CVE-2026-31635

🩸 CVE-2026-31635 – DirtyDecrypt Élévation de privilèges locale dans le noyau Linux via corruption du cache de pages RXGK "DirtyDecrypt" — Fait partie des exploits de la famille "Dirty" 2026 📖 Présentation DirtyDecrypt CVE-2026-31635 est une vulnérabilité d'élévation de privilèges locale dans le...

CVE-2022-22965-Spring4Shell

Ce depot n’a pas de fichier README...

CVE-2026-56423-MISP-deleteSelection-BrokenAccessControl

CVE-2026-56423 — Contrôle d'accès défaillant dans deleteSelection de MISP Preuve de concept pour une faille d'absence d'autorisation dans les flux de suppression en masse de MISP pour les Rapports d'événements et les Groupes de partage. Les gestionnaires deleteSelection autorisent chaque élément...

CVE-2026-103337

Missing Authorization vulnerability in Kirillbdev WC Ukraine Shipping wc-ukr-shipping allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WC Ukraine Shipping: from n/a through 1.23.2...

CVE-2026-105695 Penpot: Missing authorization in chunked-upload assembly lets another authenticated user consume a victim's upload session

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, assemble-chunks retrieves an upload session using only its session ID, while upload-chunk correctly scopes the lookup to the authenticated profile. An authenticated user who obtains another user's live, completed...

CVE-2026-105695 Penpot: Missing authorization in chunked-upload assembly lets another authenticated user consume a victim's upload session

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, assemble-chunks retrieves an upload session using only its session ID, while upload-chunk correctly scopes the lookup to the authenticated profile. An authenticated user who obtains another user's live, completed...

CVE-2026-105695 Penpot: Missing authorization in chunked-upload assembly lets another authenticated user consume a victim's upload session

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, assemble-chunks retrieves an upload session using only its session ID, while upload-chunk correctly scopes the lookup to the authenticated profile. An authenticated user who obtains another user's live, completed...

CVE-2026-105695

The open-source design and prototyping platform Penpot contains a missing authorization vulnerability in its chunked-upload assembly functionality. Prior to version 2.18.0 , the assemble-chunks function retrieves an upload session using only its session ID, failing to scope the lookup to the auth...

CVE-2026-51947-Advisory

Ce depot n’a pas de fichier README...

CVE-2026-105687 Penpot: A team admin (non-owner) can remove the team owner via ::delete-team-member — missing owner-protection

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the delete-team-member RPC allows a team administrator to remove any member other than themselves but does not protect the team owner. A non-owner administrator can delete the owner's team-profile-rel membership and lock t...

CVE-2022-3992

CVE-2022-3992 Cross-Site Scripting XSS dans WonderCMS Description : Une vulnérabilité de script intersite XSS dans le système de gestion de la désinfection Sanitization Management System v1.0 permet à des attaquants potentiels de téléverser des fichiers arbitraires via un nom conçu dans les champ...

CVE-2024-7135

CVE-2024-7135 Le plugin Tainacan pour WordPress est vulnérable à un accès non autorisé aux données en raison d'un contrôle de capacité manquant sur la fonction 'getfile' dans toutes les versions jusqu'à la 0.21.7 incluse. La fonction est également vulnérable au directory traversal. Cela permet à...

CVE-2026-97304

Missing Authorization vulnerability in Arraytics Timetics timetics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Timetics: from n/a through 1.0.63...

CVE-2026-97303

Missing Authorization vulnerability in Apps Mav Scratch & Win – Giveaways and Contests scratch-win-giveaways-for-website-facebook allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Scratch & Win – Giveaways and Contests: from n/a through 3.0.2...

CVE-2026-97309

Missing Authorization vulnerability in Webful Creations RepairBuddy computer-repair-shop allows Retrieve Embedded Sensitive Data.This issue affects RepairBuddy: from n/a through 4.1226...

CVE-2026-58865

In multiple functions of PduParser.java, there is a possible persistent denial of service due to a missing bounds check. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-103086

Missing Authorization vulnerability in Stiofan UsersWP userswp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects UsersWP: from n/a through 1.2.74...

CVE-2026-102383

Missing Authorization vulnerability in VillaTheme Lookzy woo-lookbook allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Lookzy: from n/a through 1.1.14...

CVE-2026-20253

CVE-2026-20253 — Laboratoire RCE sans authentification préalable pour Splunk Enterprise Création et troncature arbitraires de fichiers sans authentification via le sidecar PostgreSQL CVSS 9.8 · Critique · CWE-306 · Exploité activement CISA KEV ⚠️ Avertissement Ce dépôt est destiné strictement à de...

CVE-2026-58865

In multiple functions of PduParser.java, there is a possible persistent denial of service due to a missing bounds check. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation...