1473 matches found
New API < v0.12.10 - Stripe Webhook Bypass
New API v0.12.10 contains a broken authentication caused by unauthenticated attacker forging Stripe webhook events, letting attackers credit arbitrary quota without payment, exploit requires no authentication. id: CVE-2026-41432 info: name: New API v0.12.10 - Stripe Webhook Bypass author: str4k3r...
Exploit-CVE-2017-6008
Exploit-CVE-2017-6008 The CVE-2017-6008 is a vulnerability in the HitmanPro scan that allows privilege escalation by exploiting a kernel pool buffer overflow. The exploits here use the Quota Process Pointer Overwrite attack as described in the Tarjei Mandt's paper Also, the exploits use my Pool...
Unity Linux 20.1050a Security Update: kernel (UTSA-2026-053396)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-053396 advisory. In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix slab-use-after-free due to dangling pointer dqipriv When mounting ocfs2 and then...
CVE-2026-84936 EmbedPress 4.6.0 - 4.6.3 - Unauthenticated Google Reviews API Quota Consumption and Database Bloat
The EmbedPress WordPress plugin before 4.6.4 does not have proper authorization on a public review-loading action, allowing unauthenticated users to force the site to make repeated billable third-party API requests using the site's own configured API key, and to create an unbounded number of...
CVE-2026-84936
The EmbedPress WordPress plugin (versions 4.6.0–4.6.3 ) has a missing-authorization flaw on a public review-loading action. An unauthenticated attacker can force the site to issue repeated billable third-party API requests using the site's own configured API key and to write an unbounded number o...
WordPress EmbedPress plugin 4.6.0-4.6.3 - Unauthenticated Google Reviews API Quota Consumption and Database Bloat vulnerability
Unauthenticated Google Reviews API Quota Consumption and Database Bloat vulnerability discovered by RIA Labs in WordPress Plugin EmbedPress versions 4.6.0-4.6.3...
AZL-99534 CVE-2026-80837 affecting package kernel 6.6.150.1-1
In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: don't queue packet path object notifications All file:line references below are against v7.2-rc4 ac5b0e5651b1. The trace was captured on 7.2.0-rc6-kasan72rc6 075b74841bd0, where the same lines apply...
CVE-2026-80837
CVE-2026-80837 is a use-after-free vulnerability in the Linux kernel's nf_tables subsystem, confirmed on version 7.2.0-rc6 via KASAN. The root cause is a race in nft_quota_obj_eval(), which enqueues a packet-path notification onto nft_net->notify_list via an unlocked list_add_tail(), while nft...
Linux Distros Unpatched Vulnerability : CVE-2026-80837
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - netfilter: nftables: don't queue packet path object notifications All file:line references below are against v7.2-rc4 ac5b0e5651b1. The trace was captured on...
EUVD-2026-66449
In the Linux kernel, the following vulnerability has been resolved: xfs: fix ilock leak on error in xfsdqgetnextid xfsdqgetnextid takes the quota inode ILOCK before calling xfsireadextents. If xfsireadextents fails, the function returns immediately without releasing the lock, leaking the quota...
EUVD-2026-66771
LimeSurvey Community Edition 7.0.5 contains a stored cross-site scripting vulnerability in the survey quota creation workflow. An authenticated low-privileged user who can create and manage their own survey can store malicious JavaScript in a quota message. This issue affects LimeSurvey: 7.0.5...
CVE-2026-61617
Wings is the server control plane for the Pterodactyl game-server management panel. In versions up to and including 1.13.2, the SFTP write path does not enforce a server's disk quota during a transfer, allowing a tenant with SFTP write access to a single server to exhaust the host node's physical...
CVE-2026-16809
LimeSurvey Community Edition 7.0.5 contains a stored cross-site scripting vulnerability in the survey quota creation workflow. An authenticated low-privileged user who can create and manage their own survey can store malicious JavaScript in a quota message. This issue affects LimeSurvey: 7.0.5...
CVE-2026-61617 Pterodactyl Wings SFTP write path does not enforce disk quota, allowing node-wide disk exhaustion
Wings is the server control plane for the Pterodactyl game-server management panel. In versions up to and including 1.13.2, the SFTP write path does not enforce a server's disk quota during a transfer, allowing a tenant with SFTP write access to a single server to exhaust the host node's physical...
CVE-2026-61617 Pterodactyl Wings SFTP write path does not enforce disk quota, allowing node-wide disk exhaustion
Wings is the server control plane for the Pterodactyl game-server management panel. In versions up to and including 1.13.2, the SFTP write path does not enforce a server's disk quota during a transfer, allowing a tenant with SFTP write access to a single server to exhaust the host node's physical...
CVE-2026-61617
Wings , the server control plane for the Pterodactyl game-server management panel, contains a disk-quota enforcement flaw in its SFTP write path (versions up to and including 1.13.2 ). Wings checks available disk space only once as a boolean when the write handle is opened—using a stale cached va...
CVE-2026-16809
CVE-2026-16809 affects LimeSurvey Community Edition 7.0.5 and is a stored cross-site scripting (XSS) vulnerability in the survey quota creation workflow. An authenticated low-privileged user with the ability to create and manage their own survey can store malicious JavaScript in a quota message ,...
CVE-2026-16809 LimeSurvey Community Edition 7.0.5 - Stored XSS in quota message rendering
LimeSurvey Community Edition 7.0.5 contains a stored cross-site scripting vulnerability in the survey quota creation workflow. An authenticated low-privileged user who can create and manage their own survey can store malicious JavaScript in a quota message. This issue affects LimeSurvey: 7.0.5...
CVE-2026-16809 LimeSurvey Community Edition 7.0.5 - Stored XSS in quota message rendering
LimeSurvey Community Edition 7.0.5 contains a stored cross-site scripting vulnerability in the survey quota creation workflow. An authenticated low-privileged user who can create and manage their own survey can store malicious JavaScript in a quota message. This issue affects LimeSurvey: 7.0.5...
CVE-2026-80529
A flaw was found in the Linux kernel's XFS filesystem. During dquot recovery, the xlogrecoverdquotcommitpass2 function fails to correctly propagate verification errors. This allows a corrupt quota buffer to be written back to disk, potentially leading to data corruption within the XFS filesystem...