fuzztruction

Fuzztruction Fuzztruction es un prototipo académico de un fuzzer que no muta entradas directamente como la mayoría de los fuzzers sino que utiliza una aplicación llamada generadora para producir una entrada para nuestro objetivo de fuzzing. Como los programas que generan datos suelen producir la...

altdns

Altdns - Descubrimiento de subdominios mediante alteraciones y permutaciones Altdns es una herramienta de reconocimiento DNS que permite el descubrimiento de subdominios que siguen patrones. Altdns recibe palabras que podrían estar presentes en subdominios bajo un dominio como test, dev, staging...

CVE-2026-108742: Missing Authorization

CloudBeaver through 25.3.5 contains a missing authorization vulnerability in the initConnection GraphQL mutation that lets view-only shared-project members persist credentials without datasource-edit permission. Attackers can set saveCredentials and sharedCredentials flags with chosen...

PT-2026-110145

🚨 CVE-2026-108742 CloudBeaver through 25.3.5 contains a missing authorization vulnerability in the initConnection GraphQL mutation that lets view-only shared-project members persist credentials without datasource-edit permission. Attackers can set saveCredentials and sharedCredentials flags with...

CVE-2026-6243

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via kses bypass / mutation XSS in all versions up to, and including, 3.28.36. This is due to the 'getdynamicvalues' function performing text-level find-and-replace operations on post content without...

EUVD-2026-96213

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via kses bypass / mutation XSS in all versions up to, and including, 3.28.36. This is due to the 'getdynamicvalues' function performing text-level find-and-replace operations on post content without...

CVE-2026-6243 Frontend Admin by DynamiApps <= 3.28.36 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Content

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via kses bypass / mutation XSS in all versions up to, and including, 3.28.36. This is due to the 'getdynamicvalues' function performing text-level find-and-replace operations on post content without...

CVE-2026-6243

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 3.28.36 . The root cause is the get_dynamic_values function, which performs text-level find-and-replace operations on post content without utilizing HTML-aw...

CVE-2026-6243: Improper Neutralization of Input During Web Page Generation

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via kses bypass / mutation XSS in all versions up to, and including, 3.28.36. This is due to the 'getdynamicvalues' function performing text-level find-and-replace operations on post content without...

CVE-2026-107813

Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, the api/cluster router exposes node and namespace mutation operations and cluster-wide Nginx reload or restart operations with AuthRequired but without RequireSecureSession. An authenticated OTP-enabled user...

CVE-2026-104083 SmarterMail < Build 9777 Stored Mutation XSS via MathML Foreign Content

SmarterMail before build 9777 contains a stored mutation cross-site scripting vulnerability that allows remote attackers to inject executable script by placing payloads inside a element nested within MathML foreign content , which the custom HTML sanitizer treats as inert CDATA text but browsers...

CVE-2026-104083

SmarterMail versions before build 9777 are vulnerable to a stored mutation cross-site scripting (XSS) vulnerability. The root cause lies in a custom HTML sanitizer that incorrectly treats a element nested within MathML foreign content (specifically ) as inert CDATA text, while browsers reparse i...

EUVD-2026-44644

PraisonAI: Platform members can rewrite shared labels and owner issue labels without owner/admin authorization...

Modification of Assumed-Immutable Data (MAID)

Overview msgpack5 is an A msgpack v5 implementation for node.js and the browser, with extension points Affected versions of this package are vulnerable to Modification of Assumed-Immutable Data MAID via the readInt64BE function in lib/decoder.js, which mutates the input buffer in-place when...

CVE-2026-107296 msgpack5: Decoding negative int64 values mutates the input buffer

msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, decoding a negative signed 64-bit integer modifies the corresponding bytes in the caller-provided input buffer while computing the value. Applications that retain or reuse encoded input for integrity checks,...

CVE-2026-107296 msgpack5: Decoding negative int64 values mutates the input buffer

msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, decoding a negative signed 64-bit integer modifies the corresponding bytes in the caller-provided input buffer while computing the value. Applications that retain or reuse encoded input for integrity checks,...

NPM: vm2: Default VM can mutate host TypedArray and ArrayBuffer intrinsics after the host-prototype pollution fix

NPM: vm2: Default VM can mutate host TypedArray and ArrayBuffer intrinsics after the host-prototype pollution fix vulnerability discovered by ? in WordPress Npm vm2 versions = 3.11.0, = 3.11.7...

EUVD-2026-81602

vm2: Default VM can mutate host TypedArray and ArrayBuffer intrinsics after the host-prototype pollution fix...

vm2: Default VM can mutate host TypedArray and ArrayBuffer intrinsics after the host-prototype pollution fix

Summary vm2's current host-intrinsic prototype protection is incomplete. The fix for GHSA-vwrp-x96c-mhwq blocks sandbox writes into classic host intrinsics such as Object.prototype, Array.prototype, and Function.prototype, but current head still lets sandbox code in a default VM reach and mutate...

CVE-2026-105632

Plane is an open-source project management tool. Prior to 1.4.0, the GraphQL joinProject mutation lets any workspace member add themselves to any project in that workspace including network=0 secret/private projects they were never invited to and grants them a full Member role read + write. The...