41813 matches found
CVE-2026-93624
The Music Player for WooCommerce plugin for WordPress (versions
CVE-2026-92953
A flaw was found in vm2. The sandbox fails to properly isolate host object structures from untrusted code running inside the virtual machine. An attacker can exploit this issue by manipulating object prototype chains to modify shared host prototypes, resulting in prototype pollution the...
CVE-2026-103237 MISP: Nested Model Alias Key Bypasses Sanitization to Modify Cross-Tenant Rows
MISP contains an improper input validation vulnerability in its ORM save path. When a user submits data through various endpoints attribute add/edit, event edit, free-text import, sighting capture, shadow attribute proposal, event report creation, object reference add, user admin edit, the...
CVE-2026-103237 MISP: Nested Model Alias Key Bypasses Sanitization to Modify Cross-Tenant Rows
MISP contains an improper input validation vulnerability in its ORM save path. When a user submits data through various endpoints attribute add/edit, event edit, free-text import, sighting capture, shadow attribute proposal, event report creation, object reference add, user admin edit, the...
cve-2019-5420-POC
Rails ActiveSupport Exploit cve-2019-5420 POC consider this to chain CVE-2019-5418! Pairs lovely with CVE-2019-5418! POC Screenshot 🚨 Warning This repository contains a proof-of-concept PoC exploit demonstrating remote code execution RCE in Ruby on Rails applications via...
Security update for python-PyYAML
This update for python-PyYAML fixes the following issues: Update to 5.3.1. CVE-2020-14343: A vulnerability was discovered in the PyYAML library, where it was susceptible to arbitrary code execution when it processes untrusted YAML files through the fullload method or with the FullLoader loader...
SUSE-SU-2026:4402-1 Security update for python-PyYAML
This update for python-PyYAML fixes the following issues: - Update to 5.3.1. - CVE-2020-14343: A vulnerability was discovered in the PyYAML library, where it was susceptible to arbitrary code execution when it processes untrusted YAML files through the fullload method or with the FullLoader loade...
Exploit-CVE-2025-68613
Эксплойт-CVE-2025-68613 Оповещение безопасности: Критическая уязвимость удаленного выполнения кода в n8n CVE-2025-68613 В средстве автоматизации рабочих процессов n8n обнаружена критическая уязвимость, позволяющая выполнять произвольный код. Аутентифицированные пользователи с разрешениями на...
oss
oss 中文 | English A cross-cloud object storage CLI based on the S3 protocol. One binary for all major providers: AWS S3, Aliyun OSS, Tencent COS, Huawei OBS, Baidu BOS, Kingsoft KS3, UCloud US3, JD Cloud OSS, Google Cloud Storage, Cloudflare R2, Scaleway, Wasabi, DigitalOcean Spaces, Yandex,...
CVE-2026-91051
The EWWW Image Optimizer WordPress plugin before 8.8.0 does not prevent authenticated users with author-level permissions from storing a serialized value in a post meta field that is deserialized when the post is rendered, allowing them to perform PHP Object Injection, which can lead to remote co...
EUVD-2026-89618
The EWWW Image Optimizer WordPress plugin before 8.8.0 does not prevent authenticated users with author-level permissions from storing a serialized value in a post meta field that is deserialized when the post is rendered, allowing them to perform PHP Object Injection, which can lead to remote co...
CVE-2026-91051 EWWW Image Optimizer 8.6.0 - 8.7.7 - Author+ PHP Object Injection via 'eio_page_settings' Post Meta
The EWWW Image Optimizer WordPress plugin before 8.8.0 does not prevent authenticated users with author-level permissions from storing a serialized value in a post meta field that is deserialized when the post is rendered, allowing them to perform PHP Object Injection, which can lead to remote co...
CVE-2026-91051
The EWWW Image Optimizer WordPress plugin versions before 8.8.0 (specifically versions 8.6.0 - 8.7.7 ) is vulnerable to PHP Object Injection . Authenticated users with author-level permissions can store a serialized value in a post meta field (specifically 'eio_page_settings' ). When the post is ...
CVE-2026-91051 EWWW Image Optimizer 8.6.0 - 8.7.7 - Author+ PHP Object Injection via 'eio_page_settings' Post Meta
The EWWW Image Optimizer WordPress plugin before 8.8.0 does not prevent authenticated users with author-level permissions from storing a serialized value in a post meta field that is deserialized when the post is rendered, allowing them to perform PHP Object Injection, which can lead to remote co...
CVE-2019-13272
CVE-2019-13272 Linux local root exploit Linux 4.10 5.1.17 PTRACETRACEME local root CVE-2019-13272 In the Linux kernel before 5.1.17, ptracelink in kernel/ptrace.c mishandles the recording of the credentials of a process that wants to create a ptrace relationship, which allows local users to obtai...
com.mchange/mchange-commons-java: mchange-commons-java: Arbitrary code execution via JNDI dereferencing of crafted objects
A flaw was found in mchange-commons-java, a Java utility library. An attacker can exploit this vulnerability by providing a maliciously crafted javax.naming.Reference or serialized object to an application using the library. This can provoke the application to download and execute arbitrary...
PT-2026-103483
Name of the Vulnerable Software and Affected Versions Nested Pages versions prior to 3.3.3 Description Nested Pages is subject to a PHP Object Injection issue. This occurs when untrusted data is passed to the unserialize function, allowing an attacker to inject malicious objects into the...
Exploiting Vulnerabilities: Universal Adversarial Attacks on Vision-Language-Action Models in Robotics
Recently, Vision-Language-Action VLA models have revolutionized robotic manipulation by seamlessly integrating visual perception, language understanding, and action generation in an end-to-end learning framework. However, since these models are designed to interact directly with the physical worl...
CVE-2023-26136
Research on the vulnerability CVE-2023-26136 Description Versions of the package tough-cookie before 4.1.3 are vulnerable to Prototype Pollution due to improper handling of cookies when using CookieJar in rejectPublicSuffixes=false mode. This issue arises from the manner in which objects are...
