CVE-2026-46442 Flowise: Authenticated Host RCE via POST /api/v1/node-custom-function and NodeVM Sandbox Escape

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.1.2, POST /api/v1/node-custom-function lacks route-level authorization, allowing any authenticated user or API key to submit arbitrary JavaScript to the Custom JS Function node. When...

Critical Check Point VPN Flaw Exploited to Bypass Passwords in IKEv1 Setups

Check Point has warned of active exploitation of a critical vulnerability impacting Remote Access VPN and Mobile Access deployments that are configured to use the deprecated IKEv1 key exchange protocol. The vulnerability, tracked as CVE-2026-50751 CVSS score: 9.3, is a case of a logic flow weakne...

JLSEC-2026-592

An issue was discovered in yasm version 1.3.0. There is a use-after-free in exprtraversenodespost in libyasm/expr.c...

CVE-2026-11507

creationtimestamp| type| source ---|---|--- 2026-06-08 13:30:32+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnrs3vsfty2t...

CVE-2026-11505

creationtimestamp| type| source ---|---|--- 2026-06-08 13:01:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnrqhbsvgd2o...

Post_Exploitation_Privilege_Escalation

⬆️ Week 05 — Post-Exploitation & Privilege Escalation Inter...

CVE-2026-41722

creationtimestamp| type| source ---|---|--- 2026-06-08 10:00:35+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mnrgegyddl2n 2026-06-08 10:24:16+00:00| seen| https://cyber.gc.ca/en/alerts-advisories/broadcom-vmware-security-advisory-av26-560 2026-06-08 10:50:45+00:00| seen|...

AnSploit

Ansploit v2.0 — Android Network Security & Exploitation Toolki...

CVE-2026-41842

creationtimestamp| type| source ---|---|--- 2026-06-08 07:18:37+00:00| seen| https://cyber.gc.ca/en/alerts-advisories/spring-security-advisory-av26-558 2026-06-09 08:01:16+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mntq5zi3kj2x 2026-06-09 12:13:52+00:00| seen|...

CVE-2026-40983

creationtimestamp| type| source ---|---|--- 2026-06-08 07:18:37+00:00| seen| https://cyber.gc.ca/en/alerts-advisories/spring-security-advisory-av26-558 2026-06-08 13:20:13+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mnrrjhm3tl25 2026-06-09 08:01:30+00:00| seen|...

CVE-2026-11481

creationtimestamp| type| source ---|---|--- 2026-06-08 07:04:54+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnr4kdtmua2s...

CVE-2026-11495

creationtimestamp| type| source ---|---|--- 2026-06-08 06:53:59+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnr3wt6bpi2s...

CVE-2026-11477

creationtimestamp| type| source ---|---|--- 2026-06-08 05:40:00+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnqxsjnyfd2r...

CVE-2021-47984

creationtimestamp| type| source ---|---|--- 2026-06-08 05:24:59+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnqwxof6ya24...

CVE-2026-11491 CodeAstro Human Resource Management System Notice Board Management All_notice cross site scripting

A vulnerability was identified in CodeAstro Human Resource Management System 1.0. Impacted is an unknown function of the file /notice/Allnotice of the component Notice Board Management. Such manipulation of the argument Notice Title with the input as part of POST leads to cross site scripting. It...

EUVD-2026-35022

A vulnerability was identified in CodeAstro Human Resource Management System 1.0. Impacted is an unknown function of the file /notice/Allnotice of the component Notice Board Management. Such manipulation of the argument Notice Title with the input as part of POST leads to cross site scripting. It...

CVE-2026-11488 code-projects Simple Flight Ticket Booking System POST Parameter checkUser.php sql injection

A vulnerability has been found in code-projects Simple Flight Ticket Booking System 1.0. This affects an unknown part of the file checkUser.php of the component POST Parameter Handler. The manipulation of the argument Username leads to sql injection. The attack is possible to be carried out...

CVE-2026-11488

A vulnerability has been found in code-projects Simple Flight Ticket Booking System 1.0. This affects an unknown part of the file checkUser.php of the component POST Parameter Handler. The manipulation of the argument Username leads to sql injection. The attack is possible to be carried out...

CVE-2026-11488 code-projects Simple Flight Ticket Booking System POST Parameter checkUser.php sql injection

A vulnerability has been found in code-projects Simple Flight Ticket Booking System 1.0. This affects an unknown part of the file checkUser.php of the component POST Parameter Handler. The manipulation of the argument Username leads to sql injection. The attack is possible to be carried out...

EUVD-2023-60582

WordPress Sonaar Music Plugin 4.7 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts through the comment functionality. Attackers can submit JavaScript payloads in the comment parameter to wp-comments-post.php which are stored an...