Unity Linux 20.1050e Security Update: kernel (UTSA-2026-073361)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-073361 advisory. In the Linux kernel, the following vulnerability has been resolved: i2c: stub: Reject I2C block transfers with invalid length The I2CSMBUSI2CBLOCKDATA case in stubxf...

PT-2026-86571

Name of the Vulnerable Software and Affected Versions SourceCodester Class and Exam Timetabling System version 1.0 Description An issue exists in the mysqli query function within the /admin/modal add product.php file. A remote attacker can perform a SQL injection by manipulating the fname variabl...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-053266)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-053266 advisory. In the Linux kernel, the following vulnerability has been resolved: i40e: add validation for ringlen param The ringlen parameter provided by the virtual function VF ...

PT-2026-86472

The HivePress Authentication plugin for WordPress is vulnerable to Authentication Bypass via the access token parameter in all versions up to, and including, 1.1.4. This is due to the authenticate user function's Facebook authenticator resolving third-party identity by forwarding the...

PT-2026-86471

Name of the Vulnerable Software and Affected Versions MemberDash versions prior to 1.8.6 Description An Insecure Direct Object Reference IDOR exists due to missing validation on a user-controlled key. This allows unauthenticated attackers to change the password of any WordPress user, including...

PT-2026-86525

wger before 2.6 affected versions = 2.5.0 contains an open redirect vulnerability in the trainer login view wger/core/views/user.py. After a trainer enters impersonation mode, the view redirects to the user-supplied 'next' GET parameter via HttpResponseRedirect without validating it with url has...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-053431)

"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-053431 advisory. In the Linux kernel, the following vulnerability has been resolved: bcache: avoid oversized read request in cache missing code path In the cache missing code path o...

CVE-2026-54596

CVE-2026-54596 - Authenticated SQL Injection via recurringinvoicefrequency Parameter Enables Full Database Exfiltration Severity: High Advisory: GHSA-f9m3-qjc9-v27j Fixed in: Commit 7211426 Author: iltosec Summary An SQL injection vulnerability in ITFlow's recurring invoice creation endpoint allo...

CVE-2021-3262

CVE-2021-3262 SQL Injection in TripSpark VEO Transportation / NovusEDU The public "Student Busing Information" lookup page shipped with TripSpark VEO Transportation takes unauthenticated POST body input and concatenates it into a SQL Server query without parameterisation or server-side validation...

cve-2024-50330-ivanti_epm_sqli_reproduction

CVE-2024-50330: Ivanti Endpoint Manager EPM SQL Injection to RCE Overview CVE-2024-50330 is a critical pre-authentication SQL injection vulnerability in Ivanti Endpoint Manager EPM that allows a remote unauthenticated attacker to achieve remote code execution on the target server. The vulnerabili...

CVE-2026-50979

CVE-2026-50979: Authenticated Remote Code Execution in oPanel Overview CVE ID: CVE-2026-50979 Product: oPanel Affected Versions: v1.19.50 and earlier Vulnerability Type: Authenticated Command Injection / Remote Code Execution RCE Vulnerable Component: /advanced/curl endpoint Severity: Critical...

CVE-2026-65761

CVE-2026-65761 - EasyStore Pro SQL Injection via filtersortby proof-of-concept This repository provides an educational proof of concept for CVE-2026-65761, an unauthenticated SQL injection vulnerability affecting versions 1.0.0 through 2.0.2 inclusive of the EasyStore Joomla extension. Only the P...

CVE-2026-60004-poc-gitea

CVE-2026-60004 Proof-of-Concept PoC Overview This repository contains a proof-of-concept tool for CVE-2026-60004, an authenticated or pre-auth remote code execution RCE vector affecting certain Gitea versions via the diffpatch hook injection technique. The primary implementation is a single Go...

viber-desktop-html-injection

Viber Desktop — HTML Injection CVE-2025-55996 CVE: CVE-2025-55996 Discoverer: Thaw Khant Cycbake Product: Viber Desktop Affected: Viber Desktop 25.6.0 and possibly earlier Summary Viber Desktop's deep-link handler viber://forward?text= can render unsanitized HTML supplied in the text parameter...

CVE-2024-6333

CVE-2024-6333 - Xerox Authenticated Remote Code Execution Authenticated Remote Code Execution vulnerability in Xerox WorkCentre printers via the Network Troubleshooting Log feature. Description The Network Troubleshooting Log functionality /properties/security/networktroubleshootinglog.php fails ...

CVE-2026-13610

CVE-2026-13610 KiviCare – Clinic & Patient Management System CWE-269 Improper Privilege Management | Unauthenticated registration with attacker-chosen staff role → patient PHI disclosure Overview Critical vulnerability in the KiviCare – Clinic & Patient Management System WordPress plugin versions...

CS-MemoryEvasion

MemoryEvasion A Cobalt Strike memory evasion loader for redteamers,Support x86/x64 stager/stagerless payload with profiletested on windows7/10,winserver 2012 How Evasion? Hook Sleep,CreateProcessA,CreateHeap,GetProcessHeap functions before the shellcode is loaded into memory. Create a new heap fo...

CVE-2026-0920-

CVE-2026-0920- LA-Studio Element Kit for Elementor 📡 The exploit drops here first. Follow @KNxploited on Telegram — your elite feed for freshly disclosed CVEs, working PoCs, and precision security research. Updated relentlessly. Built for those who stay ahead. 🧠 Overview CVE-2026-0920 is a CVSS 9...

CVE-2026-5281

CVE-2026-5281 2026/06/27：Esta vulnerabilidad ha sido divulgada públicamente. Aunque los puntos de parche difieren, el enfoque general y la ruta de activación son completamente idénticos a los de mi PoC. Chromium commit commit e00a64ead1abef9447943efede7bc26362ac3797 HEAD - 146.0.7680.71, tag:...

CVE-2025-4427-CVE-2025-4428

CVE-2025-4428 & CVE-2025-4427 CVE-2025-4428 is a post-auth remote code execution vulnerability in EPMM's DeviceFeatureUsageReportQueryRequestValidator. It arises from the unsafe handling of user-supplied input within error messages processed via Spring’s AbstractMessageSource, which allows...