CVE-2026-58865

In multiple functions of PduParser.java, there is a possible persistent denial of service due to a missing bounds check. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation...

EUVD-2026-92618

In multiple functions of PduParser.java, there is a possible persistent denial of service due to a missing bounds check. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-45524

In isSystem of WifiPermissionsUtil.java, there is a possible sandbox escape due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2025-66391

이 저장소에는 README가 없습니다...

CVE-2026-105638

The project management tool Plane is vulnerable to a 6-digit OTP brute force attack in versions prior to 1.4.0 . The magic-code email login verifier lacks a per-code failed-attempt counter, fails to invalidate Redis entries on incorrect attempts, and does not lock email addresses. Because the ver...

CVE-2026-105638 Plane: Magic-code verifier endpoint has no rate limit, enabling 6-digit OTP brute force

Plane is an open-source project management tool. Prior to 1.4.0, Plane's magic-code email login uses a six-digit numeric OTP with approximately 20 bits of entropy. The verifier has no per-code failed-attempt counter, and an incorrect code does not increment a counter, invalidate the Redis entry, ...

EUVD-2026-92594

Plane is an open-source project management tool. Prior to 1.4.0, Plane's magic-code email login uses a six-digit numeric OTP with approximately 20 bits of entropy. The verifier has no per-code failed-attempt counter, and an incorrect code does not increment a counter, invalidate the Redis entry, ...

CVE-2026-97303

The Scratch & Win – Giveaways and Contests WordPress plugin (versions

CVE-2026-97309 WordPress RepairBuddy plugin <= 4.1226 - Sensitive Data Exposure vulnerability

Missing Authorization vulnerability in Webful Creations RepairBuddy computer-repair-shop allows Retrieve Embedded Sensitive Data.This issue affects RepairBuddy: from n/a through 4.1226...

CVE-2026-97309

The RepairBuddy computer-repair-shop WordPress plugin, developed by Webful Creations , is vulnerable to a Missing Authorization flaw in versions up to and including 4.1226 . This vulnerability allows an attacker to Retrieve Embedded Sensitive Data from the application. While the technical root ca...

CVE-2026-97309 WordPress RepairBuddy plugin <= 4.1226 - Sensitive Data Exposure vulnerability

Missing Authorization vulnerability in Webful Creations RepairBuddy computer-repair-shop allows Retrieve Embedded Sensitive Data.This issue affects RepairBuddy: from n/a through 4.1226...

EUVD-2026-92588

Missing Authorization vulnerability in Webful Creations RepairBuddy computer-repair-shop allows Retrieve Embedded Sensitive Data.This issue affects RepairBuddy: from n/a through 4.1226...

EUVD-2026-92584

Missing Authorization vulnerability in Arraytics Timetics timetics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Timetics: from n/a through 1.0.63...

EUVD-2026-92581

Missing Authorization vulnerability in Stiofan UsersWP userswp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects UsersWP: from n/a through 1.2.74...

EUVD-2026-92579

Missing Authorization vulnerability in VillaTheme Lookzy woo-lookbook allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Lookzy: from n/a through 1.1.14...

CVE-2026-105633 Plane: Issue Attachment Ownership Hijacking via Missing `issue_id` Scope

Plane is an open-source project management tool. Prior to 1.4.0, the V2 issue-attachment PATCH endpoint accepts issueid in the URL but omits it from the database query. A project member can use an issueid they control in the URL while targeting another user's attachment by its pk UUID. Because th...

CVE-2026-105633 Plane: Issue Attachment Ownership Hijacking via Missing `issue_id` Scope

Plane is an open-source project management tool. Prior to 1.4.0, the V2 issue-attachment PATCH endpoint accepts issueid in the URL but omits it from the database query. A project member can use an issueid they control in the URL while targeting another user's attachment by its pk UUID. Because th...

CVE-2026-105633 Plane: Issue Attachment Ownership Hijacking via Missing `issue_id` Scope

Plane is an open-source project management tool. Prior to 1.4.0, the V2 issue-attachment PATCH endpoint accepts issueid in the URL but omits it from the database query. A project member can use an issueid they control in the URL while targeting another user's attachment by its pk UUID. Because th...

CVE-2026-105633

The open-source project management tool Plane is vulnerable to an authorization bypass in the V2 issue-attachment PATCH endpoint prior to version 1.4.0 . The root cause is that the server accepts an issue_id in the URL but fails to include it in the database query, matching only on pk, workspace,...

CVE-2025-1307

Newscrunch 익스플로잇 CVE-2025-1307 🚨 개요 이 익스플로잇은 Newscrunch WordPress 테마 의 치명적인 취약점CVE-2025-1307을 대상으로 합니다. 이 결함은 newscrunchinstallandactivateplugin 함수의 기능 검사 누락으로 인해 인증된 사용자구독자 이상가 임의의 파일을 업로드할 수 있게 합니다. 이로 인해 원격 코드 실행RCE으로 이어져 영향을 받는 WordPress 사이트가 완전히 손상될 수 있습니다. 🔥 취약점 세부 정보 CVE ID: CVE-2025-1307...