EUVD-2026-72696

The Zephyr Project Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘message’ parameter in all versions up to, and including, 3.3.205 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Custom-level...

CVE-2026-54992-PoC

CVE-2026-54992 PoC Proof of concept for the Microsoft Message Queuing remote-read integer overflow tracked as CVE-2026-54992. The PoC uses two Windows VMs. A normal user on the vulnerable target asks the local MSMQ service to read from a queue hosted by the helper. The helper returns a malformed...

CVE-2022-25813

CVE-2022-25813: FreeMarker Server-Side Template Injection in Apache OfBiz By inserting malicious content in a message’s “Subject” field, an attacker may perform SSTI Server-Side Template Injection attacks, which can leverage FreeMarker exposed objects to bypass restrictions and obtain RCE Remote...

CVE-2026-58240

SAP NetWeaver Message Server does not sufficiently validate the authenticity of internal application server components during registration. An unauthenticated attacker with network access to the affected service could exploit this weakness to register an unauthorized component and potentially...

CVE-2026-86510 D-Link DIR-822A L2TP Control Message tunnel_set_params out-of-bounds write

A vulnerability has been found in D-Link DIR-822A A101. Affected is the function tunnelsetparams of the component L2TP Control Message Parser. Such manipulation leads to out-of-bounds write. The attack can be launched remotely. The exploit has been disclosed to the public and may be used...

EUVD-2026-72609

A vulnerability has been found in D-Link DIR-822A A101. Affected is the function tunnelsetparams of the component L2TP Control Message Parser. Such manipulation leads to out-of-bounds write. The attack can be launched remotely. The exploit has been disclosed to the public and may be used...

EUVD-2026-72575

SAP NetWeaver Message Server does not sufficiently validate the authenticity of internal application server components during registration. An unauthenticated attacker with network access to the affected service could exploit this weakness to register an unauthorized component and potentially...

CVE-2026-58240 Missing Authentication check in SAP NetWeaver (Message Server)

SAP NetWeaver Message Server does not sufficiently validate the authenticity of internal application server components during registration. An unauthenticated attacker with network access to the affected service could exploit this weakness to register an unauthorized component and potentially...

CVE-2026-58240

SAP NetWeaver Message Server fails to sufficiently validate the authenticity of internal application server components during registration. An unauthenticated attacker with network access to the service can register an unauthorized component and potentially perform unauthorized actions within the...

CVE-2026-58240 Missing Authentication check in SAP NetWeaver (Message Server)

SAP NetWeaver Message Server does not sufficiently validate the authenticity of internal application server components during registration. An unauthenticated attacker with network access to the affected service could exploit this weakness to register an unauthorized component and potentially...

CVE-2026-79574

An issue in the gateway server of mpush v0.8.1 allows attackers to execute arbitrary code via sending a crafted broadcast message...

PT-2026-86950

SAP NetWeaver Message Server does not sufficiently validate the authenticity of internal application server components during registration. An unauthenticated attacker with network access to the affected service could exploit this weakness to register an unauthorized component and potentially...

EUVD-2026-72911

An issue in the gateway server of mpush v0.8.1 allows attackers to execute arbitrary code via sending a crafted broadcast message...

CVE-2026-79574

mpush v0.8.1 contains a vulnerability in its gateway server component that allows unauthenticated, remote attackers to execute arbitrary code by sending a crafted broadcast message. The flaw is rated CVSS 9.8 (Critical) with no required privileges or user interaction. CISA's SSVC assessment indic...

PT-2026-88142

A new vulnerability with increased severity was disclosed for Microsoft Windows CVE-2026-83997 https://t.co/Di6uxnlzNX...

MSMQ-Vulnerability

MSMQ Security Lab This repository documents a controlled lab review of Microsoft Message Queuing security exposure, focusing on defensive validation, detection evidence, and remediation planning. The project is positioned as a portfolio artefact: it shows how vulnerability research can be...

CVE-2026-59310

CVE-2026-59310 More root@kitploit: echo '1 2026-08-14T12:00:00.000Z ../../../../../../opt/vmware/share/htdocs/configurev2/cve59310chkee57b163c432 research - - - CVE-2026-59310-ee57b163c432'|nc syslogserver 514 root@kitploit: GET /configurev2/cve59310chkee57b163c432-syslog.log HTTP/1.1...

CVE-2026-46456

CVE-2026-46456 — camel-aws2-sqs Inbound Message-Attribute Header Injection Runnable proof-of-concept reproducers for the same Apache Camel vulnerability, one per runtime:...

EUVD-2026-72503

In JetBrains YouTrack before 2026.2.18634 a crafted WebSocket message allowed read-only whiteboard users to modify canvas content...

EUVD-2022-56040

PocketMine-MP before 4.2.10 fails to validate the total length of incoming chat message blobs before splitting them by newline characters, allowing attackers to send large messages containing many newlines. Malicious clients can send megabyte-sized chat packets and bombard the server with thousan...