zap-hud

ZAP 抬头显示 HUD 已不再积极开发 不幸的是，由于目前没有人专注于 HUD 的开发，它已不再积极维护。 HUD 是一个独特且创新的界面，我们知道有些人很喜欢它。 但它也需要相当多的维护工作，而目前我们缺乏足够的志愿者来继续维护。 如果你有兴趣参与，请通过 ZAP HUD 讨论组 与我们联系。 为了继续维护 HUD，我们实际上不需要有 Java 经验的人——这方面我们已经有人了。 我们需要的是具有良好 JavaScript 经验并且有自信深入处理非平凡浏览器问题的人。 HUD 是一个非常规的项目，它采取不寻常的手段来绕过浏览器的安全特性。 浏览器的更新经常导致 HUD 以奇怪的方式失...

CVE-2026-26720-Twenty-RCE

Twenty CRM - Ejecución Remota de Código Autenticada RCE Resumen Producto: Twenty CRM Vulnerabilidad: Ejecución Remota de Código RCE a través de Funciones Serverless de Workflows Severidad: Crítica Componente Afectado: Automatización de Workflows Código - Función Serverless Versión Probada: v1.15....

CVE-2026-47100-Analysis-Lab

CVE-2026-47100 — FunnelKit / Funnel Builder for WooCommerce Checkout 存储型XSS实验室 本地 Docker 实验室，用于以安全、最低危害方式重现 CVE-2026-47100。 该实验室对比了存在漏洞的 FunnelKit 版本与已修复版本，并通过无害的 JavaScript 标记/弹窗来验证行为。 1. 概述 CVE-2026-47100 是 Funnel Builder / FunnelKit for WooCommerce Checkout 在 3.15.0.3 版本之前存在的一个授权缺失漏洞。 存在漏洞的结账...

CVE-2024-9756

🚀 WooCommerce 任意文件上传漏洞利用 CVE-2024-9756 📌 概述 此漏洞利用利用了 WordPress 的 Order Attachments for WooCommerce 插件（版本 2.0 至 2.4.1 ）中的一个 未授权有限任意文件上传漏洞 。 该漏洞允许 经过身份验证的用户（订阅者及以上） 在未经适当授权的情况下上传受限文件类型。 ⚠️ 免责声明 此脚本仅用于教育和安全研究目的。 任何在非自有系统上未经授权使用此漏洞的行为均严格违法。 🔗 CVE 详情 CVE ID： CVE-2024-9756 受影响插件： Order Attachments for...

CVE-2026-77996

Joomla Extension - yootheme.com - Authenticated, privileged stored XSS in YOOtheme Pro 1.0.0-5.0.41 - Lack of escaping in the location custom field lead to a XSS vector...

The vulnerability of the conntrack mechanism for monitoring network connections in the netfilter component of the Linux operating system’s kernel allows a perpetrator to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the conntrack mechanism for monitoring network connections in the netfilter component of the Linux operating system’s kernel is related to the lack of protection for service data. Exploiting this vulnerability allows a malicious actor to compromise the confidentiality,...

The vulnerability in the driver/mfd/mfd-core.c component of the Linux operating system allows a hacker to cause a service failure.

The vulnerability of the drivers/mfd/mfd-core.c component in the Linux operating system is related to the lack of synchronization. Exploiting this vulnerability can allow an attacker to cause a service failure...

The vulnerability of the wp-login.php file within the WordPress content management system allows a hacker to execute arbitrary code.

The vulnerability of the wp-login.php file in the WordPress content management system is related to the lack of security measures taken to protect the website’s structure. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

EUVD-2026-53778

In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Avoid WARNING in sva unbind path The Intel IOMMU driver allows SVA on devices even if they do not support PCI/PRI. Commit 39c20c4e83b9 "iommu/vt-d: Only handle IOPF for SVA when PRI is supported" modified the SVA bind...

CVE-2026-13596

The Participants Database WordPress plugin before 2.7.8.4 does not properly sanitize and escape a user-supplied parameter before using it in a SQL query, allowing unauthenticated attackers to perform SQL injection attacks...

CVE-2026-28814

Arbitrary Wiki Markup rendering due to lack of authentication in Apache JSPWiki up to 2.12.3 allows attacker to obtain sensitive data stored in JSPWiki variables. Users are recommended to upgrade to version 2.12.4 or 3.0.0, which fixes this issue...

EUVD-2026-50499

ATEN Unizon RpcProvider Missing Authentication Denial-of-Service Vulnerability. This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of ATEN Unizon. Authentication is not required to exploit this vulnerability. The specific flaw exists withi...

CVE-2026-17528

CVE-2026-17528 affects the nice-select2 JavaScript plugin. Versions before 2.4.1 are vulnerable to XSS via the element, where a malicious payload is rendered into the DOM and can execute arbitrary scripts in a user’s browser when interacting with affected pages. The issue is tied to insufficient...

MINI-MMM6-X4F2-Q99V

Bulletin has no description...

GO-2026-6018 Skipper's routesrv-no-auth component: All routesrv API Endpoints Lack Authentication in github.com/zalando/skipper

Skipper's routesrv-no-auth component: All routesrv API Endpoints Lack Authentication in github.com/zalando/skipper...

DEBIAN-CVE-2026-55990

In NLnet Labs Unbound 1.7.0 up to and including 1.25.1, when the 'dnscrypt:' clause lists more 'dnscrypt-provider-cert:' files than there are matching 'dnscrypt-secret-key:' files, Unbound fills only the matched prefix and leaves the tail slots at the '0xdb' fill that libsodium's allocator writes...

ASP.NET Core: ASP.NET Core: Denial of Service via uncontrolled resource allocation

A flaw was found in ASP.NET Core. This vulnerability allows an unauthorized remote attacker to cause a Denial of Service DoS by allocating resources without proper limits or throttling. This can lead to the affected system becoming unresponsive or unavailable to legitimate users...

ASP.NET Core: ASP.NET Core: Denial of Service via uncontrolled resource allocation

A flaw was found in ASP.NET Core. This vulnerability allows an unauthorized remote attacker to cause a Denial of Service DoS by allocating resources without proper limits or throttling. This can lead to the affected system becoming unresponsive or unavailable to legitimate users...

MINI-VW5C-9VXP-W78X

Bulletin has no description...

The vulnerability of Microsoft SharePoint Server, Microsoft SharePoint Server Subscription Edition, and Microsoft SharePoint Enterprise Server lies in the lack of authentication for a critical function, allowing attackers to escalate their privileges.

The vulnerability of Microsoft SharePoint Server, Microsoft SharePoint Server Subscription Edition, and Microsoft SharePoint Enterprise Server lies in the absence of authentication for a critical function. Exploiting this vulnerability can allow an attacker to increase their privileges remotely...