PT-2026-106646

In the Linux kernel, the following vulnerability has been resolved: neighbour: Enforce min/max to NDTPA INTERVAL PROBE TIME MS. NDTPA INTERVAL PROBE TIME MS sets .type and .min but misses .validation type, so no validation is applied: ynl --family rt-neigh --do setneightbl --json '"name": "arp...

CVE-2026-106038: Missing Authentication for Critical Function

Mooncake Store master through 0.3.13.post1 contains a missing authentication vulnerability that allows unauthenticated attackers to force-delete any object via Remove, RemoveByRegex, RemoveAll and BatchRemove on the cororpc port. Attackers can send forged requests with the force flag set to bypas...

CVE-2026-63030

CVE-2026-63030 — WordPress wp2shell Exploit Unauthenticated detection and exploitation tool for the WordPress core batch-confusion vulnerability CVE-2026-63030 / CVE-2026-60137, which leads to SQL injection and remote code execution RCE through the REST API batch endpoint. ⚠️ For authorized...

CVE-2026-66908

CVE-2026-66908 — camel-platform-http-main JWT iss/aud não validados Reprodutor de prova de conceito executável para a vulnerabilidade do Apache Camel em que o servidor HTTP embarcado do camel-main constrói seu autenticador JWT apenas a partir de um keystore quando nem jwtIssuer nem jwtAudience es...

CVE-2024-4898-Poc

CVE-2024-4898-Poc CVE-2024-4898 InstaWP Connect – 1-click WP Staging & Migration = 0.1.0.38 - Falta de Autorização para Configuração de API Não Autenticada/Atualização Arbitrária de Opções/Criação de Usuário Administrativo...

CVE-2021-3156

Este repositorio nao tem um README...

CVE-2024-5326-Poc

CVE-2024-5326 CVE-2024-5326 Post Grid Gutenberg Blocks and WordPress Blog Plugin – PostX = 4.1.2 - Falta de Autorização para Atualização Arbitrária de Opções Descrição O plugin Post Grid Gutenberg Blocks and WordPress Blog Plugin – PostX para WordPress é vulnerável à modificação não autorizada de...

grafana: grafana: Dashboard modification lockout via forged file-provisioning metadata

A flaw was found in Grafana. An authenticated user with Editor permissions can set file-provisioning metadata when creating a dashboard through the dashboard API due to a missing authorization check. Consequently, the dashboard is treated as externally managed by configuration files, preventing...

CVE-2026-48907

CVE-2026-48907 PoC Educacional ⚠️ Este repositório é apenas para fins educacionais e de segurança defensiva. Teste apenas em sistemas que você possui ou está explicitamente autorizado a avaliar. Não use este projeto contra sistemas de terceiros. Este PoC demonstra a CVE-2026-48907, uma...

Broken-Vulnerable-Code-Snippets

Vulnerable-Code-Snippets Uma coleção de trechos de código vulneráveis retirados da internet. Trechos retirados de vários posts de blogs, livros, recursos etc. Sem intenção de violação de direitos autorais Nota: Este não é um bom benchmark para testar ferramentas de análise estática; são trechos d...

CVE-2026-31635

🩸 CVE-2026-31635 – DirtyDecrypt Escalação Local de Privilégio no Kernel Linux via Corrupção de Cache de Páginas RXGK "DirtyDecrypt" — Parte da família de exploits "Dirty" de 2026 📖 Visão Geral DirtyDecrypt CVE-2026-31635 é uma vulnerabilidade de escalação local de privilégio no subsistema rxrpc d...

CVE-2022-22965-Spring4Shell

Este repositorio nao tem um README...

CVE-2026-56423-MISP-deleteSelection-BrokenAccessControl

CVE-2026-56423 — MISP deleteSelection Controle de Acesso Quebrado Prova de conceito para uma falha de autorização ausente nos fluxos de exclusão em massa do MISP para Relatórios de Evento e Grupos de Compartilhamento. Os manipuladores deleteSelection autorizam cada item selecionado com um callbac...

CVE-2026-103337

Missing Authorization vulnerability in Kirillbdev WC Ukraine Shipping wc-ukr-shipping allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WC Ukraine Shipping: from n/a through 1.23.2...

CVE-2026-105695 Penpot: Missing authorization in chunked-upload assembly lets another authenticated user consume a victim's upload session

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, assemble-chunks retrieves an upload session using only its session ID, while upload-chunk correctly scopes the lookup to the authenticated profile. An authenticated user who obtains another user's live, completed...

CVE-2026-105695 Penpot: Missing authorization in chunked-upload assembly lets another authenticated user consume a victim's upload session

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, assemble-chunks retrieves an upload session using only its session ID, while upload-chunk correctly scopes the lookup to the authenticated profile. An authenticated user who obtains another user's live, completed...

CVE-2026-105695

The open-source design and prototyping platform Penpot contains a missing authorization vulnerability in its chunked-upload assembly functionality. Prior to version 2.18.0 , the assemble-chunks function retrieves an upload session using only its session ID, failing to scope the lookup to the auth...

CVE-2026-105695 Penpot: Missing authorization in chunked-upload assembly lets another authenticated user consume a victim's upload session

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, assemble-chunks retrieves an upload session using only its session ID, while upload-chunk correctly scopes the lookup to the authenticated profile. An authenticated user who obtains another user's live, completed...

CVE-2026-51947-Advisory

Este repositorio nao tem um README...

CVE-2026-105687 Penpot: A team admin (non-owner) can remove the team owner via ::delete-team-member — missing owner-protection

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the delete-team-member RPC allows a team administrator to remove any member other than themselves but does not protect the team owner. A non-owner administrator can delete the owner's team-profile-rel membership and lock t...