CVE-2026-79707

A Path Traversal vulnerability in the builder endpoint of Google Cloud Agent Development Kit (ADK) versions 1.9.0 through 1.21.0 (Python) allows an unauthenticated remote attacker to read arbitrary files by supplying a crafted file_path query parameter. The CVSS 4.0 base score is 8.7 (HIGH) , ref...

Exploit for CVE-2024-36058

CVE-2024-36058 — Koha Library Software CVE ID: CVE-2024-3...

CVE-2026-85533 MISP Sharing Group Authorization Bypass via Omitted Distribution Parameter

An authorization flaw in MISP allowed an authenticated user to submit a sharinggroupid without verifying that the user was authorized to use the referenced Sharing Group. In several attribute and Galaxy Cluster creation and editing workflows, validation of the submitted Sharing Group was performe...

CVE-2026-85533 MISP Sharing Group Authorization Bypass via Omitted Distribution Parameter

An authorization flaw in MISP allowed an authenticated user to submit a sharinggroupid without verifying that the user was authorized to use the referenced Sharing Group. In several attribute and Galaxy Cluster creation and editing workflows, validation of the submitted Sharing Group was performe...

CVE-2026-85533 MISP Sharing Group Authorization Bypass via Omitted Distribution Parameter

An authorization flaw in MISP allowed an authenticated user to submit a sharinggroupid without verifying that the user was authorized to use the referenced Sharing Group. In several attribute and Galaxy Cluster creation and editing workflows, validation of the submitted Sharing Group was performe...

CVE-2026-85533

CVE-2026-85533 is an authorization bypass in MISP (Malware Information Sharing Platform). In attribute attachment/editing and Galaxy Cluster creation/editing workflows, the Sharing Group authorization check was only executed when the distribution field was explicitly set to 4. By omitting or mani...

CVE-2026-82186

The WPLP Cookie Consent WordPress plugin before 4.4.2 does not properly validate a pagination parameter before using it in a SQL query, allowing users with administrator privileges to perform SQL injection attacks...

Basilic diff.php RCE

Exploits command injection in Basilic = 1.5.14 via the file parameter on /Config/diff.php. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """Basilic Config/diff.php command injection RCE — execute session.""" from future import annotations import re from...

VICIdial manager_send.php RCE (CVE-2013-4468)

Exploits CVE-2013-4468 command injection via the extension parameter on /agc/managersend.php. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """VICIdial managersend.php command injection RCE CVE-2013-4468 — execute session.""" from future import annotations import...

Apache Spark doAs Command Injection RCE (CVE-2022-33891)

Exploits CVE-2022-33891 command injection in the Spark ACL check when spark.acls.enable is true. Sends a crafted doAs POST parameter to run arbitrary shell commands as the Spark process user. !/usr/bin/env python3 -- coding: utf-8 -- """Apache Spark doAs command injection RCE CVE-2022-33891 —...

WANem result.php RCE (CVE-2012-10041)

Exploits CVE-2012-10041 command injection in WANem result.php via the pc parameter. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """WANem result.php command injection RCE CVE-2012-10041 — execute session.""" from future import annotations import re from...

EditWrxLite - wrx.cgi RCE

Exploits EditWrxLite command injection via the download parameter of wrx.cgi. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """EditWrxLite wrx.cgi command injection RCE — execute session.""" from future import annotations import re from urllib.parse import quote...

CVE-2026-82186 WPLP Cookie Consent < 4.4.2 - Admin+ SQLi via 'offset' Parameter

The WPLP Cookie Consent WordPress plugin before 4.4.2 does not properly validate a pagination parameter before using it in a SQL query, allowing users with administrator privileges to perform SQL injection attacks...

EUVD-2026-70909

The WPLP Cookie Consent WordPress plugin before 4.4.2 does not properly validate a pagination parameter before using it in a SQL query, allowing users with administrator privileges to perform SQL injection attacks...

CVE-2026-82186

The WPLP Cookie Consent WordPress plugin (specifically versions before 4.4.2 ) is vulnerable to SQL injection due to improper validation of a pagination parameter (the 'offset' parameter) within a SQL query. This flaw allows users with administrator privileges to execute arbitrary SQL commands. S...

CVE-2026-82186 WPLP Cookie Consent < 4.4.2 - Admin+ SQLi via 'offset' Parameter

The WPLP Cookie Consent WordPress plugin before 4.4.2 does not properly validate a pagination parameter before using it in a SQL query, allowing users with administrator privileges to perform SQL injection attacks...

CVE-2026-85408

A vulnerability was determined in Eleveo Quality Management 9.7.0. Impacted is an unknown function of the file /enc-fwk-data/api/v3/conversations//events of the component Conversation Handler. This manipulation of the argument createdBy causes dynamically-determined object attributes. The attack ...

CVE-2026-85406

Eleveo Quality Management 9.7.0 contains a cross-site scripting (XSS) vulnerability in the Conversation Review component. The flaw allows remote exploitation with low privileges and requires user interaction, resulting in a low integrity impact (CVSS 3.1 base score 3.5 , severity LOW ). The explo...

CVE-2026-85405

Eleveo Call Recording Software 9.7.0 contains a cross-site scripting (XSS) vulnerability in the /callrec/roleAddAction.do endpoint. Manipulating the name/username argument allows a remote, authenticated attacker with user interaction to inject scripts, resulting in a low integrity impact. The exp...

CVE-2026-85398

A vulnerability was identified in code-projects Hospital Information System 1.0. Affected is the function viewReq of the file viewReq.php. Such manipulation of the argument ID leads to sql injection. It is possible to launch the attack remotely. The exploit is publicly available and might be used...