486797 matches found
CVE-2026-2796-and-CVE-2026-2768-escape-the-wasm-box
CVE-2026-2796 + CVE-2026-2768 — Escape the Wasm Box Full-chain Firefox exploitation research: a WebAssembly type confusion for renderer code execution , chained toward a parent-process bug for a sandbox escape. Both bugs were fixed in Firefox 148 MFSA-2026-13; the target here is a Firefox...
CVE-2025-24813_presentation
This is a Next.js project bootstrapped with create-next-app. Getting Started First, run the development server: root@kitploit: npm run dev or yarn dev or pnpm dev or bun dev Open http://localhost:3000 with your browser to see the result. You can start editing the page by modifying app/page.tsx. T...
CVE-2025-55885
CVE-2025-55885 Description SQL Injection vulnerability in Alpes Recherche et Developpement ARD GEC en Ligne before v.2025-04-23 allows a remote attacker to escalate privileges via the GET parameters in index.php Attack Vectors SQL injection via unsanitized GET parameter ocid on...
CVE-2026-43494-PinTheft-PoC
SLEY — PinTheft PoC CVE-2026-43494 Proof of concept — uid=1000raken → uid=0root after ./sley on WSL2 6.6.87.2-microsoft-standard-WSL2 Single-file proof-of-concept for CVE-2026-43494 PinTheft: a Linux kernel local privilege escalation that chains an RDS zerocopy reference-count bug with iouring...
N-able Issues Fourth N-central Hotfix in Five Weeks for Unauthenticated RCE Flaw
Every on-premises N-central build below 2026.3.1.14 — including servers updated to Hotfix 3 a day earlier — needs Hotfix 4. N-able's incident notice says the flaw has been exploited in the wild; its release notes say that is unconfirmed. N-able has released its fourth hotfix in five weeks for the...
xalgorix v4.6.72
Xalgorix — Open-source AI pentester that proves vulnerabilities Most scanners detect. Xalgorix proves. An autonomous LLM agent works a full pentest methodology, then an independent verifier re-exploits every finding before it's reported — so you get proof, not a pile of maybes to triage...
CVE-2026-14296
When using the Direct XIP update strategy, the main application image starts other cores i.e. radio core, based on the currently active slot without additional verification. The MCUboot in the bare upstream configuration assumes that if there is at least a single slot for each image available, th...
CVE-2026-18366
CVE-2026-18366 — Events Manager 7.4.1: Unauthenticated Privilege Escalation to Administrator | ---|--- Product| Events Manager WordPress plugin Affected versions| 7.1.0 – 7.4.0.x Fixed version| 7.4.1 Weakness| CWE-269: Improper Privilege Management Severity| CVSS 3.1: 9.8 Critical —...
EUVD-2026-72300
Any application that uses external QSPI flash for encrypted XIP on nRF5340 and relies on that encryption for confidentiality and/or integrity of the externally stored code. No specific nRF Connect SDK version is the root cause; the weakness is in the on-the-fly decryption scheme...
CVE-2026-18796 QSPI flash encryption side-channel leakage
Any application that uses external QSPI flash for encrypted XIP on nRF5340 and relies on that encryption for confidentiality and/or integrity of the externally stored code. No specific nRF Connect SDK version is the root cause; the weakness is in the on-the-fly decryption scheme...
CVE-2026-18796 QSPI flash encryption side-channel leakage
Any application that uses external QSPI flash for encrypted XIP on nRF5340 and relies on that encryption for confidentiality and/or integrity of the externally stored code. No specific nRF Connect SDK version is the root cause; the weakness is in the on-the-fly decryption scheme...
CVE-2026-18796
CVE-2026-18796 affects the nRF5340 (Nordic Semiconductor) when using external QSPI flash for encrypted XIP (eXecute In Place). The weakness lies in the on-the-fly decryption scheme , not in any specific nRF Connect SDK version, making it a side-channel leakage vulnerability. An attacker with phys...
CVE-2026-14297 The Continuous Glucose Monitoring Service's Record Access Control Point (RACP) write handler `memcpy`s the entire attacker-supplied ATT write value into a fixed 20-byte BSS buffer.
A buffer overflow in the Bluetooth Continuous Glucose Monitoring Service CGMS Record Access Control Point RACP write handler allows an authenticated BLE peer to overflow a 20-byte static buffer into adjacent BSS memory. The exploitable impact cannot be predetermined - it is entirely dependent on...
CVE-2026-14297 The Continuous Glucose Monitoring Service's Record Access Control Point (RACP) write handler `memcpy`s the entire attacker-supplied ATT write value into a fixed 20-byte BSS buffer.
A buffer overflow in the Bluetooth Continuous Glucose Monitoring Service CGMS Record Access Control Point RACP write handler allows an authenticated BLE peer to overflow a 20-byte static buffer into adjacent BSS memory. The exploitable impact cannot be predetermined - it is entirely dependent on...
EUVD-2026-72299
A buffer overflow in the Bluetooth Continuous Glucose Monitoring Service CGMS Record Access Control Point RACP write handler allows an authenticated BLE peer to overflow a 20-byte static buffer into adjacent BSS memory. The exploitable impact cannot be predetermined - it is entirely dependent on...
CVE-2026-14297
CVE-2026-14297 is a buffer overflow in the Bluetooth Continuous Glucose Monitoring Service (CGMS) Record Access Control Point (RACP) write handler of Nordic Semiconductor Struct SA . The vulnerable code memcpys the entire attacker-supplied ATT write value into a fixed 20-byte static BSS buffer , ...
CVE-2026-14296 nRF54H20: MCUBoot can be tricked to executing unauthenticated code
When using the Direct XIP update strategy, the main application image starts other cores i.e. radio core, based on the currently active slot without additional verification. The MCUboot in the bare upstream configuration assumes that if there is at least a single slot for each image available, th...
CVE-2026-14296 nRF54H20: MCUBoot can be tricked to executing unauthenticated code
When using the Direct XIP update strategy, the main application image starts other cores i.e. radio core, based on the currently active slot without additional verification. The MCUboot in the bare upstream configuration assumes that if there is at least a single slot for each image available, th...
EUVD-2026-72297
When using the Direct XIP update strategy, the main application image starts other cores i.e. radio core, based on the currently active slot without additional verification. The MCUboot in the bare upstream configuration assumes that if there is at least a single slot for each image available, th...
CVE-2026-14296
CVE-2026-14296 affects MCUBoot in its bare (upstream) configuration on the nRF54H20 SoC. When using the Direct XIP update strategy, the main application image can start other cores (e.g., the radio core) by providing an address from an unauthenticated slot, because MCUboot may select different sl...