CVE-2026-77365 Optimole <= 4.2.10 - Unauthenticated Stored Cross-Site Scripting via 'a' (above_fold_images) Parameter

The Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'a' abovefoldimages parameter in all versions up to, and including, 4.2.10 due to insufficient input sanitization and output...

CVE-2026-77365

The Optimole image optimization plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) via the 'a' (above_fold_images ) parameter in all versions up to and including 4.2.10 . The root cause is insufficient input sanitization and output escaping , allowing unauthenticated attacker...

CVE-2026-76053 TranslatePress <= 3.3.3 - Unauthenticated Stored Cross-Site Scripting via Comment Noise-Key Injection into HTML Parser

The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Noise-Key Injection into HTML Parser in all versions up to, and including, 3.3.3 due to insufficient input sanitization and output escaping. This mak...

EUVD-2026-67397

The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Noise-Key Injection into HTML Parser in all versions up to, and including, 3.3.3 due to insufficient input sanitization and output escaping. This mak...

CVE-2026-76053

TranslatePress – Translate Multilingual sites with AI Translation (WordPress plugin) is vulnerable to Stored Cross-Site Scripting in all versions up to and including 3.3.3 . The root cause is insufficient input sanitization and output escaping in the plugin's HTML parser: WordPress's comment KSES...

CVE-2026-77365 Optimole <= 4.2.10 - Unauthenticated Stored Cross-Site Scripting via 'a' (above_fold_images) Parameter

The Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'a' abovefoldimages parameter in all versions up to, and including, 4.2.10 due to insufficient input sanitization and output...

EUVD-2026-67398

The Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'a' abovefoldimages parameter in all versions up to, and including, 4.2.10 due to insufficient input sanitization and output...

PANIX

PANIX - Persistência Contra NIX O PANIX é um framework de persistência Linux poderoso, modular e altamente personalizável, projetado para pesquisadores de segurança, engenheiros de detecção, testadores de penetração, entusiastas de CTF e muito mais. Construído com versatilidade em mente, o PANIX...

CVE-2026-78615

A Reflected Cross-Site Scripting XSS vulnerability in WatchGuard Dimension's report detail page allows an attacker to execute arbitrary JavaScript in a authenticated user's browser with a specially crafted URL...

CVE-2026-78610

WatchGuard Dimension's Web UI exposes an administrator passphrase change action that lacks CSRF protection. An attacker who can induce an authenticated global administrator's browser to visit a crafted link or page can change that administrator's passphrase to an attacker-chosen value without the...

DEBIAN-CVE-2026-38822

In openNDS before 11.0.0, the clientparams.sh script, invoked by the openNDS daemon to serve the authenticated client status page, is vulnerable to OS command injection through crafted HTTP GET query parameter keys. An authenticated captive portal user can inject arbitrary shell commands by...

CVE-2026-38822

In openNDS before 11.0.0, the clientparams.sh script, invoked by the openNDS daemon to serve the authenticated client status page, is vulnerable to OS command injection through crafted HTTP GET query parameter keys. An authenticated captive portal user can inject arbitrary shell commands by...

CVE-2022-0847-L-nux-PrivEsc

CVE-2022-0847 Descrizione - POC per CVE-2022-0847: Vulnerabilità di escalation locale dei privilegi del kernel Linux. - creato da antx il 2022-03-08. Dettagli - Il ricercatore di sicurezza Max Kellermann ha divulgato in modo responsabile la vulnerabilità 'Dirty Pipe' e ha dichiarato che colpisce...

CVE-2018-7600.

IGLOO Corp, Won Chi Hyun Rapporto di analisi della RCE di Drupal RCE di Drupal CVE-2018-7600 Non dimenticare di inserire il tuo indirizzo nello script! Descrizione: Esiste una vulnerabilità di esecuzione remota del codice in diversi sottosistemi di Drupal 7.x e 8.x. Ciò consente potenzialmente ag...

WBCE-CMS-Stored-XSS---Pages-Menu

WBCE CMS Stored XSS v1.6.1 Autore: Sergio Descrizione: WBCE CMS 1.6.1 è affetto da una vulnerabilità di Cross-Site Scripting XSS persistente che consente agli attaccanti di eseguire codice arbitrario tramite un payload inserito nel parametro Intro Page del menu Pages. Il payload viene eseguito...

CVE-2025-30144

Summary La libreria fast-jwt non valida correttamente il claim iss in base alla RFC https://datatracker.ietf.org/doc/html/rfc7519page-9. Details La validazione del claim iss issuer all'interno della libreria fast-jwt consente un array di stringhe come valore iss valido. Questa lacuna progettuale...

CVE-2022-3546

CVE-2022-3546 https://vulners.com/cve/CVE-2022-3546 Una vulnerabilità è stata trovata in SourceCodester Simple Cold Storage Management System 1.0 e classificata come problematica. Interessata da questo problema è una funzionalità sconosciuta del file /csms/admin/?page=user/list del componente...

CVE-2017-13253

CVE-2017-13253 كود PoC لثغرة CVE-2017-13253. الشرح الكامل متاح هنا. لاحظ أن الأرقام مختلفة قليلاً عن مقال المدونة، حيث وجدت أن هناك فرصة أكبر لحدوث انهيار crash مع كومة بحجم 0x2000 بالطبع إذا قمت بتشغيله مرات كافية فسوف ينهار على أي حال. لأي أسئلة/مشاكل/تعليقات، يمكنك التواصل معي على تويتر...

EUVD-2026-67284

The Ebyte device does not adequately verify the origin or authenticity of requests submitted to the web management interface. An unauthenticated remote attacker could persuade an authenticated administrator to visit a crafted page, causing unauthorized configuration changes or a disruption of...

EUVD-2026-67306

Out of bounds read in V8 in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: Medium...