Exploit for CVE-2026-13233

/ URLs remain to be filled. It still ships a SAFE reproducer o...

Multiple vulnerabilities impact AIX due to OpenSSL

IBM SECURITY ADVISORY First Issued: Tue Jul 21 07:48:54 CDT 2026 The most recent version of this document is available here: https://aix.software.ibm.com/aix/efixes/security/openssladvisory48.asc Security Bulletin: Multiple vulnerabilities impact AIX due to OpenSSL...

Security Bulletin: Multiple vulnerabilities in IBM WebSphere Application Server, which impacts IBM Tivoli Netcool Configuration Manager

Summary IBM WebSphere Application Server is a required product for IBM Tivoli Netcool Configuration Manager version 6.4.2. Multiple vulnerabilities were addressed in IBM WebSphere Application Server. Vulnerability Details CVEID:CVE-2026-50645 DESCRIPTION: There is no restriction on the amount of...

Rockwell Automation FactoryTalk Services Platform

ADVISORY SUMMARY Successful exploitation of this vulnerability could allow an attacker to impersonate an authorized user on the FTSP server, resulting in unauthorized access to system configurations. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the risk of...

Security Bulletin: IBM Sterling Connect:Direct Web Services is Affected by Multiple Vulnerabilities.

Summary postgresql-42.7.11.jar is used by IBM Sterling Connect:Direct Web Services CVE-2026-54291. Vulnerability Details CVEID:CVE-2026-54291 DESCRIPTION: pgjdbc is an open source postgresql JDBC Driver. In releases 42.7.4 through 42.7.11, channelBinding=require connections can be silently...

Security Bulletin: IBM Sterling Connect:Direct Web Services is Affected by Multiple Vulnerabilities.

Summary spring-web-7.0.7.jar is used by IBM Sterling Connect:Direct Web Services CVE-2026-41839, CVE-2026-41840, CVE-2026-41845, CVE-2026-41853, CVE-2026-41854. Vulnerability Details CVEID:CVE-2026-41839 DESCRIPTION: A WebFlux application with a compromised subdomain for example, compromised via...

Security Bulletin: SPSS Collaboration and Deployment Services is affected by multiple vulnerabilities in form-data and DOMPurify

Summary SPSS Collaboration and Deployment Services is affected by multiple vulnerabilities in form-data and DOMPurify. This has been addressed in the remediation section. Vulnerability Details CVEID:CVE-2026-12143 DESCRIPTION: form-data is a library for creating readable multipart/form-data...

wp-ssrf-cloud-metadata

WordPress Core SSRF via Cloud Metadata Endpoint Bypass in wp...

K000162353: Apache Tomcat vulnerabilities CVE-2026-59083 and CVE-2026-59084

Security Advisory Description CVE-2026-59083 Improper Handling of URL Encoding Hex Encoding vulnerability in Apache Tomcat's rewrite valve allowed security constraint bypass for some configurations. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.23, from 10.1.0-M1 through 10.1.56,...

K000162352: Lodash vulnerability CVE-2026-4800

Security Advisory Description Impact: The fix for CVE-2021-23337 https://github.com/advisories/GHSA-35jh-r3h4-6jhm added validation for the variable option in .template but did not apply the same validation to options.imports key names. Both paths flow into the same Function constructor sink. Whe...

Security Bulletin: Multiple vulnerabilities in IBM Controller

Summary Multiple vulnerabilities were addressed in IBM Controller. Vulnerability Details CVEID:CVE-2025-68161 DESCRIPTION: The Socket Appender in Apache Log4j Core versions 2.0-beta9 through 2.25.2 does not perform TLS hostname verification of the peer certificate, even when the verifyHostName...

Exploit for Stack-based Buffer Overflow in Microsoft

CVE-2026-41089-Netlogon-RCE Technical analysis and Proof-of-Co...

EulerOS Virtualization 2.12.0 : openssh (EulerOS-SA-2026-2790)

According to the versions of the openssh packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : In OpenSSH before 10.3, a file downloaded by scp may be installed setuid or setgid, an outcome contrary to some users' expectation...

📄 WordPress Ajax Filter Posts (GridMaster) 3.4.11 Unauthenticated Local File Inclusion / Code Execution

WordPress Ajax Filter Posts GridMaster plugin version 3.4.11 contains an unauthenticated local file inclusion to remote code execution vulnerability. A remote attacker can traverse the filesystem and include attacker-controlled PHP code, resulting in remote code execution when a suitable file is...

EulerOS Virtualization 2.10.0 : openssl (EulerOS-SA-2026-2863)

According to the versions of the openssl packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : Issue summary: When a delta CRL that contains a Delta CRL Indicator extension is processed a NULL pointer dereference might happen...

EulerOS Virtualization 2.10.0 : openssh (EulerOS-SA-2026-2862)

According to the versions of the openssh packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : OpenSSH before 10.3 omits connection multiplexing confirmation for proxy-mode multiplexing sessions.CVE-2026-35388 In OpenSSH befo...

EulerOS Virtualization 2.12.0 : openssl (EulerOS-SA-2026-2791)

According to the versions of the openssl packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : Issue summary: When a delta CRL that contains a Delta CRL Indicator extension is processed a NULL pointer dereference might happen...

📄 WordPress Quotes llama 3.1.4 Unauthenticated Blind SQL Injection

WordPress Quotes llama plugin version 3.1.4 contains an unauthenticated time-based blind SQL injection vulnerability through selectsearch. A remote attacker can inject SQL through the vulnerable parameter and infer database contents through response timing. This proof of concept exploit...

📄 WordPress JSON API User 3.9.2 Unauthenticated Privilege Escalation

WordPress JSON API User plugin version 3.9.2 contains an unauthenticated privilege escalation to administrator vulnerability through Mass-Assignment. A remote attacker can elevate privileges to the administrator role and take control of the affected site. This proof of concept exploit demonstrate...

PT-2026-62120

Two undocumented privileged accounts exist in Autel Maxi Charger Single firmware through V1.03.51. The accounts use vendor-defined password derivation mechanisms based on device-specific values, allowing an attacker with knowledge of the algorithm and required inputs to authenticate to the web...