE-2026-60137 — WordPress Core SQL Injection PoC Non-destruc...

GHSA-3PWP-G2MJ-5P3V WordPress Coding Standards (WordPressCS) contains an arbitrary code execution vulnerability

Impact WordPress Coding Standards WordPressCS versions before 3.4.1 contain an arbitrary code execution vulnerability in the WordPress.WP.EnqueuedResourceParameters sniff. As a result, running PHPCS with WordPressCS over untrusted PHP code, for example, in a CI pipeline that lints pull requests, ...

CVE-2026-65063 Data::RadixTree::Shared versions before 0.02 for Perl create a world-readable mmap backing file and open it without O_EXCL or O_NOFOLLOW

Data::RadixTree::Shared versions before 0.02 for Perl create a world-readable mmap backing file and open it without OEXCL or ONOFOLLOW. The segment is created in radix.h with openpath, ORDWR|OCREAT, 0666. The mode is 0666, so under the default umask 022 the file is created mode 0644 world-readabl...

Exploit for CVE-2026-63030

CVE-2026-63030 WordPress REST Batch Route-Confusion SQL I...

EUVD-2026-44365

Insertion of sensitive information into a file in the Recovery Kit response file generation feature in Devolutions Server 2026.1.22.0, 2026.2.11.0 allows an attacker with access to the generated response file to obtain the Azure Key Vault client secret in cleartext, even when the option to exclud...

CVE-2026-15642

In Devolutions Server versions 2026.1.22.0 and 2026.2.11.0 , the Recovery Kit response file generation feature fails to properly sanitize output. This flaw allows an attacker with access to the generated response file to obtain the Azure Key Vault client secret in cleartext. This exposure occurs ...

Security update 5.1.4 for Multi-Linux Manager Client Tools and Salt Bundle

Description: This update fixes the following issues: golang-github-QubitProducts-exporterexporter: Security issues fixed: CVE-2022-21698: Fixed prometheus/clientgolang possible denial of service using InstrumentHandlerCounter bsc1248699 golang-github-prometheus-nodeexporter updated to version...

CVE-2026-9834

The WP Database Backup – Unlimited Database & Files Backup by Backup for WP plugin for WordPress is vulnerable to OS Command Injection in all versions up to and including 7.11 via the wpdbexcludetable parameter. This is due to the direct concatenation of user-supplied $POST'wpdbexcludetable' valu...