103029 matches found
CVE-2026-8380
CVE-2026-8380 CVE-2026-8380 — Frontend File Manager = 23.6 Arbitrary Post Deletion Overview A critical authorization flaw was identified in the WordPress plugin Frontend File Manager nmedia-user-file-uploader affecting versions = 23.6. The vulnerability allows authenticated users with low...
cve-2025-29927
CVE-2025-29927 Vulnerabilidad CVE-2025-29927 Todas las versiones de Next.js desde la 11.1.4 hasta la 13.5.6, 14.x anteriores a 14.2.25, y 15.x anteriores a 15.2.3 se ven afectadas por esta vulnerabilidad. El impacto es particularmente significativo para aplicaciones que dependen de middleware par...
Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: openldap (UTSA-2026-090503)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-090503 advisory. libldap in certain third-party OpenLDAP packages has a certificate-validation flaw when the third-party package is asserting RFC6125 support. It considers CN even wh...
CVE-2026-79917
MaxKB is an open-source AI assistant for enterprise. In 2.7.0 through 2.10.4-lts, POST /chat/api/applicationid/chat/chatid/sharechat verifies that a conversation exists but does not verify that it belongs to the authenticated chatuserid or to the application bound to the caller's token. An attack...
CVE-2026-59815 Joplin: Pending share recipients can write items into shared folders before accepting invitations
Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.7, Joplin Server's ItemModel.checkIfAllowed authorizes writes to items with a share ID when any shareusers row exists for the caller, without requiring ShareUserStatus.Accepted. ...
CVE-2026-59815
Joplin Server (an open-source note-taking and to-do application) had an authorization flaw in ItemModel.checkIfAllowed() prior to version 3.7.7 . The method granted write access to items with a share ID whenever any share_users row existed for the caller, without requiring ShareUserStatus.Accepte...
ZeroLogon-PoC-DC-Pwn
Zerologon CVE-2020-1472 Overview This project is an implementation of the Zerologon vulnerability CVE-2020-1472 , one of the most critical Active Directory security vulnerabilities. This vulnerability allows an unauthenticated attacker to compromise the entire Active Directory domain by resetting...
CVE-2026-34213
CVE-2026-34213 A low-privileged Docmost user could supply a victim attachmentId to the generic upload endpoint and overwrite another page's stored attachment inside the same workspace. Intro I identified, responsibly disclosed, and reproduced a High-severity authorization flaw in Docmost , the...
CVE-2026-61745
InvenTree , an open-source inventory management system, contains a missing authorization flaw in the POST /api/machine/{pk}/restart/ endpoint (src/backend/InvenTree/machine/api.py). The endpoint uses IsAuthenticatedOrReadScope without requiring the ADMIN role that other machine management operati...
CVE-2025-6018-6019-PoC
CVE-2025-6018 & CVE-2025-6019: Local Privilege Escalation PoC A robust Proof of Concept PoC for chaining CVE-2025-6018 PAM/Polkit Active Session Bypass and CVE-2025-6019 libblockdev SUID Mount Flaw to achieve root access on vulnerable Linux systems. Disclaimer This tool is for educational purpose...
CVE-2026-46300
🛡️ CVE-2026-46300 - Fragnesia Un ataque limpio y mortal a la caché de páginas Variante de la familia "Dirty Frag" 📌 Descripción general CVE-2026-46300 Fragnesia es un fallo lógico de alta gravedad en el manejo de búferes de socket del núcleo Linux skbtrycoalesce dentro del subsistema...
pwnage24mtk
pwnage24mtk Exploit de certificados para dispositivos MTK. Hay una falla lógica en el proceso de verificación de certificados de MTK. Similar a CVE-2023-20696. Puede estar parcheado en junio. Aviso legal Este proyecto se utiliza únicamente para investigación. Asegúrate de obtener autorización ant...
cve-2015-1592
These files were discussed in my Houston Perl Mongers talk about "Weaponizing Perl Serialization Flaws With MetaSploit". The video of the talk that explains these files is available here: https://youtu.be/Gzx6KlqiIZE The storable-.pl files are used to generate the 'config' parameter values used i...
CVE-2023-27524
CVE-2023-27524 Apache Superset Auth Bypass CVE-2023-27524 Reference https://nvd.nist.gov/vuln/detail/CVE-2023-27524 https://github.com/horizon3ai/CVE-2023-27524 https://www.horizon3.ai/cve-2023-27524-insecure-default-configuration-in-apache-superset-leads-to-remote-code-execution/...
poc-CVE-2026-0073
CVE-2026-0073 PoC Wireless ADB TLS Auth Bypass This directory contains a Python proof of concept for CVE-2026-0073. The script is generated using AI-assisted code generation techniques. Summary CVE-2026-0073 is a logic issue in ADB daemon certificate verification adbdtlsverifycert in auth.cpp. Th...
CVE-2026-47321
The CompressionFilter class uses ZLib to deflate and inflate data sent and received. When we inflate incoming data, the filter does not control the resulting size, and create a buffer no matter what. Some compressed data may have a compression ration greater than 1 thousand, leading to an...
EUVD-2026-83841
A flaw was found in the Admin REST API of Keycloak, an open-source identity and access management solution. The issue occurs because the API uses a per-request in-memory cache to resolve clients by their unique identifier without verifying if the client belongs to the realm specified in the reque...
React Server Components - Remote Code Execution
React Server Components 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack contain a remote code execution caused by unsafe deserialization of payloads from HTTP requests to Server Function endpoints, letting...
Copy-Fail-CVE-2026-31431-Lab
Copy Fail CVE-2026-31431 — Laboratorio de Reproducción y Detección de Exploit Este repositorio documenta la reproducción de extremo a extremo, la ingeniería de detección y la respuesta a incidentes para CVE-2026-31431 "Copy Fail" , una vulnerabilidad crítica de escalada de privilegios locales del...