CVE-2026-28622

In getQueryBuilderInternal of MediaProvider.java, there is a possible way to retrieve location metadata due to a permissions bypass. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

EUVD-2026-73969

In getQueryBuilderInternal of MediaProvider.java, there is a possible way to retrieve location metadata due to a permissions bypass. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-28622

CVE-2026-28622 affects the Media Provider component in Android's Project Mainline, specifically in getQueryBuilderInternal of MediaProvider.java. A permissions bypass allows retrieval of location metadata , resulting in local information disclosure with no additional execution privileges or user ...

CVE-2026-28622

In getQueryBuilderInternal of MediaProvider.java, there is a possible way to retrieve location metadata due to a permissions bypass. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

rinhit

RinHit RinHit - macOS 생태계 정찰 프레임워크. Apple 생태계에서 아티팩트를 수집하여 네트워크 활동, 기기 간 신원, 물리적 위치 상관관계의 타임라인을 구축합니다. 이는 오픈소스 정찰 모듈입니다. 클로즈드소스 Swift 페이로드rinhit-agent는 내부적으로 레드팀에서 사용되며 이 저장소에 포함되지 않습니다. 기능 Wi-Fi 네트워크 정찰 - com.apple.wifi.known-networks.plist레거시 파싱 또는 networksetupmacOS 15+ Data Vault 사용 Bluetooth...

cve-2026-42945-scan

cve-2026-42945-scan Статический сканер для конфигурационных файлов NGINX, который обнаруживает шаблон rewrite/set, связанный с CVE-2026-42945. Сканер обрабатывает конфиги NGINX с помощью crossplane, обходит блоки location и выводит каждый потенциально уязвимый location в следующем формате:...

openhaystack

OpenHaystack OpenHaystack is a framework for tracking personal Bluetooth devices via Apple's massive Find My network. Use it to create your own tracking tags that you can append to physical objects keyrings, backpacks, ... or integrate it into other Bluetooth-capable devices such as notebooks...

CVE-2026-18741

CVE-2026-18741 - Worksuite SaaS의 저장형 XSS 개요 CVE-2026-18741은 Worksuite SaaS 6.0.14 이전 버전에 영향을 미치는 저장형 XSS 취약점입니다. 이 문제는 자산 관리Asset Management 모듈에 위치해 있습니다. 사용자 제어 입력은 다음과 같은 필드를 통해 저장될 수 있습니다: 위치Location 설명Description 저장된 입력은 이후 영향을 받는 자산이 조회될 때 렌더링되어, 공격자가 제어하는 JavaScript가 해당 자산을 조회하는 사용자의 브라우저...

EUVD-2026-70905

The WPFunnels WordPress plugin before 3.13.0 does not restrict access to the log files it writes to a predictable location under the public uploads directory, allowing unauthenticated users to download customer order details and opt-in form submissions when logging is enabled...

CVE-2026-85207

A vulnerability was identified in itsourcecode Online Medicine Delivery System 1.0. Impacted is an unknown function of the file /index.php?q=orderdetails. Such manipulation of the argument location leads to cross site scripting. The attack may be launched remotely. The exploit is publicly availab...

CVE-2026-49456

Waku is the minimal React framework. Prior to version 1.0.0-beta.1, the unstableredirect helper exported from waku/router/server packages/waku/src/router/define-router.tsx:156–161 accepts an arbitrary string and reflects it unchanged into the HTTP Location response header with no URL validation,...

EUVD-2026-70700

A vulnerability was identified in itsourcecode Online Medicine Delivery System 1.0. Impacted is an unknown function of the file /index.php?q=orderdetails. Such manipulation of the argument location leads to cross site scripting. The attack may be launched remotely. The exploit is publicly availab...

CVE-2026-85207

A reflected cross-site scripting (XSS) vulnerability was identified in itsourcecode Online Medicine Delivery System 1.0 , specifically in an unknown function of the file /index.php?q=orderdetails . Manipulation of the location argument enables an attacker to inject arbitrary scripts. The attack i...

CVE-2026-49456

Waku (the minimal React framework) prior to version 1.0.0-beta.1 is vulnerable to an open redirect via the unstable_redirect() helper in waku/router/server. The function reflects user-supplied strings unchanged into the HTTP Location header with no URL validation, scheme restriction, or path-only...

Smart Contracts Claimed Vulnerable by the CVE Database, with Labels and Source Locations

The Common Vulnerabilities and Exposures CVE database catalogs vulnerability claims in hard- and software, among them those pertaining to blockchain programs a.k.a. smart contracts. We present CVE-Smart-Contracts, a curated dataset of CVE records up to July 2026 referring to Ethereum smart...

PT-2026-84533

Name of the Vulnerable Software and Affected Versions AVideo versions prior to 29.1 Description An unauthenticated SQL injection exists in the User Location plugin. The endpoints 'regions.json.php' and 'cities.json.php' fail to properly escape or bind the country and region GET parameters before...

ASB-A-484928416

In getQueryBuilderInternal of MediaProvider.java, there is a possible way to retrieve location metadata due to a permissions bypass. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

EUVD-2026-42990

Snipe-IT's API Location Creation Bypasses FMCS Parent-Child Company Boundary Validation...

CVE-2026-78071

DP Calendar is a Joomla extension by digital-peak.com. Versions 7.0.0 through 10.11.2 are affected by an authenticated, privileged stored XSS . The root cause is that the location title is rendered in a data attribute without proper escaping. Exploitation requires an authenticated user with the c...

CVE-2026-78071 Joomla Extension - digital-peak.com - Authenticated, privileged stored XSS in DP Calendar 7.0.0-8.19.5, 9.0.0-10.12.0

Joomla Extension - digital-peak.com - Authenticated, privileged stored XSS in DP Calendar 7.0.0-8.19.5, 9.0.0-10.12.0 - Location title is rendered in data attribute without escaping leads to XSS, needs create permission in DPCalendar...