CVE-2026-109306

Craft CMS from 5.0.0 before 5.10.14 contains a missing authorization vulnerability in AppController::actionSwitchToLicensedEdition that lets any authenticated user change the installed edition. Low-privileged front-end users can call the action route when the licensed edition mismatches to...

CVE-2026-109296

Open WebUI before 0.11.4 contains a missing authorization vulnerability that allows authenticated users to reach disabled model provider backends by supplying an explicit backend index. Attackers can pass the index as a path segment or query parameter on Ollama and OpenAI-compatible listing route...

CVE-2026-108477

Missing Authorization vulnerability in Arraytics Booktics booktics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booktics: from n/a through 1.0.28...

CVE-2026-108476

Missing Authorization vulnerability in VideoWhisper.com Paid Videochat Turnkey Site ppv-live-webcams allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Paid Videochat Turnkey Site: from n/a through 7.5.13...

EUVD-2026-97722

Missing Authorization vulnerability in WPMU DEV Forminator forminator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Forminator: from n/a through 1.58.0...

EUVD-2026-97721

Missing Authorization vulnerability in Arraytics Booktics booktics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booktics: from n/a through 1.0.28...

EUVD-2026-97577

Missing Authorization vulnerability in VideoWhisper.com Broadcast Live Video videowhisper-live-streaming-integration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Broadcast Live Video: from n/a through 7.3.6...

EUVD-2026-97576

Missing Authorization vulnerability in VideoWhisper.com Paid Videochat Turnkey Site ppv-live-webcams allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Paid Videochat Turnkey Site: from n/a through 7.5.13...

RCE

This repository does not have a README...

CVE-2026-31694-POC

CVE-2026-31694: FUSE readdir cache out-of-bounds write A missing bounds check in fs/fuse/readdir.c:fuseadddirenttocache. A FUSE server returns a dirent with namelen = 4095, which serializes to a 4120-byte record. The kernel copies it into a single 4096-byte page-cache page and overflows by 24...

cve-2017-12615

This repository does not have a README...

CVE-2020-0022

This repository does not have a README...

CVE-2020-3580

This repository does not have a README...

SNP

This repository does not have a README...

PoC-for-CVE-2021-38540-

CVE-2021-38540 Proof of Concept Missing Authentication on Critical component Known as CVE-2021-38540 About this bug: The variable import endpoint was not protected by authentication in Airflow =2.0.0, =2.0.0, variables List Variables PoC Source: POST /variable/varimport HTTP/2 Host:...

CVE-2026-48558

CVE-2026-48558: SimpleHelp OIDC Authentication Bypass !WARNING This code is provided AS IS for educational and research purposes only. Do not use this PoC on production systems, shared environments, or any unauthorized targets. This exploit demonstrates a critical remote code execution RCE...

EUVD-2026-97560

Missing Authorization vulnerability in Arraytics Booktics booktics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booktics: from n/a through 1.0.28...

NotCVE-2026-0010

Summary Vulnerability: Unauthenticated IPC Local Privilege Escalation to SYSTEM via Barrier Daemon TCP Port 24801 Vendor: debauchee Barrier project Product: Barrier 2.4.0 final release, 2021-11-01 CWE: CWE-306: Missing Authentication for Critical Function Description Barrier's Windows service...

CVE-2023-4800

CVE ID: CVE-2023-4800 Vulnerability Type: Sensitive Data Exposure Description: The DoLogin Security plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the dashboard widget in versions up to, and including, 3.7. This makes it possible for...

CVE-2026-56164-EXP

Microsoft SharePoint Server Elevation of Privilege - CVE-2026-56164 Functional unauthenticated EOP exploit. Overview Missing authentication for critical function CWE-306 in SharePoint Server user profile and site collection endpoints. Allows remote attackers to escalate from anonymous to Site...