cve-2026-9082-drupal-postgresql-rce

CVE-2026-9082 Drupal PostgreSQL SQLi से RCE यह रिपॉजिटरी Ambionics लेख में वर्णित Drupal JSON:API PostgreSQL SQL इंजेक्शन के लिए एक स्थानीय लैब और एक छोटा एक्सप्लॉइट शामिल करता है। एक्सप्लॉइट का महत्वपूर्ण हिस्सा PostgreSQL एस्केलेशन है: एक बार इंजेक्शन PostgreSQL सुपरयूज़र के रूप में SELECT...

CVE-2025-13401-XSS-Stored

Prova de Conceito: XSS Armazenado no Autoptimize para imagens encontradas no conteúdo quando a otimização de imagens ou o pré-carregamento está habilitado. Na versão 3.1.13, a função utiliza uma abordagem de "lista negra" via pregreplace para remover atributos específicos como title, alt, , , e d...

cve-2025-4664

CVE-2025-4664 Este repositório contém um PoC para explorar a CVE-2025-4664, uma vulnerabilidade onde navegadores baseados em Chromium vazam parâmetros sensíveis de URL através de requisições de pré-carregamento do cabeçalho Link. Recursos Para uma explicação detalhada de como este exploit funcion...

CVE-2026-79264

Incorrect reference resolution in Preload in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass web origin policy via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-79214

Improper input validation in Preload in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-79184

Missing authorization in Preload in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. Chromium security severity: Low...

CVE-2026-79110

Missing authorization in Preload in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass web origin policy via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-79031

Improper resource exposure in Preload in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass site isolation via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-79184

Google Chrome prior to 152.0.7977.65 contains a missing authorization flaw in the Preload component. A remote attacker who had already compromised the renderer process could exploit this to bypass the web origin policy using a crafted HTML page. Chromium rates the severity as Low , consistent wit...

CVE-2026-79214

CVE-2026-79214 is an improper input validation vulnerability in the Preload component of Google Chrome prior to 152.0.7977.65 . A remote attacker who had already compromised the renderer process could exploit this flaw via a crafted HTML page to bypass the web origin policy , potentially accessin...

CVE-2026-79264

Google Chrome prior to 152.0.7977.65 is affected by an incorrect reference resolution flaw in its Preload component. A remote attacker can exploit this by serving a crafted HTML page to a victim, resulting in a bypass of the web origin policy . Chromium's internal security severity is rated Mediu...

CVE-2026-79031

CVE-2026-79031 is an improper resource exposure vulnerability in the Preload component of Google Chrome , affecting versions prior to 152.0.7977.65 . A remote attacker could exploit this via a crafted HTML page to bypass site isolation , potentially exposing resources across isolated origins. Chr...

CVE-2026-79110

CVE-2026-79110 affects Google Chrome prior to 152.0.7977.65 . The vulnerability is a missing authorization in the Preload component, allowing a remote attacker to bypass the web origin policy via a crafted HTML page. Chromium rates the severity as Medium . No in-the-wild exploitation details are ...

CVE-2026-71551

The EXEC IPC handler in electron/ipc-handlers/exec.ts passes arbitrary commands via child_process.exec() without requiring nodeExecution permission. Community plugins run with new Function() can call window.ea.exec() to execute OS commands under the desktop account's privileges. The confirmation ...

CVE-2026-43971 Link Header Directive Smuggling via Unescaped target/rel/Attribute Keys in cow_link:link/1

Improper Encoding or Escaping of Output vulnerability in ninenines cowlib allows Link header directive smuggling via unescaped special characters in cowlink:link/1. cowlink:dolink/1 in cowlib interpolates the target URI, rel value, and attribute keys directly into the serialized Link: header valu...

CVE-2026-43971 Link Header Directive Smuggling via Unescaped target/rel/Attribute Keys in cow_link:link/1

Improper Encoding or Escaping of Output vulnerability in ninenines cowlib allows Link header directive smuggling via unescaped special characters in cowlink:link/1. cowlink:dolink/1 in cowlib interpolates the target URI, rel value, and attribute keys directly into the serialized Link: header valu...

EUVD-2026-58789

ImpressCMS contains an authenticated remote code execution vulnerability in the custom tag module that allows authenticated administrators to execute arbitrary PHP code by storing a malicious payload in a custom tag with PHP type enabled. The application decodes HTML-encoded content via...

CVE-2026-70610

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.9, 40.9.2, 41.2.2, and 42.0.0-beta.4, objects copied across the contextBridge boundary from untrusted content could carry an attacker-influenced prototype, enabling...

Prototype Pollution

Overview electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS. Affected versions of this package are vulnerable to Prototype Pollution in the contextBridge boundary. An attacker can influence the prototype of objects copied across the...

GHSA-FF2P-HMQR-HXM4 Electron: contextBridge object copy honors prototype setters

Impact Objects copied across the contextBridge boundary from untrusted content could carry an attacker-influenced prototype, enabling prototype-pollution-style attacks against preload code despite context isolation being enabled. Apps are only affected if their preload code accepts object argumen...