CVE-2026-56796

Dell Command Update DCU, versions prior to 5.7.1, contain an Improper Link Resolution Before File Access 'Link Following' vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privileges...

EUVD-2026-62499

Dell Command Update DCU, versions prior to 5.7.1, contain an Improper Link Resolution Before File Access 'Link Following' vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privileges...

CVE-2026-56796

Dell Command Update versions prior to 5.7.1 contain a Link Following (CWE-59) vulnerability. A low-privileged local attacker can exploit it to achieve Elevation of Privileges. Dell's DSA-2026-309 advisory provides the fix. No in-the-wild exploitation has been reported. Upgrade to version 5.7.1. h...

CVE-2026-56796

Dell Command Update DCU, versions prior to 5.7.1, contain an Improper Link Resolution Before File Access 'Link Following' vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privileges...

CVE-2026-76216 Vikunja through 2.4.0 Principal-Type Confusion via LinkSharing

Vikunja through 2.4.0 contains a principal-type confusion vulnerability where LinkSharing principals with id N are treated as user principals with users.id == N at three permission checks lacking type guards. Attackers with a link-share JWT can remove victims from teams, enumerate and delete vict...

CVE-2026-76216

Vikunja through 2.4.0 contains a principal-type confusion vulnerability where LinkSharing principals with id N are treated as user principals with users.id == N at three permission checks lacking type guards. Attackers with a link-share JWT can remove victims from teams, enumerate and delete vict...

foursquare-map-sdk (>=2.0.0, <=3.1.0), metro-sp-mdp (>=0.1.0, <=2.1.2) +3 more potentially affected by CVE-2026-73415 via jupyterlab (3.2.9)

jupyterlab PYPI version 3.2.9 is affected by a known vulnerability. The following packages have a transitive dependency on jupyterlab and may be impacted: - foursquare-map-sdk =2.0.0, =0.1.0, =0.8.2, =0.12.0.dev0, =1.11.0, =1.13.0 Source cves: CVE-2026-73415 Source advisory: OSV:PYSEC-2026-3671...

CVE-2026-76037

A flaw was found in Google Chrome. A local attacker could exploit a link following vulnerability within the CredentialProvider component. This vulnerability allows for the execution of arbitrary code outside the browser's security sandbox through a local program. Mitigation Mitigation for this...

Stored Cross-Site Scripting (XSS)

Kestra is vulnerable to stored cross-site scripting XSS. The vulnerability is due to improper sanitization of JavaScript event-handler attributes in the custom link Markdown syntax, which allows an attacker with permission to create or update a Flow description to inject malicious JavaScript that...

CVE-2026-18937

The Broken Link Checker WordPress plugin before 2.4.12 does not limit which query variables it accepts from user input on sites using plain permalinks, allowing unauthenticated users to overwrite arbitrary PHP global variables, and to execute arbitrary code on the server when a classic non-block ...

CVE-2026-18937 Broken Link Checker < 2.4.12 - Unauthenticated RCE via Query Variable Injection

The Broken Link Checker WordPress plugin before 2.4.12 does not limit which query variables it accepts from user input on sites using plain permalinks, allowing unauthenticated users to overwrite arbitrary PHP global variables, and to execute arbitrary code on the server when a classic non-block ...

CVE-2026-18937 Broken Link Checker < 2.4.12 - Unauthenticated RCE via Query Variable Injection

The Broken Link Checker WordPress plugin before 2.4.12 does not limit which query variables it accepts from user input on sites using plain permalinks, allowing unauthenticated users to overwrite arbitrary PHP global variables, and to execute arbitrary code on the server when a classic non-block ...

CVE-2026-18937

The Broken Link Checker WordPress plugin (versions through 2.4.11 ) is vulnerable to unauthenticated Remote Code Execution (RCE) via query variable injection (CWE-94). On sites using plain permalinks , the plugin fails to limit which query variables it accepts from user input, allowing an attacke...

EUVD-2026-62285

The Broken Link Checker WordPress plugin before 2.4.12 does not limit which query variables it accepts from user input on sites using plain permalinks, allowing unauthenticated users to overwrite arbitrary PHP global variables, and to execute arbitrary code on the server when a classic non-block ...

D-Link Multi HNAP RCE

Module exploits HNAP remote code execution vulnerability in multiple D-Link devices which allows executing commands on the device. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link Multi HNAP RCE""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from...

TP-Link WDR740ND & WDR740N Path Traversal

Exploits TP-Link WDR740ND and WDR740N path traversal vulnerabilitythat allowsto read files from the filesystem. !/usr/bin/env python3 -- coding: utf-8 -- """TP-Link WDR740ND & WDR740N Path Traversal""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

D-Link DSL-2740R DNS Change

Module exploits D-Link DSL-2740R dns change vulnerability. If the target is vulnerable it is possible to change dns settings. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link DSL-2740R DNS Change""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

D-Link DWR-932 Info Disclosure

Module explois information disclosure vulnerability in D-Link DWR-932 devices. It is possible to retrieve sensitive information such as credentials. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link DWR-932 Info Disclosure""" import json import re from kittysploit import from...

D-Link DIR-825 Path Traversal

Module exploits D-Link DIR-825 path traversal vulnerability, which allows reading files from the device. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link DIR-825 Path Traversal""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleAuxiliary,...

D-Link DIR-300 & DIR-645 & DIR-815 UPNP RCE

Module exploits D-Link DIR-300, DIR-645 and DIR-815 UPNP Remote Code Execution vulnerability which allows executing command on the device. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link DIR-300 & DIR-645 & DIR-815 UPNP RCE""" import socket from kittysploit import from lib.exploit.handler...