CVE-2026-106224: Missing Authorization

Missing authorization in Google Lens in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to obtain cross-origin data via a crafted HTML page. Chromium security severity: Medium...

PT-2026-106773

Name of the Vulnerable Software and Affected Versions Dell Container Storage Modules CSM versions prior to 1.18.0 Description The csm-authorization-tenant gRPC service TenantService lacks authentication for critical functions. An unauthenticated adjacent network attacker could exploit this to...

PT-2026-106742

Name of the Vulnerable Software and Affected Versions Mooncake Store versions master through 0.3.13.post1 Description A missing authentication issue allows unauthenticated attackers to force-delete objects via the coro rpc port. By sending forged requests with the force flag set, attackers can...

PT-2026-106774

Name of the Vulnerable Software and Affected Versions Crayons plugin for SPIP versions prior to 3.5.0 Description A missing authorization flaw allows unauthenticated attackers to modify arbitrary editable object fields. This occurs when the secu anti-forgery parameter is omitted in the 'crayons...

CVE-2026-63030

CVE-2026-63030 — WordPress wp2shell Exploit Unauthenticated detection and exploitation tool for the WordPress core batch-confusion vulnerability CVE-2026-63030 / CVE-2026-60137, which leads to SQL injection and remote code execution RCE through the REST API batch endpoint. ⚠️ For authorized...

CVE-2026-66908

CVE-2026-66908 — camel-platform-http-main JWT iss/aud not validated Runnable proof-of-concept reproducer for the Apache Camel vulnerability where the camel-main embedded HTTP server builds its JWT authenticator from a keystore alone when neither jwtIssuer nor jwtAudience is configured, so inbound...

CVE-2024-4898-Poc

CVE-2024-4898-Poc CVE-2024-4898 InstaWP Connect – 1-click WP Staging & Migration = 0.1.0.38 - Autorización faltante para configuración de API no autenticada/Actualización arbitraria de opciones/Creación de usuario administrativo...

CVE-2021-3156

This repository does not have a README...

CVE-2024-5326-Poc

CVE-2024-5326 CVE-2024-5326 Post Grid Gutenberg Blocks and WordPress Blog Plugin – PostX = 4.1.2 - Falta de autorización para actualización de opciones arbitrarias Descripción El plugin Post Grid Gutenberg Blocks and WordPress Blog Plugin – PostX para WordPress es vulnerable a la modificación no...

grafana: grafana: Dashboard modification lockout via forged file-provisioning metadata

A flaw was found in Grafana. An authenticated user with Editor permissions can set file-provisioning metadata when creating a dashboard through the dashboard API due to a missing authorization check. Consequently, the dashboard is treated as externally managed by configuration files, preventing...

CVE-2026-48907

CVE-2026-48907 PoC Educativo ⚠️ Este repositorio es solo con fines educativos y de seguridad defensiva. Pruebe únicamente en sistemas que le pertenezcan o para los que tenga autorización explícita. No utilice este proyecto contra sistemas de terceros. Este PoC demuestra la CVE-2026-48907, una...

Broken-Vulnerable-Code-Snippets

Vulnerable-Code-Snippets A collection of vulnerable code snippets taken form around the internet. Snippets taken from various blog posts, books, resources etc. No Copyright Infringement Intended Note: This is not a good benchmark for testing static analysis tools, they are broken code snippets,...

CVE-2026-31635

🩸 CVE-2026-31635 – DirtyDecrypt Escalada de Privilegios Local del Kernel de Linux mediante Corrupción de Caché de Página RXGK "DirtyDecrypt" — Parte de la familia de exploits "Dirty" de 2026 📖 Resumen DirtyDecrypt CVE-2026-31635 es una vulnerabilidad de escalada de privilegios local en el...

CVE-2022-22965-Spring4Shell

Este repositorio no tiene un README...

CVE-2026-56423-MISP-deleteSelection-BrokenAccessControl

CVE-2026-56423 — MISP deleteSelection Control de Acceso Roto Prueba de concepto de una vulnerabilidad de autorización faltante en los flujos de eliminación masiva de MISP para Event Reports y Sharing Groups. Los controladores deleteSelection autorizan cada elemento seleccionado con un callback qu...

CVE-2026-103337

Missing Authorization vulnerability in Kirillbdev WC Ukraine Shipping wc-ukr-shipping allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WC Ukraine Shipping: from n/a through 1.23.2...

CVE-2026-105695 Penpot: Missing authorization in chunked-upload assembly lets another authenticated user consume a victim's upload session

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, assemble-chunks retrieves an upload session using only its session ID, while upload-chunk correctly scopes the lookup to the authenticated profile. An authenticated user who obtains another user's live, completed...

CVE-2026-105695 Penpot: Missing authorization in chunked-upload assembly lets another authenticated user consume a victim's upload session

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, assemble-chunks retrieves an upload session using only its session ID, while upload-chunk correctly scopes the lookup to the authenticated profile. An authenticated user who obtains another user's live, completed...

CVE-2026-105695

The open-source design and prototyping platform Penpot contains a missing authorization vulnerability in its chunked-upload assembly functionality. Prior to version 2.18.0 , the assemble-chunks function retrieves an upload session using only its session ID, failing to scope the lookup to the auth...

CVE-2026-105695 Penpot: Missing authorization in chunked-upload assembly lets another authenticated user consume a victim's upload session

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, assemble-chunks retrieves an upload session using only its session ID, while upload-chunk correctly scopes the lookup to the authenticated profile. An authenticated user who obtains another user's live, completed...