296 matches found
dwn
🥽 dwn dockerpwn - Docker 攻击工具管理器 介绍 dwn 是“黑客的 docker-compose”。它使用类似 docker-compose 的简单 YAML “计划”格式，定义镜像名称、版本以及卷/端口映射，从而配置工具以供使用。 特性 使用 dwn，你可以： 在 Docker 容器中配置常用的渗透测试工具 拥有上下文感知的卷挂载 无需重启容器即可动态修改端口绑定 还有更多！ 安装 只需运行 pip3 install dwn。 用法 dwn...
CVE-2026-82858
@hulumi/drift versions before 1.3.2 accept externally supplied execute plans without sufficient provenance validation, allowing untrusted reconciliation input to be treated as trusted. Attackers can supply malicious execute plans that bypass security checks to perform unsafe reconciliation...
EUVD-2026-68446
@hulumi/drift versions before 1.3.2 accept externally supplied execute plans without sufficient provenance validation, allowing untrusted reconciliation input to be treated as trusted. Attackers can supply malicious execute plans that bypass security checks to perform unsafe reconciliation...
CVE-2026-82858
@hulumi/drift versions before 1.3.2 accept externally supplied execute plans without sufficient provenance validation, causing untrusted reconciliation input to be treated as trusted. An attacker can supply malicious execute plans that bypass security checks and perform unsafe reconciliation oper...
CVE-2026-81346
The Frontend Admin by DynamiApps WordPress plugin before 3.29.11 does not perform a capability check on one of its AJAX actions, allowing any authenticated user, such as a subscriber, to delete arbitrary membership plans...
EUVD-2026-68065
The Frontend Admin by DynamiApps WordPress plugin before 3.29.11 does not perform a capability check on one of its AJAX actions, allowing any authenticated user, such as a subscriber, to delete arbitrary membership plans...
CVE-2026-81346
The Frontend Admin by DynamiApps WordPress plugin, prior to version 3.29.11 , fails to perform a capability check on one of its AJAX actions . This missing authorization check allows any authenticated user with the Subscriber role or higher to delete arbitrary membership plans . The root cause is...
CVE-2026-82306
StarRocks through 4.0.13 contains an information disclosure vulnerability in the querydetail endpoint that returns unfiltered query history for all users. Authenticated attackers with low privileges can access full SQL text, execution plans, and profiling data from every query executed by other...
CVE-2026-82306
StarRocks through 4.0.13 contains an information disclosure vulnerability in the query_detail endpoint, which returns unfiltered query history for all users rather than scoping results to the requesting user. An authenticated attacker with low privileges can thereby retrieve the full SQL text , e...
73% of Organizations Say They Are Not Fully Ready for a Major Cyberattack
Most organizations have incident response plans, security tools, and technical teams in place. Yet new research suggests that many still lack the coordination, visibility, and executive alignment needed to withstand a serious cyberattack. According to The State of Incident Response Readiness 2026...
CVE-2026-15673
The SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin for WordPress is vulnerable to generic SQL Injection via 'checkoutpaymentplans' and 'orderstatus' Settings in all versions up to, and including, 3.9.7 due to insufficient escaping on the user supplied...
CVE-2026-15673
The SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin for WordPress is vulnerable to generic SQL Injection via 'checkoutpaymentplans' and 'orderstatus' Settings in all versions up to, and including, 3.9.7 due to insufficient escaping on the user supplied...
CVE-2026-15673
CVE-2026-15673 affects the WordPress plugin “SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery” up to version 3.9.7. It is a second‑order SQL Injection where insufficient escaping in the update_option‑stored values in checkout_payment_plans and order_status allo...
GHSA-5Q4Q-834J-G8G4 Paymenter has URL parameter injection that bypasses paid plan limits at checkout
Summary The checkout component improperly filters URL-writable properties, allowing authenticated users to inject arbitrary key-value pairs into server provisioning parameters. Because bundled server extensions prioritize these user-supplied properties over administrator-defined configurations, a...
Anthropic Releases Claude Fable 5, Its Most Powerful AI Yet, With Cyber Safeguards
On June 9, Anthropic released Claude Fable 5, the most capable model it has ever made, generally available. It also did something unusual: it shipped one model as two products, split not by capability but by a layer of safety classifiers. Fable 5 goes to the public. Its twin, Claude Mythos 5, the...
CVE-2026-4949
The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 4.16.12. This is due to the 'processcheckout' function not properly enforcing...
CVE-2026-50214
The /v1/Plan service relies entirely on a shared global API token for full administrative management, allowing arbitrary creation of zero-cost network access plans...
CVE-2026-50214
The /v1/Plan service relies entirely on a shared global API token for full administrative management, allowing arbitrary creation of zero-cost network access plans...
CVE-2026-50214
The CVE-2026-50214 entry concerns the /v1/Plan service that relies entirely on a shared global API token for full administrative management, enabling arbitrary creation of zero-cost network access plans. According to the NVD entry, this leads to critical impact across confidentiality, integrity, ...