CVE-2026-77754

The Kirki WordPress plugin prior to version 6.0.14 is missing a capability check on some endpoints of the kirki_get_apis public AJAX action. This allows unauthenticated users to retrieve the email addresses of registered users and comment authors, as well as non-public page content and site setti...

Important: Red Hat Security Advisory: kernel security, bug fix, and enhancement update

An update for kernel is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

kernel: nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page

A flaw was found in the Linux kernel's nvmet subsystem. An unauthenticated remote attacker could exploit an out-of-bounds heap read vulnerability in the Discovery Get Log Page function. By sending a specially crafted request with a manipulated offset, an attacker could read sensitive kernel memor...

CVE-2024-43919

CVE-2024-43919 YARPP = 5.30.10 - अधिकार की कमी विवरण YARPP – Yet Another Related Posts Plugin वर्डप्रेस प्लगइन अनधिकृत पहुँच के प्रति संवेदनशील है, क्योंकि /includes/yarppprosetdisplaytypes.php फ़ाइल में संस्करण 5.30.10 तक के सभी संस्करणों में क्षमता जाँच capability check गायब है। इससे अनप्रमाणित...

CVE-2022-0739

CVE-2022-0739 CVE-2022-0739 के लिए Python PoC एक्सप्लॉइट CVE-2022-0739 विशेषताएँ डेटाबेस मेटाडेटा लुकअप वर्डप्रेस उपयोगकर्ता क्रेडेंशियल डंप मनमाना ब्लाइंड क्वेरी इंजेक्शन 💉 उपयोग root@kitploit: usage: cve-2022-0739 -h -u URL -e EXEC options: -h, --help show this help message and exit -u URL, --u...

bluemonday

bluemonday bluemonday is a HTML sanitizer implemented in Go. It is fast and highly configurable. bluemonday takes untrusted user generated content as an input, and will return HTML that has been sanitised against an allowlist of approved HTML elements and attributes so that you can safely include...

payloads

payloads Git All the Payloads! A collection of web attack payloads. Pull requests are welcome! Usage run ./get.sh to download external payloads and unzip any payload files that are compressed. Payload Credits fuzzdb - https://github.com/fuzzdb-project/fuzzdb SecLists -...

Fake Apple Support AI Calls Target Stolen-Device Owners for Passcodes and 2FA Codes

Cybersecurity researchers have disclosed details of a phishing-as-a-service PhaaS platform built to strip Apple's Activation Lock from stolen devices, using rented AI voice agents that call theft victims posing as Apple Support and ask for their device passcode. SOCRadar Threat Research Unit STRU...

CVE-2026-58094 TOCTOU race in POSIX shared memory large page configuration

The FIOSSHMLPGCNF ioctl2 operation configures the page size for a largepage shared memory object. This is intended to be used immediately after creating the object, before any memory is allocated for the object. The handler checked whether a page size had already been configured without holding t...

CVE-2026-58094 TOCTOU race in POSIX shared memory large page configuration

The FIOSSHMLPGCNF ioctl2 operation configures the page size for a largepage shared memory object. This is intended to be used immediately after creating the object, before any memory is allocated for the object. The handler checked whether a page size had already been configured without holding t...

EUVD-2026-66253

The FIOSSHMLPGCNF ioctl2 operation configures the page size for a largepage shared memory object. This is intended to be used immediately after creating the object, before any memory is allocated for the object. The handler checked whether a page size had already been configured without holding t...

CVE-2026-58094

FreeBSD is affected by a TOCTOU race condition in the posixshm module, specifically in the FIOSSHMLPGCNF ioctl(2) handler, which checks whether a largepage shared memory object's page size has been configured without holding the rangelock. Two concurrent unprivileged callers can both observe an u...

CVE-2026-19760 WP Fastest Cache <= 1.5.0 - Unauthenticated Stored Cross-Site Scripting via HTTP Host Header

The WP Fastest Cache – WordPress Cache Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via HTTP Host Header in all versions up to, and including, 1.5.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inje...

EUVD-2026-66249

The WP Fastest Cache – WordPress Cache Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via HTTP Host Header in all versions up to, and including, 1.5.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inje...

CVE-2026-19760

The WP Fastest Cache WordPress plugin (all versions up to and including 1.5.0) is vulnerable to unauthenticated stored cross-site scripting via the HTTP Host header. Insufficient input sanitization and output escaping in the Host-header-to-URL code path allows an attacker to inject arbitrary scri...

CVE-2026-19760 WP Fastest Cache <= 1.5.0 - Unauthenticated Stored Cross-Site Scripting via HTTP Host Header

The WP Fastest Cache – WordPress Cache Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via HTTP Host Header in all versions up to, and including, 1.5.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inje...

CVE-2026-80191

GROWI applies its page-viewer permission check to attachment requests only when the request carries an authenticated user. retrieveAttachmentFromIdParam in apps/app/src/server/routes/attachment/get.ts guards the check with a condition requiring the user to be non-null, so a request that carries n...

mini-diarium v0.7.0

Mini Diarium A local-only journal with serious encryption. Free, open source, and never touches the internet. !Microsoft Storehttps://img.shields.io/badge/Microso...

kernel: nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page

A flaw was found in the Linux kernel's nvmet subsystem. An unauthenticated remote attacker could exploit an out-of-bounds heap read vulnerability in the Discovery Get Log Page function. By sending a specially crafted request with a manipulated offset, an attacker could read sensitive kernel memor...

Important: Red Hat Security Advisory: kernel-rt security, bug fix, and enhancement update

An update for kernel-rt is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from...