PT-2026-135452

Netpbm before 10.86.51, 11.x before 11.02.30, and 11.03 before 11.15.08 contains an integer overflow in jbigtopnm that causes heap buffer overflow when computing output buffer size. Attackers can supply a crafted multi-plane JBIG file with large header dimensions so jbg dec merge planes overflows...

CVE-2026-60004-gitea-0day

CVE-2026-60004 - Gitea = 1.27.0 Pre-Auth RCE This is a proof-of-concept exploit for CVE-2026-60004, a critical remote code execution vulnerability in Gitea versions 1.17 through 1.27.0. The script automates the full exploitation chain, from user registration to establishing a stable, interactive...

revng

The rev.ng binary analysis framework and decompiler Welcome to the rev.ng project! rev.ng is an open source binary analysis framework based on LLVM and QEMU. It features a full-fledged decompiler. It's developed by rev.ng Labs in the open. Getting started Head to the online documentation to get...

merge-authz-test

merge-authz-test authz test CVE-2026-1999 siblings...

CVE-2026-3030-Prototype-Pollution-in-JSON-Merge-Patch

CVE-2026-3030 – Prototype Pollution in JSON Merge Patch Program Code Node.js // server.js - Vulnerable REST API with deep merge const express = require'express'; const app = express; app.useexpress.json; let config = role: 'user', settings: ; // Insecure deep merge function pollutable via proto...

CVE-2026-60004

CVE-2026-60004 — Gitea diffpatch RCE Remote code execution PoC for the Gitea diffpatch endpoint. An account with write access to a repository on instances with open registration, simply registering an account suffices can execute arbitrary shell commands on the server as the Gitea service account...

CVE-2026-23416-POC

CVE-2026-23416 — PoC mm/mseal: update VMA end correctly on merge Vulnerability discovered by Antonius / Blue Dragon Security Overview Field| Detail ---|--- CVE ID| CVE-2026-23416 Subsystem| mm/mseal — mm/vma.c Affected| Linux kernel 6.17 through 7.0-rc5 Fixed in| Linux 7.0-rc6, stable backports...

CVE-2020-8158

CVE-2020-8158: TypeORM Prototype Pollution Vulnerability Overview This is a proof-of-concept demonstrating CVE-2020-8158, a critical prototype pollution vulnerability in TypeORM versions = 0.2.25 package.json - Dependencies Setup Instructions See SETUP.md for detailed setup and exploitation...

EUVD-2026-114572

The The Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 3.15.5 This is due to the software allowing users to execute an action that does not properl...

CVE-2020-8554

Create Kubernetes cluster kind create cluster --config ./kind.yaml The cluster must have certmanager: https://cert-manager.io/docs/installation/kubernetes/ Test vulnerability kubectl apply -f - 'EOF' apiVersion: v1 kind: Namespace metadata: name: kubeproxy-mitm --- apiVersion: apps/v1 kind:...

CVE-2026-71204-PoC

CVE-2026-71204 — changedetection.io: Omitted Checkbox in /settings Save Silently Disables API Key Enforcement Product: dgtlmoon/changedetection.io — v0.55.7 Files: changedetectionio/blueprint/settings/init.py, changedetectionio/forms.py CWE: CWE-284 — Improper Access Control CVSS 3.1:...

CVE-2026-103442

CVE-2026-103442: CentralAuth MergeAccount object injection Reporter: Marco Paciaroni BomboBombone. CentralAuth accepted a browser-supplied merge-session key when decoding migration state. A user with the centralauth-merge right could substitute a key that produced a PHP object graph. The report's...

CVE-2026-92680

CVE-2026-92680 Proof of Concept Araxis Merge for Windows stores server credentials with DPAPI with pOptionalEntropy set to NULL. This allows any code running in the same user context to decrypt them. Full writeup: https://grepstrength.com/research/araxis-merge | ---|--- CVE| CVE-2026-92680 CWE|...

CVE-2026-101326: kstover: The The Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder plugin for WordPress…

The The Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 3.15.5 This is due to the software allowing users to execute an action that does not properl...

SealSecurity_Exam

SealSecurityExam Prototype pollution is a JavaScript vulnerability that enables an attacker to add arbitrary properties to global object prototypes, which may then be inherited by user-defined objects. A prototype pollution source is any user-controllable input that enables you to add arbitrary...

CVE-2026-107251

Incorrect Authorization vulnerability in Drupal Entity Reference Manager Merge entities allows Forceful Browsing. This issue affects Entity Reference Manager Merge entities versions: from 0.0.0 to 1.0.3...

CVE-2026-107251 Entity Reference Manager (Merge entities) - Critical - Access bypass - SA-CONTRIB-2026-194

Incorrect Authorization vulnerability in Drupal Entity Reference Manager Merge entities allows Forceful Browsing. This issue affects Entity Reference Manager Merge entities versions: from 0.0.0 to 1.0.3...

CVE-2026-107251 Entity Reference Manager (Merge entities) - Critical - Access bypass - SA-CONTRIB-2026-194

Incorrect Authorization vulnerability in Drupal Entity Reference Manager Merge entities allows Forceful Browsing. This issue affects Entity Reference Manager Merge entities versions: from 0.0.0 to 1.0.3...

CVE-2026-107251

The Entity Reference Manager (Merge entities) module for Drupal is affected by an Incorrect Authorization vulnerability (CWE-863). This flaw occurs because the module fails to sufficiently restrict access to all entity management operations. Consequently, users with content viewing permissions ca...

CVE-2026-107251: Drupal Entity Reference Manager (Merge entities): Incorrect Authorization vulnerability in Drupal Entity Reference Manager (Merge entities) allows Forceful Browsing

Incorrect Authorization vulnerability in Drupal Entity Reference Manager Merge entities allows Forceful Browsing. This issue affects Entity Reference Manager Merge entities versions: from 0.0.0 to 1.0.3...