susinternals

susinternals - back from the dead by @deft @cablethief & @randomwalksp reino This tool allows you executing commands remotely via the PSExeSVC service from a python script. It can be used to: Authenticate as a user with a primary token: Authenticate as system: Full blog post can be found here!...

NocoBase - SQL Injection

NocoBase versions prior to 2.0.39 contain a SQL injection vulnerability in the @nocobase/database package. The queryParentSQL function in eager-loading-tree.ts constructs a recursive CTE query by directly concatenating user-controlled primary key values into the SQL WHERE IN clause without...

CVE-2024-37759_PoC

CVE-2024-37759 PoC Description DataGear version 5.0.0 and earlier has a SpEL expression injection vulnerability that leads to remote code execution. Exploit CVE Exploit Details When you request the /data/schemaId/tableName/view interface, if the database table does not have a primary key, an...

CVE-2026-111979 GiveWP < 4.19.0.1 - Give Worker+ Stored XSS via Form Template Primary Color

The GiveWP WordPress plugin before 4.19.0.1 does not properly sanitise and escape one of its donation form template settings before outputting it inside an HTML attribute, allowing users with a custom form-editing GiveWP WordPress plugin before 4.19.0.1 role to inject arbitrary web scripts that...

CVE-2026-111979

The GiveWP WordPress plugin (versions before 4.19.0.1 ) is vulnerable to a Stored Cross-Site Scripting (XSS) flaw. The issue arises because the plugin fails to properly sanitise and escape one of its donation form template settings before outputting it within an HTML attribute . An attacker with ...

PT-2026-116767

In the Linux kernel, the following vulnerability has been resolved: sctp: discard the rest of the packet on a stale-cookie error When an association is in COOKIE-ECHOED state and the peer sends a bundled ERRORStale CookieDATA packet from one of its non-primary addresses, processing the ERROR chun...

CVE-2026-111447

Wheels 1.1 through 4.1.2 resolves nestedProperties records by posted primary key without checking that they belong to the parent being saved. A user able to submit a nested form for their own parent can update and reassign another parent's hasMany or hasOne rows, or delete them when...

Astra Linux – Vulnerability in Containerd

Containerd is an open-source container runtime. A bug was discovered in Containerd prior to versions 1.6.18 and 1.5.18, where supplementary groups were not set up properly within a container. If an attacker has direct access to a container and manipulates the supplementary group permissions, they...

PT-2026-108189

Name of the Vulnerable Software and Affected Versions Tenable Identity Exposure SaaS affected versions not specified Description A command injection flaw exists in the Active Directory Events Listener. This allows an authenticated attacker with low privileges to execute arbitrary commands with...

CVE-2026-87975

A flaw was found in Django. When handling model formsets where primary keys can be modified through form fields, the application does not properly validate submitted key values against the authorized query scope. A remote attacker with permission to submit form data can exploit this issue by...

CVE-2026-103235

MISP contains a mass assignment vulnerability in the event delegation feature. When a user with delegation permission submits a delegation request, the application authorized the user against the event identified in the URL but then persisted the entire submitted record, including caller-supplied...

CVE-2026-103235 MISP Event Delegation Mass Assignment Allows Retargeting Delegation to Arbitrary Events

MISP contains a mass assignment vulnerability in the event delegation feature. When a user with delegation permission submits a delegation request, the application authorized the user against the event identified in the URL but then persisted the entire submitted record, including caller-supplied...

UBUNTU-CVE-2026-16271

hw/display/qxl: validate primary surface stride against width...

CVE-2026-103235: Improperly Controlled Modification of Dynamically-Determined Object Attributes

MISP contains a mass assignment vulnerability in the event delegation feature. When a user with delegation permission submits a delegation request, the application authorized the user against the event identified in the URL but then persisted the entire submitted record, including caller-supplied...

CVE-2026-100392 InvoicePlane: Primary Administrator Privilege Downgrade via `Users::form()` (Missing Object-Level Authorization)

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. In version 1.7.2, Users::form performs no object-level authorization check on userid = 1. A Secondary Administrator usertype = 1, userid != 1 can rewrite the Primary Administrator's usertype to 2...

PT-2026-102341

Name of the Vulnerable Software and Affected Versions InvoicePlane versions prior to 1.7.2 Description An authorization flaw exists where a secondary administrator can take over the primary administrator account. While a previous fix protected the Users::change password function, the Users::form...

CVE-2026-75517 Novu: Cross-Environment Integration Manipulation (IDOR)

Novu provides an API for sending notifications through multiple channels. Prior to 3.18.0, Novu integration mutation use cases including remove-integration, update-integration, auto-configure-integration, and set-integration-as-primary look up an integration by integrationId and organizationId...

CVE-2026-25262

Memory corruption while processing a crafted ELF file in the Primary Bootloader...

CVE-2026-25262 Write-what-where Condition in Primary Bootloader

Memory corruption while processing a crafted ELF file in the Primary Bootloader...

CVE-2026-25262

CVE-2026-25262 is a write-what-where memory corruption in the Primary Bootloader (PBL) of Qualcomm Snapdragon chips (MDM and MSM series), triggered by processing a crafted ELF file during Sahara protocol handshake in Emergency Download Mode. An attacker with physical access can bypass secure boot...