CVE-2026-37070

CVE-2026-37070 Incorrect access control in /vfm-admin/ajax/streamvid.php in Veno File Manager Project in 4.4.9 allows an authenticated attacker to read any uploaded files by other users as long as it knows the path and filename via a specially crafted GET request to the affected endpoint...

GO-2026-6497 vulnerabilities

Vulnerabilities for packages: k8sgpt, helm-set-status, tigera-operator, kube-arangodb, opentofu, helm-push, gitness, cert-manager-cmctl, kyverno-notation-aws, manifest-tool, k9s, rancher-helm, kargo, xeol, helm-mapkubeapis, flux-helm-controller, cluster-api-helm-controller, maru...

GO-2026-6499 vulnerabilities

Vulnerabilities for packages: k8sgpt, helm-set-status, tigera-operator, kube-arangodb, opentofu, helm-push, gitness, cert-manager-cmctl, kyverno-notation-aws, manifest-tool, k9s, rancher-helm, kargo, xeol, helm-mapkubeapis, flux-helm-controller, cluster-api-helm-controller, maru...

freepbx-endpoint-sqli-rce

CVE-2025-57819 — FreePBX Endpoint Module SQL Injection → Remote Code Execution Summary FreePBX is the open-source web GUI for Asterisk PBX, widely deployed in enterprise telephony environments. The Endpoint Manager module exposes an AJAX handler at /admin/ajax.php that accepts a brand parameter a...

CVE-2026-37072

CVE-2026-37072 Veno File Manager Project Veno File Manager Project 4.4.9 is vulnerable to Incorrect Access Control in admin-head-updates.php An unauthenticated attacker can exploit a Local File Inclusion vulnerability in the 'lang' GET parameter. By sending a specially crafted POST request with t...

CVE-2026-37068

CVE-2026-37068 Arbitrary file write in /vfm-admin/index.php?section=translations&action=update in Veno File Manager Project 4.4.9 allows an authenticated user with the role of super administrator to overwrite any php file in the application via a specially crafted POST request to the affected...

screenscrub

screenscrub Find credentials in screenshots, extract them to a secret manager, and irreversibly redact them from the images — so secrets don't rot in your notes, screenshots, and /Desktop. Local. Offline. Silent. No network, no telemetry by default. screenscrub bridges two existing tool categorie...

CVE-2026-37073

CVE-2026-37073 Incorrect access control in /vfm-admin/ajax/sendfiles.php in Veno File Manager Project 4.4.9 allows an unauthenticated attacker to send emails from the configured SMPT server on the application via making a POST request to the endpoint with needed parameters and header...

WordPress Smart Manager – WooCommerce Bulk Edit: Products, Orders, Users & More (Spreadsheet) plugin <= 8.97.0 - Authenticated (Subscriber+) SQL Injection to Privilege Escalation vulnerability

Authenticated Subscriber+ SQL Injection to Privilege Escalation vulnerability discovered by lhking in WordPress Plugin Smart Manager versions = 8.97.0...

Blackash-CVE-2025-61757

🚨 CVE-2025-61757 — Pre-Auth RCE Alert 🚨 🧩 Summary ID: CVE-2025-61757 Product: Oracle Identity Manager Oracle Fusion Middleware Component: REST WebServices Affected Versions: 12.2.1.4.0 & 14.1.2.1.0 Severity: 🔴 Critical — 9.8 CVSS 3.1 Published: Oct 21, 2025 Type: Missing Authentication for Critic...

CVE-2026-104843

uv is a Python package and project manager written in Rust. From 0.12.7 until 0.12.18, uv wheel extraction on Windows can process a malicious wheel in a way that writes a file outside the installation prefix, including an executable in a directory already present on the user's PATH. Non-Windows...

WordPress WDS MCP Content Manager plugin <= 3.10.4 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin WDS MCP Content Manager versions = 3.10.4...

abdal-lockbox

🔐 Abdal LockBox 🌐 Read in your language: 🇬🇧 English | 🇨🇳 中文 | 🇷🇺 Русский | 🇪🇸 Español | 🇯🇵 日本語 | 🇮🇷 فارسی | 🇸🇦 العربية | 🇹🇷 Türkçe | 🇩🇪 Deutsch | 🇮🇳 हिन्दी Secure. Store. Autofill. — A privacy-first Android password manager by Abdal Security Group. Abdal LockBox keeps your credentials encrypted on...

2025-Oracle-SSO-LDAP-Attack-Post-Incident-Written-Report

2025-Oracle-SSO-LDAP-Attack-Post-Incident-Written-Report Этот пост-инцидентный отчёт рассматривает атаку на цепочку поставок 2025 года, направленную на инфраструктуру идентификации и аутентификации Oracle Cloud. В нём подробно описано, как злоумышленники использовали неисправленную уязвимость...

CVE-2026-22777

CVE-2026-22777 — CRLF-инъекция в ComfyUI-Manager - RCE в связке с CVE-2025-67303 Критичность: Критическая CVSS 9.8 Затронуто: ComfyUI-Manager Выполнение кода Как это работает ComfyUI-Manager предоставляет эндпоинт /api/manager/dbmode, который принимает query-параметр value и записывает его напрям...

CVE-2026-94405

Authorization Bypass Through User-Controlled Key vulnerability in Shahjada Download Manager allows Retrieve Embedded Sensitive Data. This issue affects Download Manager: from n/a through 3.3.71...

Blind-XSS-Manager

Blind-XSS-Manager Никогда не забывай, куда внедряешь. Описание Расширение для Chrome, которое отслеживает URL-адреса, в которые были внедрены Blind XSS-пейлоады. Оно добавляет уникальное значение для каждого пейлоада, привязанного к URL, и фиксирует его в расширении при копировании. Пейлоады почт...

CVE-2024-5082

Overview This repository contains a Python proof of concept for CVE-2024-5082 , a remote code execution vulnerability in Sonatype Nexus Repository Manager 2. The vulnerability allows a user with sufficient permission to publish a specially crafted Maven artifact and mark it for processing by the...

CVE-2026-94405 WordPress Download Manager plugin <= 3.3.71 - Sensitive Data Exposure vulnerability

Authorization Bypass Through User-Controlled Key vulnerability in Shahjada Download Manager allows Retrieve Embedded Sensitive Data. This issue affects Download Manager: from n/a through 3.3.71...

EUVD-2026-91338

Authorization Bypass Through User-Controlled Key vulnerability in Shahjada Download Manager allows Retrieve Embedded Sensitive Data. This issue affects Download Manager: from n/a through 3.3.71...