1639 matches found
cvelistV5
Note 2026-2-17 Adding Additional day of processing for date normalization to addreess potential inconsistencies New Date Normalization schedule: 2/16/26 - 2/28/26 Note 2026-2-10 Record Date NormalizationdeltaLog.json file change The deltaLog.json file normally retains a rolling 30 days worth of C...
progress-burp
Progress Tracker Burp Suite extension to track vulnerability assessment progress. Features Capturing items unique requests from the Burp Suite tools Proxy, Repeater, Target. Request unique key is defined as follows: target host, port, protocol, path and method. Items have following editable...
MacPersistenceChecker
MacPersistenceChecker See EVERYTHING that runs on your Mac. Understand WHY it runs. Decide WHAT stays. TL;DR MacPersistenceChecker shows you everything that runs automatically on your Mac , explains why it matters , and helps you decide what to keep or remove. β Find malware β Detect hidden...
peer-tweet
PeerTweet Decentralized feeds using BitTorrent's DHT. Idea from Arvid and The8472 "DHT RSS feeds" http://libtorrent.org/dhtrss.html Screenshot Quick links Download the latest binaries from the releases page. Find and share PeerTweet addresses from the addresses issues page. What is PeerTweet?...
Discourse - Private User Field Disclosure via Directory Items IDOR
Discourse prior to 2025.12.2, 2026.1.1, and 2026.2.0 contains an IDOR vulnerability caused by lack of authorization checks on userfieldids parameter in DirectoryItemsControllerindex, letting any user retrieve private user field values, exploit requires no authentication. id: CVE-2026-26265 info:...
CVE-2025-60378
CVE-2025-60378: Stored HTML Injection in RISE Ultimate Project Manager & CRM β οΈ Security Advisory A critical Stored HTML Injection vulnerability affecting invoices, messaging, and automated communications -ff6600 π Overview A critical Stored HTML Injection vulnerability has been discovered in RISE...
CVE-2026-128043
OpenMage magento-lts versions before 20.19.0 and 21.0.0-beta1 before 21.0.0-beta3 are vulnerable to a cross-site request forgery (CSRF) . The vulnerability exists in the PayPal cancel and decline return handlers , which trust the checkout session without verifying that the request originated from...
joomla-menu-items-api
abraxaslabs.tech Β· github.com/abraxas Β· @abraxasnull Β· [email protected] Β· joomla-menu-items-api Write-up: https://abraxaslabs.tech/research/joomla-menu-items-api joomla-menu-items-api Class: Privilege leftover Reach: Remote Joomla CMS 6.1.3 0f2d4de - Open Source Matters The administrator UI...
CVE-Disclosures
CVE Disclosures This repository contains security advisories and vulnerability disclosures researched and reported by Sahil Arya. List of CVEs CVE-2025-70336 β PodcastGenerator 3.2.9 Stored XSS Live Items...
EUVD-2026-124547
In Progress Kendo UI for jQuery Form, the items.hint option is documented as a string but is rendered as HTML. An attacker who can influence a Form item's hint can cause attacker-controlled markup to execute as JavaScript when a user views the rendered form. Successful exploitation may compromise...
CVE-2026-124695
Progress Kendo UI for jQuery Form is vulnerable to Cross-Site Scripting (XSS) due to improper neutralization of input during web page generation (CWE-79 ). Specifically, the items[].hint option is documented as a string but is rendered as HTML . An attacker capable of influencing a Form item's hi...
Occ
Prohibited Items Segmentation via Occlusion-aware Bilayer Modeling ICME 2025 Official PyTorch Implementation of Prohibited Items Segmentation via Occlusion-aware Bilayer Modeling. Paper link: IEEE, Arxiv. Get Started Dependencies Code is successfully tested on Linux with Pytorch 2.1.2 and CUDA...
CVE-2026-124648
The TI WooCommerce Wishlist WordPress plugin before 2.13.0 does not verify that a visitor who is not logged in owns a registered user's wishlist before letting them manage it, allowing unauthenticated users who know or guess a wishlist's share key to delete items from other customers' wishlists...
EUVD-2026-124282
The TI WooCommerce Wishlist WordPress plugin before 2.13.0 does not verify that a visitor who is not logged in owns a registered user's wishlist before letting them manage it, allowing unauthenticated users who know or guess a wishlist's share key to delete items from other customers' wishlists...
PT-2026-145713
The TI WooCommerce Wishlist WordPress plugin before 2.13.0 does not verify that a visitor who is not logged in owns a registered user's wishlist before letting them manage it, allowing unauthenticated users who know or guess a wishlist's share key to delete items from other customers' wishlists...
CVE-2026-124648: Unknown TI WooCommerce Wishlist: The TI WooCommerce Wishlist WordPress plugin before 2.13.0 does not verify that a visitor who is not logged in owns aβ¦
The TI WooCommerce Wishlist WordPress plugin before 2.13.0 does not verify that a visitor who is not logged in owns a registered user's wishlist before letting them manage it, allowing unauthenticated users who know or guess a wishlist's share key to delete items from other customers' wishlists...
CVE-2023-43878-RiteCMS-Stored-XSS---MainMenu
Rite CMS v3.0 Multiple Stored XSS Author: Sergio Description: Rite CMS 3.0 is affected by a Multiple Cross-Site scripting XSS stored vulnerability that allows attackers to execute arbitrary code via a crafted payload i to the Main Menu - Items in the Administration Menu. Attack Vectors:...
DRUPAL-CONTRIB-2026-324
This module enables you to sell licenses such as roles or files using Drupal Commerce. The module doesn't sufficiently validate license order items, which under certain conditions could allow a customer to obtain a license without paying its full price. This vulnerability is mitigated by the fact...
EUVD-2026-123610
In Progress Kendo UI for jQuery versions 2026.3.1015 up to, but not including, 2026.4.1110, PropertyGrid does not encode bound property values and items.description in its default configuration. An attacker who can influence either value can cause JavaScript to execute when a user views the grid...
EUVD-2026-123278
The GetPaid WordPress plugin from 2.8.63 to 2.8.64 does not ensure item quantities on its payment forms are whole numbers, allowing unauthenticated users to have an invoice for a priced item marked as paid without being charged...