PT-2026-106743

Mooncake Store master through 0.3.13.post1 contains a missing authorization vulnerability that allows unauthenticated attackers to create, steal, and falsely complete replication tasks via the coro rpc port. Attackers can invoke CreateCopyTask, CreateMoveTask, FetchTasks, and MarkTaskToComplete...

PT-2026-106745

Mooncake Store master through 0.3.13.post1 contains a missing authorization vulnerability that allows unauthenticated attackers to inject completed LOCAL DISK replicas through the NotifyOffloadSuccess RPC. Attackers can mount a local disk segment with a self-chosen client UUID, then attach replic...

PT-2026-106646

In the Linux kernel, the following vulnerability has been resolved: neighbour: Enforce min/max to NDTPA INTERVAL PROBE TIME MS. NDTPA INTERVAL PROBE TIME MS sets .type and .min but misses .validation type, so no validation is applied: ynl --family rt-neigh --do setneightbl --json '"name": "arp...

CVE-2026-63691: Missing Authorization

Dell Container Storage Modules, versions prior to 1.18.0, contains a Missing Authorization vulnerability in the Dell CSI Driver for PowerMax - csireverseproxy . An unauthenticated attacker with adjacent network access could potentially exploit this vulnerability, leading to Unauthorized access...

PT-2026-106435

Missing Authorization vulnerability in Patterns In The Cloud Autoship Cloud for WooCommerce Subscription Products autoship-cloud allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Autoship Cloud for WooCommerce Subscription Products: from n/a through 2.17.1...

CVE-2026-63688: Missing Authentication for Critical Function

Dell Container Storage Modules CSM, versions prior to v1.18.0, contains a Missing Authentication for Critical Function vulnerability in the csm-authorization-storage gRPC server. An unauthenticated remote attacker could potentially exploit this vulnerability, leading to unauthorized access to...

CVE-2026-106384: Missing Authorization

Missing authorization in SiteIsolation in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. Chromium security severity: Medium...

PT-2026-106880

Missing authorization in Passwords in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-106224: Missing Authorization

Missing authorization in Google Lens in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to obtain cross-origin data via a crafted HTML page. Chromium security severity: Medium...

PT-2026-107035

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 155.0.8059.39 Description Missing authorization in FullScreen allows a remote attacker who has compromised the renderer process and used social engineering to bypass system access restrictions through a crafted...

Fedora 43 : python3.12 (2026-f30cb310f9)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-f30cb310f9 advisory. New version of the Python interpreter Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has...

CVE-2026-63030

CVE-2026-63030 — WordPress wp2shell Exploit Unauthenticated detection and exploitation tool for the WordPress core batch-confusion vulnerability CVE-2026-63030 / CVE-2026-60137, which leads to SQL injection and remote code execution RCE through the REST API batch endpoint. ⚠️ For authorized...

CVE-2026-66908

CVE-2026-66908 — camel-platform-http-main : les revendications JWT iss/aud non validées Reproducteur de preuve de concept exécutable pour la vulnérabilité Apache Camel où le serveur HTTP embarqué de camel-main construit son authentificateur JWT uniquement à partir d'un keystore lorsqu'aucun...

CVE-2024-4898-Poc

CVE-2024-4898-Poc CVE-2024-4898 InstaWP Connect – 1-click WP Staging & Migration = 0.1.0.38 - Missing Authorization to Unauthenticated API setup/Arbitrary Options Update/Administrative User Creation...

CVE-2021-3156

This repository does not have a README...

CVE-2024-5326-Poc

CVE-2024-5326 CVE-2024-5326 Post Grid Gutenberg Blocks and WordPress Blog Plugin – PostX = 4.1.2 - Missing Authorization to Arbitrary Options Update Description The Post Grid Gutenberg Blocks and WordPress Blog Plugin – PostX plugin for WordPress is vulnerable to unauthorized modification of data...

grafana: grafana: Dashboard modification lockout via forged file-provisioning metadata

A flaw was found in Grafana. An authenticated user with Editor permissions can set file-provisioning metadata when creating a dashboard through the dashboard API due to a missing authorization check. Consequently, the dashboard is treated as externally managed by configuration files, preventing...

CVE-2026-48907

CVE-2026-48907 PoC éducatif ⚠️ Ce dépôt est destiné uniquement à des fins éducatives et de sécurité défensive. Testez uniquement sur des systèmes que vous possédez ou pour lesquels vous avez une autorisation explicite. N'utilisez pas ce projet contre des systèmes tiers. Ce PoC démontre la...

Broken-Vulnerable-Code-Snippets

Vulnerable-Code-Snippets Une collection d'extraits de code vulnérables provenant d'Internet. Les extraits sont tirés de divers articles de blog, livres, ressources, etc. Aucune violation de droit d'auteur n'est intentionnelle. Remarque : Ce n'est pas un bon benchmark pour tester les outils...

CVE-2026-31635

🩸 CVE-2026-31635 – DirtyDecrypt Linux Kernel Local Privilege Escalation via RXGK Page Cache Corruption "DirtyDecrypt" — Part of the 2026 "Dirty" family exploits 📖 Overview DirtyDecrypt CVE-2026-31635 is a local privilege escalation vulnerability in the Linux kernel's rxrpc subsystem specifically...