WPTimeCapsulePOC

Backup and Staging by WP Time Capsule 1.21.16 - 身份认证绕过概念验证 最近在 WP Time Capsule 1.21.16 中发现了一个身份认证绕过漏洞（https://www.webarxsecurity.com/vulnerability-infinitewp-client-wp-time-capsule/）。此 PoC 演示了该问题的工作原理以及如何利用它。 该 PoC 该 PoC 提供两种不同的选项： 选项 1：获取管理员 cookie 示例： root@kitploit: poc.py http://127.0.0.1/ 选项...

Linux Distros Unpatched Vulnerability : CVE-2026-86091

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ntopng before 6.7.260717 fails to check user privileges in the pools bulk-delete endpoint, allowing authenticated non-administrators to delete all host pools an...

EUVD-2026-71778

ntopng before 6.7.260717 fails to check user privileges in the pools bulk-delete endpoint, allowing authenticated non-administrators to delete all host pools and member bindings. Attackers can issue POST requests to the delete pools endpoint to irreversibly destroy every host pool, removing traff...

EUVD-2026-66385

StarRocks performs no privilege check when a legacy synchronous materialized view is dropped. Every other statement type routed through AuthorizerStmtVisitor calls into Authorizer before execution, but visitDropMaterializedViewStatement returns immediately with a comment stating the check happens...

CVE-2026-55545

Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs WebSocket subscription handlers fail to enforce the privileges required by equivalent REST endpoints. PacketsApi.subscribePackets exposes the packets WebSocket topic without ObjectPrivilegeType.ReadPacket,...

GHSA-FWWW-CP23-7F5G Yamcs's WebSocket subscription handlers omit the privilege checks their REST siblings enforce

Asset / scope: Yamcs 5.12.7 WebSocket topics packets, algorithm-status, mdb-changes Summary Several WebSocket subscription handlers do not perform the privilege check that their REST counterparts enforce, so a principal subscribing over WebSocket receives data the REST API would have scoped or...

Yamcs's WebSocket subscription handlers omit the privilege checks their REST siblings enforce

Asset / scope: Yamcs 5.12.7 WebSocket topics packets, algorithm-status, mdb-changes Summary Several WebSocket subscription handlers do not perform the privilege check that their REST counterparts enforce, so a principal subscribing over WebSocket receives data the REST API would have scoped or...

CVE-2026-55545 Yamcs: WebSocket subscription handlers omit the privilege checks their REST siblings enforce

Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs WebSocket subscription handlers fail to enforce the privileges required by equivalent REST endpoints. PacketsApi.subscribePackets exposes the packets WebSocket topic without ObjectPrivilegeType.ReadPacket,...

CVE-2026-55545 Yamcs: WebSocket subscription handlers omit the privilege checks their REST siblings enforce

Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs WebSocket subscription handlers fail to enforce the privileges required by equivalent REST endpoints. PacketsApi.subscribePackets exposes the packets WebSocket topic without ObjectPrivilegeType.ReadPacket,...

EUVD-2026-67839

Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs WebSocket subscription handlers fail to enforce the privileges required by equivalent REST endpoints. PacketsApi.subscribePackets exposes the packets WebSocket topic without ObjectPrivilegeType.ReadPacket,...

CVE-2026-77235 Missing privilege check in SecureContext_FreeContext in FreeRTOS-Kernel

Missing privilege verification in the secure context cleanup handler in FreeRTOS-Kernel before 11.3.1 might allow local users to cause a use-after-free condition in secure-world memory via the SVC handler for secure context deallocation. To remediate this issue, users should upgrade to...

CVE-2026-74270

In the Linux kernel, the following vulnerability has been resolved: handshake: Require admin permission for DONE command ACCEPT and DONE are the two downcalls of the handshake genl family, both intended for use by the trusted handshake agent tlshd. ACCEPT already requires GENLADMINPERM; DONE has ...

Efacec QC 安全漏洞

Efacec QC is a series of electric vehicle charging posts from Efacec Portugal. A security vulnerability exists in Efacec QC that stems from a lack of privilege control over user XXX, which could lead to unlimited privilege elevation...

Google Android Missing Privilege Checking Vulnerability

Google Android is a free and open source mobile operating system based on the Linux kernel developed by Google. Google Android suffers from a missing privilege check vulnerability that can be exploited by attackers to cause a physical denial of service...

WordPress Cryptocurrency Payment Gateway for WooCommerce plugin unauthorized data modification vulnerability

WordPress Cryptocurrency Payment Gateway for WooCommerce plugin is a virtual currency payment collection plugin designed for WooCommerce e-commerce platform. WordPress Cryptocurrency Payment Gateway for WooCommerce plugin suffers from an unauthorized data modification vulnerability that stems fro...

WordPress plugin Custom Searchable Data Entry System 安全漏洞

WordPress Custom Searchable Data Entry System plugin is a plugin for creating a searchable data entry system in your website that allows users to fill in information based on specific criteria and enables data matching queries. The WordPress Custom Searchable Data Entry System plugin suffers from...

Google Android Missing Privilege Check Vulnerability

Google Android is a free and open source mobile operating system based on the Linux kernel, developed by Google Inc. and the Open Handset Alliance, and is mainly used for smartphones, tablets and other devices. Google Android suffers from a missing privilege check vulnerability, which can be...

Google Android 安全漏洞

Google Android is a free and open source mobile operating system based on the Linux kernel, developed by Google Inc. and the Open Handset Alliance, and is mainly used for smartphones, tablets and other devices. Google Android suffers from a missing privilege check vulnerability, which can be...

Google Android 安全漏洞

Google Android is a Linux-based open source operating system from Google. Google Android suffers from an elevation of privilege vulnerability due to a missing privilege check in the onCreate function in UninstallerActivity.java. An attacker can exploit this vulnerability to gain elevated privileg...

Google Android 安全漏洞

Google Android is a Linux-based open source operating system from Google. Google Android suffers from an elevation of privilege vulnerability, which is caused by a lack of privilege checking in multiple functions. The vulnerability can be exploited by an attacker to cause privilege escalation...