CVE-2026-109656: Missing Authorization

Frappe ERPNext before 15.118.2 and 16.x before 16.30.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks on item master data. Authenticated attackers with low-privileged accounts can call these endpoints to read item master data...

CVE-2026-109665: Missing Authorization

Frappe ERPNext before 15.108.0 and 16.x before 16.18.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper permission checks. Authenticated low-privileged users can call these endpoints to deactivate master records, modifying data beyond their permitted...

CVE-2026-109188: Missing Authorization

jshERP through 3.6 contains a missing authorization vulnerability that allows low-privilege authenticated users to create tenant-wide master data via add and import endpoints lacking role checks. Attackers can send POST requests to endpoints like /account/add, /material/add, or...

CVE-2026-107862: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in ExpressTech Quiz And Survey Master quiz-master-next allows DOM-Based XSS.This issue affects Quiz And Survey Master: from n/a through 11.2.7...

PT-2026-110577

Name of the Vulnerable Software and Affected Versions jshERP versions prior to 3.7 Description A missing authorization issue allows authenticated users with low privileges to create tenant-wide master data. This occurs because certain endpoints do not perform necessary role checks. An attacker ca...

CVE-2026-109670: Improper Neutralization of Input During Web Page Generation

Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a stored cross-site scripting vulnerability caused by record names being rendered without escaping. Attackers with write access to item master data can store malicious script in a record name that executes in the browser of any...

tofu

tofu Una herramienta modular para hackear sistemas de archivos Windows sin conexión y omitir pantallas de inicio de sesión. Puede realizar volcados de hashes, puertas traseras OSK, enumeración de usuarios y más. Cómo funciona : Cuando una máquina Windows se apaga, a menos que tenga Bitlocker u ot...

scannerl

Scannerl Scannerl es un motor modular de fingerprinting distribuido implementado por Kudelski Security. Scannerl puede generar huellas digitales de miles de objetivos en un solo host, pero también puede distribuirse fácilmente a través de múltiples hosts. Scannerl es al fingerprinting lo que zmap...

hdcp-genkey

Esempio di generazione della chiave HDCP Questo script implementa una versione semplice dell'algoritmo di generazione delle chiavi HDCP in Python utilizzando la chiave master HDCP trapelata che si trova in master-key.txt. Usage: generatekey.py options Options: -h, --help show this help message an...

keepass-password-dumper

Volcador de contraseña maestra de KeePass 2.X CVE-2023-32784 Actualización La vulnerabilidad fue asignada CVE-2023-32784 y corregida en KeePass 2.54. Gracias nuevamente a Dominik Reichl por su rápida respuesta y solución creativa. Aclaración: la contraseña debe escribirse en un teclado, no copiar...

CVE-2026-96558

The Quiz and Survey Master QSM – Quiz Maker & Survey Maker plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'qsmhiddenquestions' parameter in all versions up to, and including, 11.2.6 due to insufficient input sanitization and output escaping. This makes it...

EUVD-2026-96227

The Quiz and Survey Master QSM – Quiz Maker & Survey Maker plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'qsmhiddenquestions' parameter in all versions up to, and including, 11.2.6 due to insufficient input sanitization and output escaping. This makes it...

CVE-2026-96558 Quiz and Survey Master (QSM) <= 11.2.6 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'qsm_hidden_questions' Parameter

The Quiz and Survey Master QSM – Quiz Maker & Survey Maker plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'qsmhiddenquestions' parameter in all versions up to, and including, 11.2.6 due to insufficient input sanitization and output escaping. This makes it...

CVE-2026-96558

The Quiz and Survey Master (QSM) plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting in all versions up to and including 11.2.6 . The flaw stems from insufficient input sanitization and output escaping of the 'qsm_hidden_questions' parameter. An unauthenticated attacker ca...

CVE-2026-96558: Improper Neutralization of Input During Web Page Generation

The Quiz and Survey Master QSM – Quiz Maker & Survey Maker plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'qsmhiddenquestions' parameter in all versions up to, and including, 11.2.6 due to insufficient input sanitization and output escaping. This makes it...

CVE-2026-104392

Deserialization of Untrusted Data vulnerability in ExpressTech Quiz And Survey Master quiz-master-next allows Object Injection.This issue affects Quiz And Survey Master: from n/a through 11.2.7...

EUVD-2026-95741

Deserialization of Untrusted Data vulnerability in ExpressTech Quiz And Survey Master quiz-master-next allows Object Injection.This issue affects Quiz And Survey Master: from n/a through 11.2.7...

CVE-2026-104392

The Quiz And Survey Master WordPress plugin (versions

CVE-2026-104392 WordPress Quiz And Survey Master plugin <= 11.2.7 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in ExpressTech Quiz And Survey Master quiz-master-next allows Object Injection.This issue affects Quiz And Survey Master: from n/a through 11.2.7...

RUSTSEC-2026-0335 Pre-shared key mode transmits the TGK in cleartext, exposing the SRTP master key

mykey implements MIKEY RFC 3830 for SRTP key exchange. Pre-shared key mode transmitted the TEK Generation Key TGK in the clear. MikeyMessage::newpskinit built its KEMAC payload with EncAlg::Null and placed the TGK in encdata verbatim. Anyone able to read a PSK-Init message therefore recovers the...