PaperCut NG/MF Critical Zero-Day Exploited in the Wild

Overview On August 27, 2026, PaperCut Software published an urgent security advisory stating that it is investigating active exploitation of a vulnerability affecting PaperCut NG and PaperCut MF. PaperCut has confirmed customer incidents and is treating the issue as a security emergency. At the...

Security Bulletin: IBM Application Modernization Accelerator is affected by multiple vulnerabilities found in Java, JavaScript and IBM WebSphere Application Server Liberty

Summary There are multiple vulnerabilities in Java, JavaScript and IBM WebSphere Application Server Liberty used by IBM Application Modernization Accelerator. Vulnerability Details CVEID:CVE-2026-9320 DESCRIPTION: IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server ...

Security Bulletin: IBM Transformation Advisor is affected by multiple vulnerabilities found in Java, JavaScript and IBM WebSphere Application Server Liberty

Summary There are multiple vulnerabilities in Java, JavaScript and IBM WebSphere Application Server Liberty used by IBM Transformation Advisor. Vulnerability Details CVEID:CVE-2026-75838 DESCRIPTION: DOMPurify before 3.4.13 contains a cross-site scripting vulnerability in INPLACE sanitization whe...

Security Bulletin: IBM Maximo Application Suite - Cluster Performance Insights uses ansible_core-2.19.11, postcss-8.5.10 and dompurify-3.4.11 which are vulnerable to CVE-2026-16493, CVE-2026-45623, CVE-2026-69153 and CVE-2026-66010

Summary IBM Maximo Application Suite - Cluster Performance Insights uses ansiblecore-2.19.11, postcss-8.5.10 and dompurify-3.4.11 which are vulnerable to CVE-2026-16493, CVE-2026-45623, CVE-2026-69153 and CVE-2026-66010. This bulletin contains information regarding these vulnerabilities and their...

Critical cPanel Flaw Could Let One Hosting Customer Take Root Control of a Whole Server

cPanel has released patches for a security flaw affecting domain parking and addon domain functionality in cPanel and WebHost Manager WHM, which could allow code execution as the root user. The vulnerability, assigned the CVE identifier CVE-2026-65643 , impacts all supported versions of cPanel &...

CVE-2026-81777 WordPress Essential Addons for Elementor plugin <= 6.8.0 - Bypass vulnerability vulnerability

Authentication Bypass by Spoofing vulnerability in WPDeveloper Essential Addons for Elementor allows Identity Spoofing. This issue affects Essential Addons for Elementor: from n/a through 6.8.0...

EUVD-2026-67656

Authentication Bypass by Spoofing vulnerability in WPDeveloper Essential Addons for Elementor allows Identity Spoofing. This issue affects Essential Addons for Elementor: from n/a through 6.8.0...

CVE-2026-81777 WordPress Essential Addons for Elementor plugin <= 6.8.0 - Bypass vulnerability vulnerability

Authentication Bypass by Spoofing vulnerability in WPDeveloper Essential Addons for Elementor allows Identity Spoofing. This issue affects Essential Addons for Elementor: from n/a through 6.8.0...

CVE-2026-81777

Essential Addons for Elementor (WordPress plugin by WPDeveloper) versions up to and including 6.8.0 are affected by an Authentication Bypass by Spoofing vulnerability that enables Identity Spoofing . The issue was discovered by Gaurav popalghat and scored CVSS 5.3 (MEDIUM) , with a network attack...

Security update for python310

This update for python310 fixes the following issues: Security issues fixed: CVE-2026-7774: tarfile.datafilter path traversal bypass allows writing outside the extraction directory bsc1267821. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST...

HW-Pyton-10

CVE-2020-11022 Breve descrizione CVE-2020-11022 — una vulnerabilità di tipo Reflected XSS cross-site scripting legata a una gestione non corretta dell'input utente, che viene riflesso nella risposta HTML senza escaping. Un attaccante può iniettare codice JavaScript che verrà eseguito nel browser...

-CVE-2025-8088

-CVE-2025-8088 Script POWERSHEL per verificare se il tuo dispositivo è interessato o meno 🚨 CVE-2025-8088: Allerta Zero-Day di WinRAR! 🚨 Una vulnerabilità critica di WinRAR CVE-2025-8088 sta facendo notizia: gli aggressori possono sfruttare questa falla nelle versioni 7.13 per eseguire codice...

Exploit for CVE-2026-16723

CVE-2026-16723 Reproduction Project Overview This project...

CVE-2026-6286

The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to Stored Cross-Site Scripting via customer name fields in versions up to and including 2.2. This is due to an authentication bypass where the AddBookingCommand explicitly skips nonce verification...

CVE-2026-76581

The WPMU DEV Dashboard plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 5.0.1. This is due to inconsistent and ambiguous HMAC message construction between the unauthenticated wdpssostep1 and wdpssostep2 AJAX actions, where step 1 signs and disclose...

CVE-2025-15556-Notepad-WinGUp-Updater-RCE

Software interessato: versioni di Notepad++ precedenti alla versione 8.8.9 che utilizzano l'aggiornatore WinGUp. Tipo di vulnerabilità: bypass della verifica dell'integrità degli aggiornamenti che porta all'esecuzione di codice arbitrario. Descrizione: l'aggiornatore WinGUp non verifica...

CVE-2025-31161

🚨 CVE-2025-31161 - Bypass critico dell'autenticazione in CrushFTP CVE-2025-31161 è una vulnerabilità critica di bypass dell'autenticazione in CrushFTP, una popolare soluzione di Managed File Transfer MFT. Un attaccante remoto non autenticato può impersonare qualsiasi utente noto incluso l'account...

PatchlessCLRLoader

PatchlessCLRLoader PatchlessCLRLoader è un fork di InlineExecute-Assembly per caricare assembly .NET e indirizzare l'output a mailslot. L'ho riscritto come loader standalone con la seguente implementazione: Payload con crittografia AES Supporto payload fileless Bypass patchless di AMSI ed ETW...

LsassReflectDumping

LsassReflectDumping Questo strumento sfrutta la tecnica di Process Forking utilizzando l'API RtlCreateProcessReflection per clonare il processo lsass.exe. Una volta creato il clone, utilizza i callback MINIDUMPCALLBACKINFORMATION per generare un memory dump del processo clonato. Passaggi Ottenere...

Disable-TamperProtection

Disabilitare la protezione Tamper e altri componenti Defender / MDE È possibile abusare dei privilegi SYSTEM / TrustedInstaller per manomettere o eliminare le impostazioni di WdFilter chiave di registro ALTITUDE e scaricare il minidriver del kernel per disabilitare la protezione Tamper e altri...