CVE-2026-107817 MariaDB: mysql_json plugin OOB reads

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the mysqljson plugin assumed that imported MySQL tables contained valid MySQL binary JSON data. A specially prepared MySQL table containing invalid JSON data cou...

CVE-2026-107817 MariaDB: mysql_json plugin OOB reads

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the mysqljson plugin assumed that imported MySQL tables contained valid MySQL binary JSON data. A specially prepared MySQL table containing invalid JSON data cou...

CVE-2026-107817

The MariaDB server is vulnerable to an out-of-bounds read within the mysql_json plugin affecting versions 10.6.1 to 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2. The root cause is that the plugin incorrectly assumes imported MySQL tables contain valid MySQL binary JSON data . A speciall...

CVE-2026-107817

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the mysqljson plugin assumed that imported MySQL tables contained valid MySQL binary JSON data. A specially prepared MySQL table containing invalid JSON data cou...

CyBroHttpServer-v1.0.3-Directory-Traversal

CyBroHttpServer-v1.0.3-Directory-Traversal Directory Traversal in CyBroHttpServer v1.0.3 allows an attacker to read sensitive informations. CVE-2018-16133 https://vulners.com/cve/CVE-2018-16133 PoC To exploit vulnerability, someone could use 'http://host/../../../../../../../../' request to get...

scripts-nse

What is it? Some NSE scripts to search information from routers. The author of this scripts are VicenDominguez. He found the 0-Day on Huawei I only modified for two others. The author of this script is not responsible for its use. Huawei HG253s v2 Vodafone-Spain is starting to rent a new Huawei...

WordPress Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin <= 5.7.2 - Insecure Direct Object Reference to Authenticated (Subscriber+) Unauthorized Booking Creation and Sensitive Information Disclosure vulnerability

Insecure Direct Object Reference to Authenticated Subscriber+ Unauthorized Booking Creation and Sensitive Information Disclosure vulnerability discovered by Supakiad S. m3ez in WordPress Plugin LatePoint versions = 5.7.2...

CVE-2026-75597

pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev101, the /web/ route in src/pyload/webui/app/blueprints/appblueprint.py renders Jinja2 templates without any authentication requirement. Every equivalent direct route /logs, /settings, /queue, /dashboard, etc...

Exploits

Exploits Real world and CTFs exploit POCs. Real World CVE| Short description| Exploit ---|---|--- CVE-2017-5343| Wordpress SQL Injection| POC CVE-2018-8880| Unauthenticated Lutron Quantum Bacnet v2 network info exfiltration| POC CVE-2018-11629| Default and unremovable credentials in Homeworks QS...

WordPress Booking Calendar plugin <= 11.4.3 - Unauthenticated Sensitive Information Exposure in 'WPBC_FLEXTIMELINE_NAV' AJAX Action vulnerability

Unauthenticated Sensitive Information Exposure in 'WPBCFLEXTIMELINENAV' AJAX Action vulnerability discovered by Jonah Burgess CryptoCat in WordPress Plugin Booking Calendar versions = 11.4.3...

CVE-2026-106555

A flaw was found in OpenSSH's SSH daemon sshd. When Generic Security Service Application Program Interface GSSAPI authentication is enabled, authentication state can improperly persist across separate authentication attempts. A local user could exploit this condition during sequential...

CVE-2026-98236

A flaw was found in the Linux kernel's MHI MBIM Modem Host Interface Mobile Broadband Interface Model driver. When receiving network data, the driver ignores the return value of memory copy operations when extracting datagrams. A compromised or malicious modem can supply crafted datagram offsets...

CVE-2026-107716

A flaw was found in Banks. The directory prompt registry fails to properly validate symbolic links file system shortcuts that point to another location. An attacker with the ability to influence files in the prompt directory can exploit this vulnerability by creating links that point outside the...

CVE-2026-107282

A flaw was found in AsyncHttpClient. When an application performs request retries or failovers to a different host, the client fails to properly reset the original host's security and proxy context. Consequently, an unintended destination host can receive sensitive information, including...

CVE-2023-31014_Lab

CVE-2023-31014 Implicit Intent Hijacking Lab An educational Android Lab created based on the public report of CVE-2023-31014 in NVIDIA GeForce NOW for Android. It does not include NVIDIA source code, actual Action strings, or real authentication credentials. Facts confirmed from the public report...

EUVD-2026-95911

pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev101, the /web/ route in src/pyload/webui/app/blueprints/appblueprint.py renders Jinja2 templates without any authentication requirement. Every equivalent direct route /logs, /settings, /queue, /dashboard, etc...

CVE-2026-75597

The pyLoad download manager is vulnerable to unauthenticated access to sensitive Jinja2 templates. Prior to version 0.5.0b3.dev101 , the /web/ route in src/pyload/webui/app/blueprints/app_blueprint.py fails to enforce authentication, bypassing the @login_required protection used on direct routes ...

CVE-2026-75597 pyLoad: Unauthenticated access to /web/<path:filename> bypasses authentication on sensitive templates and leaks internal error details via exception attribute typo

pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev101, the /web/ route in src/pyload/webui/app/blueprints/appblueprint.py renders Jinja2 templates without any authentication requirement. Every equivalent direct route /logs, /settings, /queue, /dashboard, etc...

CVE-2026-107783

Insertion of sensitive information into log file in AWS Tools for PowerShell before 5.0.306 might allow local users to recover an IAM user's cleartext AWS Management Console password from command output and log artifacts. To remediate this issue, users should upgrade to version 5.0.306 or later...

SUSE-SU-2026:4608-1 Security update for bind

This update for bind fixes the following issues: - CVE-2026-19033: Unauthenticated IXFR deltas are applied to the live zone before TSIG verification bsc1280430. - CVE-2026-19662: qpcache NOQNAME proof use-after-free crashes recursive resolver bsc1280432. - CVE-2026-19666: Use-after-free in...