CVE-2026-103882: acadlix: The Acadlix LMS – AI Quiz Maker, Online Exam & Course Plugin for WordPress plugin for WordPress is vulnerable to…

The Acadlix LMS – AI Quiz Maker, Online Exam & Course Plugin for WordPress plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the postdeleteassessmentfilebyid function in all versions up to, and including, 1.1.9. This makes it possible for...

Microsoft Edge (Chromium) < 156.0.4314.58 Multiple Vulnerabilities

The version of Microsoft Edge installed on the remote Windows host is prior to 156.0.4314.58. It is, therefore, affected by multiple vulnerabilities as referenced in the October 31, 2026 advisory. - Missing authorization in AppManifest in Google Chrome prior to 153.0.8010.47 allowed a remote...

PT-2026-134506

Name of the Vulnerable Software and Affected Versions NextGEN Gallery versions prior to 4.4.2 Description Remote Code Execution is possible for authenticated attackers with custom-level access and above. The issue occurs via the render image function due to unrestricted mass assignment of...

PT-2026-134528

Name of the Vulnerable Software and Affected Versions AJ-Report versions 1.0 through 1.7.1 Description The software uses a hard-coded JWT secret to sign share tokens, which enables attackers to forge valid tokens offline. By creating a token with the reportCode variable set to 'dataSet', an...

CVE-2026-116512: wedevs: The Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker plugin for WordPress…

The Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.1.1 via the 'id' parameter parameter. This is due to unsanitized 'id' parameter value concatenated...

CVE-2026-119977: WordPress Foundation WordPress: WordPress Core is vulnerable to Remote Code Execution in versions 4.7 through 7.1.3

WordPress Core is vulnerable to Remote Code Execution in versions 4.7 through 7.1.3. This is due to predictable, web-accessible staging paths used during full-package core upgrades. This makes it possible for unauthenticated attackers to execute code on the server during the upgrade window...

Apache ActiveMQ Classic 5.18.2 OpenWire Remote Code Execution

Apache ActiveMQ Classic version 5.18.2 is vulnerable to remote code execution through unsafe deserialization of OpenWire ExceptionResponse data. This proof of concept supplies a local Docker lab, version checker, and Spring XML generator for CVE-2023-46604. https://packetstorm.news/download/23867...

WordPress IvyForms 1.5.1 Shell Upload

WordPress IvyForms plugin version 1.5.1 and earlier contains an arbitrary file upload vulnerability that allows a user with custom form-editing access to configure executable extensions and upload a PHP payload through a published form. https://packetstorm.news/download/238670...

ManageEngine ADAudit Plus Build 8605 Vulnerability Scanner

ManageEngine ADAudit Plus versions before build 8606 contain an unauthenticated remote code execution issue in the Agent API. This tool fingerprints HTTP services, identifies exposed Agent API endpoints, and reports detected build versions...

RockyLinux 8 : hplip (RLSA-2026:82295)

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:82295 advisory. hplip: potential memory buffer overflow CVE-2020-6923 hplip: HP Linux Imaging and Printing Software - Use of DSA Key CVE-2025-43023 hplip: HPLIP: Multip...

CVE-2026-76010: smub: The Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery plugin for WordPress is vulnerable to Remote Code…

The Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.4.1 via the renderimage function. This is due to unrestricted mass assignment of caller-supplied metadata keys onto the image model...

Linear eMerge E3-Series 1.00-06 Command Injection

Linear eMerge E3-Series version 1.00-06 and earlier contain an unauthenticated command injection in cardscandecoder.php. This proof of concept uses the hard-coded root credentials tracked as CVE-2019-7261 to execute a benign marker command. https://packetstorm.news/download/238664...

KLA91385 Multiple vulnerabilities in Microsoft Browser

Multiple vulnerabilities were found in Microsoft Browser. Malicious users can exploit these vulnerabilities to bypass security restrictions, cause denial of service, execute arbitrary code. Below is a complete list of vulnerabilities: 1. Denial of service vulnerability in SVG can be exploited...

FreePBX Endpoint Manager 17.0.2 SQL Injection / Remote Code Execution

FreePBX Endpoint Manager versions before 15.0.66, 16.0.89, and 17.0.3 contain an unauthenticated SQL injection vulnerability that allows database manipulation and remote code execution. Included proof of concept inserts a cron job to execute commands as asterisk...

React 19.2.0 React Server Components Remote Code Execution

React Server Components version 19.2.0 and earlier affected releases contain an unsafe deserialization issue that permits unauthenticated remote code execution. This proof of concept sends a crafted Flight payload to execute a supplied command. https://packetstorm.news/download/238687...

Delinea Privilege Manager 13.0.1058 Unauthenticated Remote Code Execution

Delinea Privilege Manager agent versions 10.1.0 through 12.0.5796 and 13.0.0 through 13.0.1058 allow unauthenticated code execution as LocalSystem through an improperly validated callback endpoint. https://packetstorm.news/download/238674...

Security update for python-Brotli (important)

openSUSE security update: security update for python-brotli ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:22183-1 Rating: important References: bsc1252945 bsc1287779 Cross-References: CVE-2025-6176 CVE-2026-111497 CVSS scores: CVE-2025-6176 SUSE :...

CVE-2024-10629

🛠️ GPX Viewer Exploit CVE-2024-10629 This repository contains a proof-of-concept exploit for the GPX Viewer plugin for WordPress, which is vulnerable to arbitrary file creation CVE-2024-10629. The vulnerability allows authenticated attackers with subscriber-level access and above to create...

CVE-2026-23744

CVE-2026-23744 MCPJam inspector Remote-Code-Execution: Proof Of Concept POC usage: python3 cve-2026-23744.py --target https:// --att-ip --att-p...

Blackash-CVE-2025-54574

🛑 CVE-2025-54574 — Heap Buffer Overflow in Squid ≤ 6.3 🛑 Severity: Critical CVSS 9.3 Affected Software: Squid Proxy versions 6.3 and earlier Vulnerability Type: Heap-based buffer overflow Discovered in: URN Uniform Resource Name processing Impact: Possible remote code execution or denial-of-servi...