CVE-2026-104949

WarehousePG WHPG 6.27.1 through 6.27.6 and 7.2.1 through 7.6.0 are affected by a missing authorization vulnerability CWE-862 in gpaddcoordinatorstandby. The function is named gpaddmasterstandby in WHPG 6, and WHPG 7 keeps that name as an alias. Unlike the other segment add and remove functions, i...

EUVD-2026-107264

WarehousePG WHPG 6.27.1 through 6.27.6 and 7.2.1 through 7.6.0 are affected by a missing authorization vulnerability CWE-862 in gpaddcoordinatorstandby. The function is named gpaddmasterstandby in WHPG 6, and WHPG 7 keeps that name as an alias. Unlike the other segment add and remove functions, i...

CVE-2026-104949

WarehousePG (WHPG) versions 6.27.1 through 6.27.6 and 7.2.1 through 7.6.0 are impacted by a missing authorization vulnerability (CWE-862) in the gp_add_coordinator_standby() function (aliased as gp_add_master_standby() in WHPG 6). The root cause is that this specific function does not require sup...

CVE-2026-104947

WarehousePG WHPG 7.2.1 through 7.6.0 is affected by a missing authorization vulnerability CWE-862 in the built-in function gplogbackendmemorycontexts. Any authenticated database role can run this function without a GRANT. It also gets around the superuser restriction that PostgreSQL places on the...

CVE-2026-104947

WarehousePG (WHPG) versions 7.2.1 through 7.6.0 are vulnerable to a missing authorization vulnerability (CWE-862 ) in the built-in function gp_log_backend_memory_contexts(). Any authenticated database role can execute this function without a GRANT , bypassing the superuser restrictions imposed by...

EUVD-2026-107262

WarehousePG WHPG 7.2.1 through 7.6.0 is affected by a missing authorization vulnerability CWE-862 in the built-in function gplogbackendmemorycontexts. Any authenticated database role can run this function without a GRANT. It also gets around the superuser restriction that PostgreSQL places on the...

GHSA-86WM-68PQ-5JWQ ApostropheCMS: Unauthenticated resource exhaustion via pre-auth aposBigUpload processing in @apostrophecms/import-export

Summary A potential unauthenticated denial-of-service vulnerability exists in the chunked import upload path used by @apostrophecms/import-export. The affected import API routes invoke: self.apos.http.bigUploadMiddleware before the actual import handler performs its authentication check. Because ...

ApostropheCMS: Unauthenticated resource exhaustion via pre-auth aposBigUpload processing in @apostrophecms/import-export

Summary A potential unauthenticated denial-of-service vulnerability exists in the chunked import upload path used by @apostrophecms/import-export. The affected import API routes invoke: self.apos.http.bigUploadMiddleware before the actual import handler performs its authentication check. Because ...

auth-header-trust-rules

auth-header-trust-rules A small Semgrep rule pack that flags code making authentication, authorization, or trust decisions based on HTTP request headers an attacker controls. The canonical example of the vulnerability class is CVE-2025-29927: Next.js trusted the x-middleware-subrequest header to...

Analysis-for-stage1-shellcode-loader-from-hacking-

Analysis for stage1 shellcode loader from hacking team Flowchart of code Network IoC https://172\.20\.20\.164 Mozilla/4.0 compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; MDDRJS...

-CVE-2021-44790

CVE-2021-44790 Description of CVE-2021-44790 CVE-2021-44790 describes a system-level security vulnerability in the modlua of the Apache HTTP Server, specifically in version 2.4.51 and earlier versions. This vulnerability is triggered when the r:parsebody function improperly handles HTTP...

EpSiLoNPoInTlnk

README EpSiLoNPoInTlnk CVE-2026-21510 - .LNK Generator Tool for generating .lnk files exploiting the CVE-2026-21510 vulnerability Windows ShellLink Remote Code Execution. Designed for offensive security research, authorized penetration testing, and vulnerability analysis. Legal Warning ⚠️ THIS TOO...

chaos-operator

Litmus chaos-operator for injecting chaos experiments on Kubernetes Codacy Badge Litmus chaos operator is used by Kubernetes application developers and SREs to inject chaos into the applications and Kubernetes infrastructure in a managed fashion. Its objective is to make the process of validation...

CVE-2026-25232-PoC

CVE-2026-25232 — Gogs Protected Branch Deletion Bypass Write → Admin Escalation Overview Field| Details ---|--- CVE| CVE-2026-25232 Product| Gogs Go Git Service Affected Versions| = 0.13.4 Fixed Version| 0.14.1 CVSS Score| Medium CWE| CWE-863: Incorrect Authorization Authentication Required| Yes...

CVE-2026-0770-PoC

CVE-2026-0770 - Langflow Remote Code Execution Summary Langflow contains a critical remote code execution vulnerability in the validatecode function located in src/lfx/src/lfx/custom/validate.py. The function uses exec to execute user-supplied Python code without sandboxing, allowing arbitrary...

CVE-2026-3796

CVE-2026-3796 In QAX Virus Removal version dated 2025-10-22 and earlier, the affected driver QKSecureIOImp.sys rely on caller process's image to determine whether they are allowed to communicate to the mini filter driver. Attackers could impersonate a legitimate caller process image through tacti...

CVE-2026-39987-Marimo-Preauth-RCE

CVE-2026-39987 Marimo Pre-auth RCE Research Overview This project focuses on CVE-2026-39987, a pre-authentication Remote Code Execution vulnerability in Marimo related to the terminal WebSocket endpoint /terminal/ws. Marimo is an open-source reactive Python notebook that allows users to write and...

Security Bulletin: IBM Guardium Data Protection is affected by multiple vulnerabilities

Summary IBM Guardium Data Protection has addressed multiple vulnerabilities in an update. Vulnerability Details CVEID:CVE-2026-33186 DESCRIPTION: gRPC-Go is the Go language implementation of gRPC. Versions prior to 1.79.3 have an authorization bypass resulting from improper input validation of th...

CVE-2026-5465

CVE-2026-5465: Privilege Escalation in Amelia WordPress Plugin ⚠️ Executive Summary Critical Insecure Direct Object Reference IDOR vulnerability in the Amelia plugin that allows an authenticated user with the Employee Provider role to escalate privileges up to full Account Takeover of the WordPres...

CVE-2024-10124-Poc

CVE-2024-10124-Poc The Vayu Blocks – Gutenberg Blocks for WordPress & WooCommerce plugin for WordPress is vulnerable to unauthorized arbitrary plugin installation and activation due to a missing capability check on the tpinstall function in all versions up to, and including, 1.1.1. This makes it...