CVE-2018-13257

Blackboard Learn CAS Ticket Host Header Spoofing An authentication module within Blackboard Learn is susceptible to HTTP host header spoofing during Central Authentication Service CAS service ticket validation. A CAS service ticket is intended for only a specific service , but Blackboard Learn do...

Learn-Web-Hacking

Web Hacking Study Notes 中文版 README Link to notes English Translation Status This English version is a work in progress. The translated table of contents is intended to help readers find topics, but many pages in the English site may still show the original Chinese text. The Chinese files under...

chromepass

Chromepass - Hacking Chrome Saved Passwords and Cookies View Demo · Report Bug · Request Feature Table of Contents About the Project AV Detection Getting started Prerequisites Installation Usage Email Errors, Bugs and Feature Requests Learn More License Demo About The project Chromepass is a...

CVE-2021-36747

CVE-2021-36747 Blackboard Learn through 9.1 allows XSS by an authenticated user via the Feedback to Learner form. Discovered: May 11th, 2018 The Blackboard Security Team has been notified of this issue. They acknowledged the vulnerability on May 14, 2018. Description: The Blackboard tool commonly...

CVE-2022-39196-

CVE-2022-39196 Black board CMS 权限提升 Blackboard Learn 1.10.1 版本允许远程认证用户通过输入学生凭证并直接访问特定 webapps/bbcms/execute/ URL 来读取非预期的文件。 附加信息 root@kitploit: 步骤1：使用学生凭证权限。用户名： 及密码： 进行登录。 步骤2：使用"学生"账户权限成功登录后。 步骤3：然后请求"漏洞的URL/位置"。 步骤4：无需任何权限要求，直接将会话从"学生"提升为"竞赛管理系统"权限。 漏洞类型 root@kitploit: 敏感数据泄露 产品供应商...

CLSA-2026-1787201491 TuxCare security update for scikit-learn (1 CVE)

TuxCare rebuilt scikit-learn to address 1 CVE. Fixed in 1.0.2.post2+tuxcare...

PT-2026-76638

In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the cmd learn driver of the markasjunk plugin is subject to remote code execution via crafted placeholder replacement values. This issue only affects Roundcube instances using the markasjunk plugin with its cmd learn driver...

python313-scikit-learn-1.9.0-1.1 on GA media (moderate)

python313-scikit-learn-1.9.0-1.1 on GA media Announcement ID: openSUSE-SU-2026:11498-1 Rating: moderate Cross-References: CVE-2024-5206 CVSS scores: CVE-2024-5206 SUSE : 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Affected Products: openSUSE Tumbleweed An update that solves one vulnerability...

OPENSUSE-SU-2026:11498-1 python313-scikit-learn-1.9.0-1.1 on GA media

These are all security issues fixed in the python313-scikit-learn-1.9.0-1.1 package on the GA media of openSUSE Tumbleweed...

PT-2026-76424

These are all security issues fixed in the python313-scikit-learn-1.9.0-1.1 package on the GA media of openSUSE Tumbleweed...

CVE-2026-12153

The WP Learn Manager plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.1.8. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to install and activat...

CVE-2026-12153

CVE-2026-12153 affects the WordPress WP Learn Manager plugin up to version 1.1.8. The vulnerability is an authorization bypass in the jslearnmanager_ajax AJAX action, allowing unauthenticated attackers to install and activate arbitrary plugins from the WordPress.org repository on affected sites. ...

CVE-2026-12153 WP Learn Manager <= 1.1.8 - Missing Authorization to Unauthenticated Arbitrary Plugin Installation and Activation via jslearnmanager_ajax AJAX Action

The WP Learn Manager plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.1.8. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to install and activat...

CVE-2026-12153 WP Learn Manager <= 1.1.8 - Missing Authorization to Unauthenticated Arbitrary Plugin Installation and Activation via jslearnmanager_ajax AJAX Action

The WP Learn Manager plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.1.8. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to install and activat...

PT-2026-56320

Name of the Vulnerable Software and Affected Versions WP Learn Manager versions prior to 1.1.9 Description An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. This flaw allows unauthenticated attackers to install and...

MLFlow unsafe deserialization

Deserialization of untrusted data can occur in versions of the MLflow platform running version 1.1.0 or newer, enabling a maliciously uploaded scikit-learn model to run arbitrary code on an end user’s system when interacted with...

PYSEC-2026-1636 MLFlow unsafe deserialization

Deserialization of untrusted data can occur in versions of the MLflow platform running version 1.1.0 or newer, enabling a maliciously uploaded scikit-learn model to run arbitrary code on an end user’s system when interacted with...

PYSEC-2026-1643 MLFlow unsafe deserialization

Deserialization of untrusted data can occur in versions of the MLflow platform running version 1.1.0 or newer, enabling a maliciously uploaded scikit-learn model to run arbitrary code on an end user’s system when interacted with...

MLFlow unsafe deserialization

Deserialization of untrusted data can occur in versions of the MLflow platform running version 1.1.0 or newer, enabling a maliciously uploaded scikit-learn model to run arbitrary code on an end user’s system when interacted with...

CVE-2026-13514

A weakness has been identified in Chess Play and Learn App up to 4.9.42 on Android. This issue affects some unknown processing of the file AndroidManifest.xml of the component com.chess. This manipulation causes exposure of backup file to an unauthorized control sphere. It is feasible to perform...