cve-2026-9082-drupal-postgresql-rce

CVE-2026-9082 Drupal PostgreSQL SQLi to RCE This repository contains a local lab and a short exploit for the Drupal JSON:API PostgreSQL SQL injection described in the Ambionics article. The important part of the exploit is the PostgreSQL escalation: once the injection can evaluate a SELECT...

cve-2025-4664

CVE-2025-4664 This repository contains a PoC for exploiting CVE-2025-4664, a vulnerability where Chromium-based browsers leak sensitive URL parameters through Link header preload requests. Resources For a detailed explanation of how this exploit works, read the blog post:...

CVE-2025-13401-XSS-Stored

Proof of Concept: Stored XSS in Autoptimize tags for images found in the content when image optimization or preloading is enabled. In version 3.1.13, the function uses a "blacklist" approach via pregreplace to remove specific attributes like title, alt, class, id, width, and height from the...

Preload Component Access Information Disclosure

The vulnerability of the Preload component in Google Chrome and Microsoft Edge is related to authentication errors. Exploiting this vulnerability can allow a remote attacker to gain access to protected information through a specially created HTML page...

Preload Component Access Information Disclosure

The vulnerability of the Preload component in Google Chrome and Microsoft Edge is related to the use of a name with an incorrect link. Exploiting this vulnerability can allow an attacker to gain access to protected information through a specially created HTML page...

Preload Component Access Information Disclosure

The vulnerability of the Preload component in Google Chrome and Microsoft Edge involves exposing information in an erroneous protected area. Exploiting this vulnerability can allow a malicious actor to gain access to protected information through a specially created HTML page...

Preload Component Access Information Disclosure

The vulnerability of the Preload component in Google Chrome and Microsoft Edge is related to insufficient validation of the input protected information. Exploiting this vulnerability can allow a malicious actor to gain access to protected information through a specially created HTML page...

Preload Component Access Information Disclosure

The vulnerability of the Preload component in Google Chrome and Microsoft Edge is related to authentication errors. Exploiting this vulnerability can allow a remote attacker to gain access to protected information through a specially created HTML page...

CVE-2026-43499-T807D

T807D Final Artifacts — Source One-to-One Correspondence Recovery Package Generated: 2026-08-08 Conclusion This directory has organized the complete popsicle source tree, necessary header files, embedded su payload, production binaries, and runtime scripts that can be recovered from the current...

Astra Linux – Vulnerability in Chromium

Missing authorization in the Preload feature of Google Chrome before version 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass web origin policies through a crafted HTML page. Chromium security severity: Low...

Astra Linux – Vulnerability in Chromium

Incorrect reference resolution in the Preload mechanism in Google Chrome prior to version 152.0.7977.65 allowed a remote attacker to bypass web origin policies through a crafted HTML page. Chromium security severity: Medium...

CVE-2026-104848

The Tinypool minimal Node.js worker thread pool implementation is vulnerable to a Prototype Pollution gadget in versions prior to 2.1.1 . The root cause is located in dist/index.js, where the software constructs ThreadPool.options from a normal options object and reads execArgv and env worker opt...

CVE-2026-102677

A flaw was found in Electron. The cache mechanism for sandboxed preload scripts fails to verify that cached entries match the requested script. In applications that load untrusted web content, an attacker with a compromised renderer process can write malicious data into the cache to be reused on...

CVE-2026-102677

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. From 42.3.3 until 42.10.0, 43.5.0, and 44.0.0-beta.6, Electron's sandboxed preload code cache did not verify that a cached entry matched the preload it was served for. A compromised renderer...

GHSA-QMV3-FV6V-RMHQ Electron: Sandboxed preload code cache can be poisoned by a compromised renderer

Impact The cache Electron keeps for sandboxed preload scripts did not verify that a cached entry matched the preload it was served for. A compromised renderer could use this to run its own code in the preload context on a later load. Apps are only affected if they load untrusted content. Apps tha...

Protection Mechanism Failure

Overview electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS. Affected versions of this package are vulnerable to Protection Mechanism Failure via insufficient keying of sandboxed preload script code cache entries, allowing a renderer...

Electron: Sandboxed preload code cache can be poisoned by a compromised renderer

Impact The cache Electron keeps for sandboxed preload scripts did not verify that a cached entry matched the preload it was served for. A compromised renderer could use this to run its own code in the preload context on a later load. Apps are only affected if they load untrusted content. Apps tha...

NPM: Electron: Sandboxed preload code cache can be poisoned by a compromised renderer

NPM: Electron: Sandboxed preload code cache can be poisoned by a compromised renderer vulnerability discovered by ? in WordPress Npm electron versions = 42.3.3, 42.10.0...

CVE-2026-102677 Electron: Sandboxed preload code cache can be poisoned by a compromised renderer

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. From 42.3.3 until 42.10.0, 43.5.0, and 44.0.0-beta.6, Electron's sandboxed preload code cache did not verify that a cached entry matched the preload it was served for. A compromised renderer...

EUVD-2026-89179

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. From 42.3.3 until 42.10.0, 43.5.0, and 44.0.0-beta.6, Electron's sandboxed preload code cache did not verify that a cached entry matched the preload it was served for. A compromised renderer...