domdig

DOMDig DOMDig is a DOM XSS scanner that runs inside the Chromium web browser and it can scan single page applications SPA recursively. Unlike other scanners, DOMDig can crawl any webapplication including gmail by keeping track of DOM modifications and XHR/fetch/websocket requests and it can...

CVE-2026-116165

Parse Server versions before 8.6.101 and 9.0.0 before 9.10.4-alpha.4 are vulnerable to a missing authorization flaw on MongoDB deployments. This allows unauthenticated attackers to send REST API delete requests targeting the internal _SCHEMA collection. Successful exploitation enables the deletio...

Flipper

Playground and dump of stuff I made, modified, researched, or found for the Flipper Zero. Looking for Infrared IR codes? Head over tothe IRDB! Just want to download part of any repo? Try over here! If you're new to github in general, check out this great guide from Wr3nch! Other great spots for...

CVE-2026-101773

A flaw was found in the MySQL Group Replication plugin. An unauthenticated attacker located on the adjacent network can exploit this vulnerability to compromise the database service. Successful exploitation primarily allows an attacker to cause a Denial of Service DoS by hanging or repeatedly...

CVE-2026-95718

An authentication bypass vulnerability in the PAPI protocol of AOS-8 could allow an unauthenticated remote attacker to circumvent existing authentication controls. Successful exploitation could allow an attacker to make limited unauthorized modifications to certain settings of the affected system...

CVE-2026-97801

A flaw was found in .NET Framework. An unauthenticated remote attacker could exploit improper input validation by sending specially crafted input over the network. Successful exploitation allows an attacker to tamper with application data and make unauthorized modifications to the system state...

CVE-2026-95718

CVE-2026-95718 identifies an Authentication Bypass Vulnerability within the PAPI Protocol of AOS-8 . While the provided documents do not specify the underlying root cause, the vulnerability allows for unauthorized access. Technical details regarding specific versions, impacted components, and rem...

CVE-2026-91333

A flaw was found in the Security component of Oracle Java SE. An unauthenticated remote attacker with network access could exploit this flaw by supplying crafted input to exposed application programming interfaces APIs or by executing untrusted code within sandboxed environments. A successful...

CVE-2026-79983

A flaw was found in the Apache Camel FTP component. Remote-file consumers fail to validate directory listing entries received from remote servers, which allows path traversal outside the configured target directory. A compromised server or network attacker modifying server responses can supply...

CVE-2026-93315

A flaw was found in BuildKit. When proxy networking with Certificate Authority CA injection is enabled, a build can modify its CA certificate bundle before cleanup operations execute. A local user running a build can exploit this issue to cause the cleanup process to hang, resulting in a Denial o...

CVE-2026-108597

A flaw was found in cohere. An attacker with write permissions to an associated Amazon Simple Storage Service S3 bucket can supply a specially crafted model archive containing directory traversal sequences. When the application extracts the archive without validating member file paths, arbitrary...

CVE-2026-90263

A flaw was found in the Linux kernel's btrfs filesystem. A local user could bypass the intended read-only protection by setting a POSIX Access Control List ACL on a btrfs filesystem configured as read-only. This vulnerability occurs because the setacl code path fails to properly check the...

CVE-2019-25777

A flaw was found in perl-yaml. This vulnerability can lead to arbitrary code execution because the parser fails to restrict package variable modifications specified in YAML documents. An attacker capable of submitting crafted YAML input can overwrite internal configuration settings to enable code...

Versal Adaptive SoC – Secure Boot Bypass via Board Modifications and Crafted Boot Image

CVE Details Refer to Glossary for explanation of terms CVE| CVE Description| CVSS Base Score ---|---|--- CVE-2026-0482| In AMD Versal™ Adaptive SoC devices, insufficient boundary checks within the USB boot mode—when enabled via board modifications—allow crafted images to overflow a buffer and...

PT-2026-97785

Name of the Vulnerable Software and Affected Versions MailerLite – Signup forms official plugin for WordPress versions prior to 1.7.22 Description An issue exists where a missing capability check in the forms method of the AdminController class allows authenticated users with Contributor-level...

Versal Adaptive SoC – Secure Boot Bypass via Board Modifications and Crafted Boot Image

CVE Details Refer to Glossary for explanation of terms CVE| CVE Description| CVSS Base Score ---|---|--- CVE-2026-0482| In AMD Versal™ Adaptive SoC devices, insufficient boundary checks within the USB boot mode—when enabled via board modifications—allow crafted images to overflow a buffer and...

CVE-2026-90903 Joomla Extension - joomshaper.com - Missing CSRF Token Verification across Administrator AJAX API Endpoints in Easy Store extension 1.0.0-3.0.0

Joomla Extension - joomshaper.com - Missing CSRF Token Verification across Administrator AJAX API Endpoints in Easy Store extension 1.0.0-3.0.0 - The administrator ApiController only validated CSRF tokens inside the products action. All other administrative AJAX endpoints orders, coupons, media,...

EUVD-2026-85558

Joomla Extension - joomshaper.com - Missing CSRF Token Verification across Administrator AJAX API Endpoints in Easy Store extension 1.0.0-3.0.0 - The administrator ApiController only validated CSRF tokens inside the products action. All other administrative AJAX endpoints orders, coupons, media,...

CVE-2026-90903 Joomla Extension - joomshaper.com - Missing CSRF Token Verification across Administrator AJAX API Endpoints in Easy Store extension 1.0.0-3.0.0

Joomla Extension - joomshaper.com - Missing CSRF Token Verification across Administrator AJAX API Endpoints in Easy Store extension 1.0.0-3.0.0 - The administrator ApiController only validated CSRF tokens inside the products action. All other administrative AJAX endpoints orders, coupons, media,...

CVE-2026-93987

A flaw was found in rclone. The rclone serve docker volume plugin contains a path traversal vulnerability. A highly privileged attacker, by submitting a crafted Docker VolumeDriver.Create request with a malicious volume name, can cause the rclone plugin process to create a directory and mount a...