EUVD-2026-78168

Activiti through 7.1.0.M6 fails to validate hash-brace deferred expressions in process variables, allowing attackers to bypass expression filtering. Attackers can inject expressions beginning with that are stored and later evaluated in the full Spring context when a mail task uses variable-backed...

CVE-2017-7921-Writeup-2026

CVE-2017-7921 — 海康威视 IP 摄像头 / DVR / NVR 身份验证不当 — 通过构造的查询参数实现权限提升 | ---|--- CVE ID| CVE-2017-7921 漏洞类型| CWE-287：身份验证不当 CVSS v3.0 基础分数| 10.0（严重） — AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H CVSS v2.0 分数| 7.5（高危） — AV:N/AC:L/Au:N/C:P/I:P/A:P 披露日期| 2017年（ICS-CERT 公告 ICSA-17-124-01） 厂商| 海康威视数字技术股份有限公司 状态| 已修...

CVE-2026-56011-Lab

CVE-2026-56011 - MapPress Maps for WordPress 未认证 XSS iframe 地图渲染漏洞 执行摘要 此仓库包含一个本地 Docker 实验室，用于复现和验证 CVE-2026-56011，这是一个影响 MapPress Maps for WordPress 的未认证跨站脚本（XSS）漏洞。 MapPress Maps for WordPress 是一个用于在 WordPress 页面和文章中渲染地图的插件。漏洞行为影响可通过 mappress=embed 请求参数访问的 iframe 地图渲染路径。 此实验室比较两个 MapPress 版本：...

CVE-2025-26686-The-TCP-IP-Flaw-That-Opens-the-Gates

CVE-2025-26686：打开大门的 TCP/IP 缺陷 Windows TCP/IP 堆栈中的一个严重 RCE 漏洞（CVE-2025-26686）使敏感内存处于未锁定状态，允许远程攻击者劫持系统。该漏洞可通过网络利用，存在系统被完全入侵的风险。请立即修补。 作者： Mark Mallia 类型： 远程代码执行 RCE 严重性： 严重 攻击向量： 基于网络 受影响系统： Windows 10、11 及 Server 版本 执行摘要 微软 TCP/IP 堆栈中发现了一个编号为 CVE‑2025‑26686...

CVE-2026-9290

CVE-2026-9290 — WP User Manager LFI 到 RCE 漏洞利用 通过 'tab' 参数实现未授权路径遍历 → 本地文件包含 概述 CVE-2026-9290 是 WordPress 插件 WP User Manager – User Profile Builder & Membership（≤ 2.9.17）中存在的一个高严重性（CVSS 7.5）未授权本地文件包含（LFI）漏洞。 wpumgetactiveprofiletab 函数将 tab 查询参数直接传递给 Gamajo 模板加载器，未进行任何白名单校验。tab 值中的路径遍历序列使未授权攻击者能够通...

CVE-2026-74251

Phoca Cart 中通过属性过滤器的未认证 SQL 注入 Phoca Cart ≤ 6.1.6——未认证攻击者通过时间盲注提取完整数据库 摘要 Phoca Cart 公共商店物品页面上的 a（属性）和 s（规格）GET 数组参数未经参数化或转义，被原样拼接进 SQL WHERE 子句。未认证攻击者可通过这些参数注入任意 SQL，从而利用时间盲注技术提取完整数据库。 该漏洞存在于 admin/libraries/phocacart/search/search.php 中的 getSqlPartsArray 函数。该函数在构建 IN 列表之前调用 explode',',...

PT-2026-93189

Netcore NR255-V version 1.5.130703 contains a sensitive information disclosure vulnerability in the audit endpoints handled by l7 web auth log dump cgi.c, audit get cgi.c, and mod dispatch auth/plan.json. Attackers can query these audit components to obtain other users' session and browsing histo...

CVE-2026-88619

1024-lab SmartAdmin v3.30.0 contains a missing authorization vulnerability in the scheduled-job management module. The AdminSmartJobController exposes scheduled-job management endpoints without method-level permission checks, allowing a low-privileged authenticated user to access functionality...

EUVD-2026-78813

1024-lab SmartAdmin v3.30.0 contains a missing authorization vulnerability in the scheduled-job management module. The AdminSmartJobController exposes scheduled-job management endpoints without method-level permission checks, allowing a low-privileged authenticated user to access functionality...

PT-2026-91907

Affected versions of MISP expose several state-changing controller actions without restricting them to POST. The affected actions are: - EventReportsController::purgeUnusedPictures - NoticelistsController::enableNoticelist - ServersController::removeOrphanedCorrelations -...

PT-2026-92323

In gf algo get cached dump data of gf algo.c, there is a possible out-of-bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

PT-2026-91934

Semaphore UI through 2.19.12 exempts GET and HEAD requests from project resource permission checks in GetMustCanMiddleware. Attackers with guest or task runner roles can read all project environments including plaintext secrets, credentials, and passwords via GET requests to the environment...

PT-2026-93173

@zereight/mcp-gitlab exposes its Streamable HTTP MCP endpoint without an effective Host or Origin allowlist. A malicious web page can use DNS rebinding to route browser requests to a victim's local MCP listener while preserving an attacker-controlled Host and Origin. The server accepts those...

perl:5.32 security update

perl 4:5.32.1-475 - Fixes: CVE-2026-13221 - Don't create a trie that would overflow - Resolves: RHEL-247945 4:5.32.1-474 - Resolves: RHEL-153834 - Fix CVE-2025-40909 - Clone dirhandles without fchdir 4:5.32.1-473 - Fix CVE-2023-47038 - Added perl-autouse and perl-ExtUtils-MM-Utils to perl...

Linux Distros Unpatched Vulnerability : CVE-2026-17495

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - moment is a JavaScript date library for parsing, validating, manipulating, and formatting dates. In versions 2.29.2 through 2.30.1, a specially crafted non-stri...

PT-2026-92391

Concrete CMS below 9.5.3 was vulnerable to Cross-Site Request Forgery in the dashboard SEO Excluded Words page. The reset controller action cleared the administrator-configured reserved-word list concrete.seo.exclude words but did not validate the anti-CSRF token that the reset modal emitted, and...

SUSE SLES12: tomcat / tomcat-admin-webapps / tomcat-docs-webapp / etc (SUSE-SU-2026:4126-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4126-1 advisory. - CVE-2026-65182: Apache Tomcat: Bypass longest prefix security constraint bsc1276893. - CVE-2026-65183: Apache Tomcat: TOCTOU when...

CVE-2026-88619

1024-lab SmartAdmin v3.30.0 contains a missing authorization vulnerability in the scheduled-job management module. The AdminSmartJobController exposes scheduled-job management endpoints without method-level permission checks, allowing a low-privileged authenticated user to access functionality...

PT-2026-92407

Summary Ember's chunk decoder parses the size token leniently: it strips leading and trailing whitespace and accepts a leading + or - sign. RFC9112 §7.1 defines chunk-size = 1HEXDIG. An intermediary that parses the chunk boundary differently or rejects it will disagree with Ember on request...

PT-2026-93177

Cotonti 1.0.0 Comments plugin passes the ci GET parameter to unserialize without allowed classes restriction, allowing unauthenticated attackers to instantiate arbitrary PHP classes with attacker-controlled properties. Attackers can exploit PHP object injection through crafted serialized payloads...