CVE-2026-4604: Missing Authorization

The Klubraum Membership Request plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the krmrstoresettings function in all versions up to, and including, 1.1.0. This makes it possible for unauthenticated attackers to update the plugin's...

Exploit for Improper Authentication in Redhat Keycloak

PoC CVE-2023-0264 — front OIDC session hijacking Front está...

CVE-2026-8164

Uncontrolled Search Path Element vulnerability in ArkSigner Software and Hardware Industry and Trade Inc. ArkSigner Desktop Client allows Search Order Hijacking. This issue affects ArkSigner Desktop Client: from v2.2.16.10 through 17062026...

CVE-2026-8164 Search Order Hijacking in ArkSigner's ArkSigner Desktop Client

Uncontrolled Search Path Element vulnerability in ArkSigner Software and Hardware Industry and Trade Inc. ArkSigner Desktop Client allows Search Order Hijacking. This issue affects ArkSigner Desktop Client: from v2.2.16.10 through 17062026...

CVE-2026-8164

CVE-2026-8164: Uncontrolled Search Path Element affecting ArkSigner Desktop Client (ArkSigner Software and Hardware Industry and Trade Inc.). Affected versions: v2.2.16.10 through 17062026. Impact: high for confidentiality, integrity, and availability. Attack vector: LOCAL; prerequisites: LOW pri...

CVE-2026-8164 Search Order Hijacking in ArkSigner's ArkSigner Desktop Client

Uncontrolled Search Path Element vulnerability in ArkSigner Software and Hardware Industry and Trade Inc. ArkSigner Desktop Client allows Search Order Hijacking. This issue affects ArkSigner Desktop Client: from v2.2.16.10 through 17062026...

CVE-2026-8164

Uncontrolled Search Path Element vulnerability in ArkSigner Software and Hardware Industry and Trade Inc. ArkSigner Desktop Client allows Search Order Hijacking. This issue affects ArkSigner Desktop Client: from v2.2.16.10 through 17062026...

EUVD-2026-49853

Uncontrolled Search Path Element vulnerability in ArkSigner Software and Hardware Industry and Trade Inc. ArkSigner Desktop Client allows Search Order Hijacking. This issue affects ArkSigner Desktop Client: from v2.2.16.10 through 17062026...

vulnerabilities found in Apple MacOS

Apple has addressed several vulnerabilities in MacOS, specifically in the versions Sequoia 15.7.8, Sonoma 14.8.8, and Tahoe 26.x. These vulnerabilities involve various security issues in macOS, including insufficient sandbox restrictions, which may allow applications to gain unauthorized access t...

PT-2026-65501

Uncontrolled Search Path Element vulnerability in ArkSigner Software and Hardware Industry and Trade Inc. ArkSigner Desktop Client allows Search Order Hijacking. This issue affects ArkSigner Desktop Client: from v2.2.16.10 through 17062026...

mailpit -- WebSocket origin check bypass via percent-encoded path

Mailpit author reports: The cross-site WebSocket hijacking fix was reimplemented as an origin check gated on a raw-URI prefix test, but Go's ServeMux routes on the percent-decoded path, so requesting /%61pi/events reaches the WebSocket handler while skipping the only origin control, and the...

CVE-2026-8164: Uncontrolled Search Path Element

Uncontrolled Search Path Element vulnerability in ArkSigner Software and Hardware Industry and Trade Inc. ArkSigner Desktop Client allows Search Order Hijacking. This issue affects ArkSigner Desktop Client: from v2.2.16.10 through 17062026...

CTM360 Research Reveals How Insurance Phishing Has Evolved Into Real-Time Account Hijacking

For years, phishing campaigns targeting financial institutions followed the same playbook. Victims were tricked into entering usernames and passwords, attackers collected the credentials, and accounts were compromised later when an opportunity arose. That model is changing. Recent investigations...

GO-2026-5548 PocketBase: Account pre-hijacking via OAuth2 autolinking upgrade in github.com/pocketbase/pocketbase

PocketBase: Account pre-hijacking via OAuth2 autolinking upgrade in github.com/pocketbase/pocketbase...

GO-2026-5426 Opentelemetry-go: BSD kenv command not using absolute path enables PATH hijacking in go.opentelemetry.io/otel/sdk

Opentelemetry-go: BSD kenv command not using absolute path enables PATH hijacking in go.opentelemetry.io/otel/sdk...

NPM: Better Auth: Account takeover via pre-account hijacking on magic-link and email-OTP sign-in

NPM: Better Auth: Account takeover via pre-account hijacking on magic-link and email-OTP sign-in vulnerability discovered by ? in WordPress Npm better-auth versions = 1.1.3, 1.6.22...

CVE-2026-16519

A DLL hijacking vulnerability exists in the GeoVision GV-IP Device Utility desktop application. The application loads one or more dynamic-link libraries DLLs from an unsafe search path, allowing a local attacker to place a malicious DLL in a location searched before the legitimate library locatio...

CVE-2026-16519

Vulnerability overview. CVE-2026-16519 affects the GeoVision GV-IP Device Utility desktop application, where it loads DLLs from an unsafe search path. This DLL search order hijacking allows a local attacker to place a malicious DLL in a location that’s searched before the legitimate library, enab...

CVE-2026-16519

A DLL hijacking vulnerability exists in the GeoVision GV-IP Device Utility desktop application. The application loads one or more dynamic-link libraries DLLs from an unsafe search path, allowing a local attacker to place a malicious DLL in a location searched before the legitimate library locatio...

CVE-2026-16519: Uncontrolled Search Path Element

A DLL hijacking vulnerability exists in the GeoVision GV-IP Device Utility desktop application. The application loads one or more dynamic-link libraries DLLs from an unsafe search path, allowing a local attacker to place a malicious DLL in a location searched before the legitimate library locatio...