CVE-2026-86753 snipe-it before 8.7.0 Business Logic Bypass via asset_model endpoint

snipe-it versions before 8.7.0 fail to validate the requestable flag for asset models in the POST /account/request/assetmodel/modelId endpoint. Authenticated users can bypass administrative restrictions and create checkout requests for non-requestable asset models by submitting requests directly ...

CVE-2026-86740

Snipe-IT before 8.7.0 contains a flaw in UploadedFilesController::destroy() and Api\UploadedFilesController::destroy() where the return value of Storage::delete() is not checked. As a result, attachment deletion requests report success and files are hidden from listings, yet the physical files pe...

LSPromise

LSPromise A complete exploit chain that enables privilege escalation from a local untrusted app to root/kernel. It does not involve memory corruptions or race conditions, so attackers don't need to perform complex heap spraying or bypass mitigations against memory corruption vulnerabilities such ...

TLPE

This is a PoC and a writeup for CVE-2026-49881, a logic issue in the InCallController class in Android 17's Telecom service that allows an unprivileged app to gain arbitrary code execution as UID 1000 systemserver with no extra user interaction. We also show here that systemserver code execution...

tirreno

tirreno tirreno is open security analytics. tirreno tir.ˈrɛ.no helps understand, monitor, and protect your applications from cyber threats, account takeovers, bots, and abuse. While classic cybersecurity focuses on infrastructure and network perimeter, most breaches occur through compromised...

CVE-2026-16960

The Loops & Logic WordPress plugin before 4.3.0 does not restrict its public template-data action to the data a visitor is permitted to see, allowing unauthenticated users to read arbitrary user records including email addresses and roles and arbitrary site options...

EUVD-2026-74717

The Sunshine Photo Cart WordPress plugin before 3.7 does not validate that a client-supplied price identifier belongs to the item being purchased when it is added to the cart, allowing unauthenticated users to buy items at a lower price defined elsewhere on the site and complete an order at that...

CVE-2026-16960

The Loops & Logic WordPress plugin (versions before 4.3.0 ) exposes an unrestricted public template-data action , allowing unauthenticated users to read arbitrary user records—including email addresses and roles —as well as arbitrary site options. The root cause is a missing permission check on t...

EUVD-2026-74701

The Loops & Logic WordPress plugin before 4.3.0 does not restrict its public template-data action to the data a visitor is permitted to see, allowing unauthenticated users to read arbitrary user records including email addresses and roles and arbitrary site options...

CVE-2026-16960 Loops & Logic < 4.3.0 - Unauthenticated User Data and Site Option Disclosure

The Loops & Logic WordPress plugin before 4.3.0 does not restrict its public template-data action to the data a visitor is permitted to see, allowing unauthenticated users to read arbitrary user records including email addresses and roles and arbitrary site options...

copyfail-go

CopyFail Go ほとんどのLinux LPEはレースウィンドウやカーネル固有のオフセットを必要とします。Copy Failは一直線のロジック欠陥です — どちらも必要ありません。同じ732バイトのPythonスクリプト 静的Goバイナリが、2017年以降に出荷されたすべてのLinuxディストリビューションをroot化します。 CVE-2026-31431のGo実装です。静的バイナリが必要で、Python依存関係を避けたい場合に使用します。 詳細は copy.fail を参照してください。 対話型シェル root@kitploit:...

copyfail-go

CopyFail Go Most Linux LPEs need a race window or a kernel-specific offset. Copy Fail is a straight-line logic flaw — it needs neither. The same 732-byte Python script static Go binary roots every Linux distribution shipped since 2017. A Go implementation of CVE-2026-31431. In case you need a...

Exploit for CVE-2026-49881

This is a PoC and a writeup for CVE-2026-49881, a logic issue in...

CVE-2024-53677

POC from https://y4tacker.github.io/2024/12/16/year/2024/12/Apache-Struts2-%E6%96%87%E4%BB%B6%E4%B8%8A%E4%BC%A0%E9%80%BB%E8%BE%91%E7%BB%95%E8%BF%87-CVE-2024-53677-S2-067/ RCE Conditions No restriction on dangerous file extensions File name obtained from upload parameters when uploading files...

CVE-2023-32413

macOS LPE CVE-2023-32413 / ZDI-23-845 / Pwn2Own Vancouver 2023 exploit This is the exploit code that has been played at Pwn2Own Vancouver 2023 https://youtu.be/c0cS4R0ja-I?t=180. This code exploits CVE-2023-32413 to gain root rights on any vulnerable macOS. The vulnerability is a logic TOCTOU tha...

Kibana 9.4.x < 9.4.5 / 9.5.x < 9.5.1 Information Disclosure (ESA-2026-168)

The version of Kibana installed on the remote host is 9.4.x prior to 9.4.5, or 9.5.x prior to 9.5.1. It is, therefore, affected by a vulnerability as referenced in the ESA-2026-168 advisory. - Improper Neutralization of Special Elements in Data Query Logic CWE-943 in Kibana can lead to informatio...

UBUNTU-CVE-2026-82059

An internal aggregation expression in MongoDB Server was incorrectly r...

CVE-2026-82059

An internal aggregation expression in MongoDB Server was incorrectly r...

CVE-2026-49881

In serviceClassExists of InCallController.java, there is a possible arbitrary code execution due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-45525

In multiple locations, there is a possible improper data sanitization due to a logic error in the code. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...