69388 matches found
CVE-2026-23003-Cross-Chain-Bridge-Message-Forging-via-Missing-Origin-Chain-ID
CVE-2026-23003 – Cross‑Chain Bridge Message Forging via Missing Origin Chain ID Program Code Solidity + Python exploit // Bridge.sol - Vulnerable bridge contract contract Bridge mappingbytes32 = bool public processed; event Depositedaddress from, address to, uint256 amount, uint256 chainId;...
CVE-2023-0264
PoC for CVE-2023-0264 Keycloak vulnerability that allows session hijacking during authorization code flow See https://github.com/advisories/GHSA-9g98-5mj6-f9mv Prerequisites Docker curl jq python3 or another tool to serve static files on HTTP Steps to reproduce 1. Start Keycloak container with...
EUVD-2026-117171
Pocket ID: The client credentials grant allows any OIDC client to obtain tokens for arbitrary audiences...
Pocket ID: The client credentials grant allows any OIDC client to obtain tokens for arbitrary audiences
Summary The client credentials grant granttype=clientcredentials does not validate the resource parameter before embedding it as the aud claim in the issued JWT. Any authenticated OIDC client can obtain a Pocket ID-signed access token claiming authorization for any arbitrary audience, including...
GHSA-Q4XM-P75H-H9P3 Pocket ID: The client credentials grant allows any OIDC client to obtain tokens for arbitrary audiences
Summary The client credentials grant granttype=clientcredentials does not validate the resource parameter before embedding it as the aud claim in the issued JWT. Any authenticated OIDC client can obtain a Pocket ID-signed access token claiming authorization for any arbitrary audience, including...
EUVD-2026-117156
tsParticles: A single anonymous MCP session can monopolize HTTP mode and deny new clients...
CVE-2026-119759 TrailBase 0.28.2 < 0.35.10 IDOR via Record API File Column
TrailBase 0.28.2 before 0.35.10 contains an insecure direct object reference in std.FileUpload columns, where the Record API accepts attacker-supplied object-store file ids on insert and update without ownership validation. An authenticated attacker who can read a victim’s row can recover its...
CVE-2026-119759
TrailBase versions 0.28.2 through 0.35.10 are affected by an insecure direct object reference (IDOR) vulnerability. The root cause is a lack of ownership validation when manipulating object-store id metadata within std.FileUpload columns during insert and update operations. Authenticated attacker...
CVE-2026-123270 CVE-2026-123270
Redpanda Connect versions 4.39 to 4.110 contain a missing authentication vulnerability that enables unauthenticated remote code execution RCE. In streams mode, the management HTTP API is exposed on 0.0.0.0:4195, but authentication is disabled by default and there is no authentication gate...
CVE-2026-124581
A vulnerability was determined in itsourcecode Airline Reservation System 1.0. Affected is an unknown function of the file /admin/manageflight.php. This manipulation of the argument ID causes sql injection. The attack is possible to be carried out remotely. The exploit has been publicly disclosed...
CVE-2026-124581 itsourcecode Airline Reservation System manage_flight.php sql injection
A vulnerability was determined in itsourcecode Airline Reservation System 1.0. Affected is an unknown function of the file /admin/manageflight.php. This manipulation of the argument ID causes sql injection. The attack is possible to be carried out remotely. The exploit has been publicly disclosed...
Profile Builder CVE-2026-15826 autologin
Auxiliary for CVE-2026-15826: registration with a 61+ character username triggers Profile Builder autologin bound to user ID 1. Consumes autologin=true&wpnonce on the module HTTP client only — does not register a KittySploit framework session; use wp-admin separately or export cookies manually...
CVE-2026-123088
The UniPAY Payment Gateway For WooCommerce WordPress plugin before 2.4 does not perform any authorization check before returning an order's order-received URL for an attacker-supplied order id, exposing the order's secret key in the redirect and allowing unauthenticated attackers to enumerate...
CVE-2026-123088 UniPAY Payment Gateway For WooCommerce < 2.4 - Unauthenticated Order Key and Customer PII Disclosure
The UniPAY Payment Gateway For WooCommerce WordPress plugin before 2.4 does not perform any authorization check before returning an order's order-received URL for an attacker-supplied order id, exposing the order's secret key in the redirect and allowing unauthenticated attackers to enumerate...
CVE-2026-123088
The UniPAY Payment Gateway For WooCommerce WordPress plugin, versions prior to 2.4 , is vulnerable to an authorization bypass. The plugin fails to perform authorization checks when returning an order-received URL for a user-supplied order id . This flaw allows unauthenticated attackers to enumera...
CVE-2026-123088 UniPAY Payment Gateway For WooCommerce < 2.4 - Unauthenticated Order Key and Customer PII Disclosure
The UniPAY Payment Gateway For WooCommerce WordPress plugin before 2.4 does not perform any authorization check before returning an order's order-received URL for an attacker-supplied order id, exposing the order's secret key in the redirect and allowing unauthenticated attackers to enumerate...
ROOT-OS-DEBIAN-13-CVE-2026-63825 CVE-2026-63825 in linux - Patched by Root
Root has patched CVE-2026-63825 in the linux package for Root:Debian:13. Multiple fixed versions available...
ROOT-OS-DEBIAN-13-CVE-2026-46216 CVE-2026-46216 in linux - Patched by Root
Root has patched CVE-2026-46216 in the linux package for Root:Debian:13. Multiple fixed versions available...