CVE-2026-71620

File Upload vulnerability in Zhao-github ApiAdmin v.5.0.1 allows a remote attacker to execute arbitrary code via a crafted .php file...

WordPress Hummingbird - Speed Optimization, Caching, Minify, Compress & CDN plugin <= 3.21.0 - Unauthenticated Remote Code Execution via Cookie Name in Page Cache Debug Log vulnerability

WordPress Hummingbird - Speed Optimization, Caching, Minify, Compress & CDN plugin = 3.21.0 - Unauthenticated Remote Code Execution via Cookie Name in Page Cache Debug Log vulnerability discovered by Kuba in WordPress Plugin Hummingbird versions = 3.21.0...

CVE-2024-50482

CVE-2024-50482 WooCommerce Product Design = 1.0.0 - 未认证的任意文件上传 描述： WordPress 的 WooCommerce Product Design 插件在所有版本（包括 1.0.0）中由于缺少文件类型验证，存在任意文件上传漏洞。这使得未认证的攻击者能够在受影响站点的服务器上上传任意文件，可能导致远程代码执行。 root@kitploit: Published: 2024-10-25 00:00:00 CVE: CVE-2024-50482 CVSS:...

CVE-2024-50510

CVE-2024-50510 AR Para Woocommerce = 6.2 - Subida de Archivos Arbitraria No Autenticada Descripción El plugin AR for WooCommerce para WordPress es vulnerable a subidas de archivos arbitrarias debido a la falta de validación del tipo de archivo en todas las versiones hasta la 6.2 inclusive. Esto...

CVE-2026-9317

Nango before 0.71.6 contains a missing authentication vulnerability in the runner tRPC server that allows unauthenticated attackers to execute arbitrary JavaScript code by invoking the exposed start procedure without credentials. Attackers with network access to the runner port can send requests ...

CVE-2026-53757

Emlog is an open source website building system. In versions 2.6.29 and prior, the emUnZip function extracts all ZIP entries via ZipArchive::extractTo without validating entry paths for ../ traversal sequences. Only the first entry's subdirectory structure is checked. An attacker can overwrite...

CVE-2026-78327

An OS Command Injection (CWE-78) in the SonicWall Network Security Manager (NSM) On-Prem Management interface allows an authenticated attacker with SuperAdmin privileges to inject arbitrary commands executed on the underlying host, resulting in remote code execution . The vulnerability affects NS...

EUVD-2026-71679

An Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability in the SonicWall Network Security Manager NSM On-Prem Management interface allows an authenticated attacker with SuperAdmin privileges to inject arbitrary commands that are executed on the...

CVE-2026-78327

An Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability in the SonicWall Network Security Manager NSM On-Prem Management interface allows an authenticated attacker with SuperAdmin privileges to inject arbitrary commands that are executed on the...

EUVD-2026-60969

CodeWhale: Project config allowshell override enables arbitrary shell command execution via cloned repository...

EUVD-2026-60965

CodeWhale: rlmeval auto-approves arbitrary Python execution, bypassing the user's approval policy RCE...

CVE-2026-39987

CVE-2026-39987 Para Marimo 0.20.4 PoC ⚠️ Esta herramienta está destinada únicamente a fines educativos y pruebas de seguridad autorizadas. El creador no se hace responsable de ningún uso no autorizado o ilegal. Úsala bajo tu propio riesgo. ⚠️ Información: CVE-2026-39987 es una vulnerabilidad...

CVE-2019-10392_EXP

CVE-2019-10392EXP Jenkins Git Client RCE autenticado CVE-2019-10392Exp Uso root@kitploit: usage: Jenkins Git Client 2.8.2. -h -u TARGET -U USERNAME -P PASSWORD -i ITEM -I INTERACTIVE -c COMMAND optional arguments: -h, --help show this help message and exit -u TARGET, --target TARGET Target. -U...

cve-disclosures

Divulgaciones de CVE — Aman Bahiniya Tres CVE asignados por MITRE en diciembre de 2024. Los registros fueron reservados pero nunca publicados, por lo que aún no hay nada indexado. Este repositorio publica los avisos para que los CVE sean buscables y acreditados...

CVE-2026-9317 Nango < 0.71.6 Missing Authentication RCE via runner tRPC server

Nango before 0.71.6 contains a missing authentication vulnerability in the runner tRPC server that allows unauthenticated attackers to execute arbitrary JavaScript code by invoking the exposed start procedure without credentials. Attackers with network access to the runner port can send requests ...

CVE-2026-9317

Nango before version 0.71.6 contains a missing authentication vulnerability in the runner tRPC server . The exposed start procedure does not enforce the RUNNER_SECRET_KEY environment variable, allowing an unauthenticated attacker with network access to the runner port to invoke it and achieve rem...

EUVD-2026-71631

Nango before 0.71.6 contains a missing authentication vulnerability in the runner tRPC server that allows unauthenticated attackers to execute arbitrary JavaScript code by invoking the exposed start procedure without credentials. Attackers with network access to the runner port can send requests ...

CVE-2026-9317 Nango < 0.71.6 Missing Authentication RCE via runner tRPC server

Nango before 0.71.6 contains a missing authentication vulnerability in the runner tRPC server that allows unauthenticated attackers to execute arbitrary JavaScript code by invoking the exposed start procedure without credentials. Attackers with network access to the runner port can send requests ...

CVE-2026-10036-speechbrain-rce

CVE-2026-10036: Ejecución Arbitraria de Código en SpeechBrain mediante el Análisis de CKPT.yaml Gravedad: Alta, CVSS 4.0 8.7 , CVSS 3.1 8.8 asignado por VulnCheck, la CNA Vector v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N Vector v3.1:...

Project-CVE-2025-54068

Livewire2025CVE Escáner de CVE-2025-54068 para Livewire Escáner automatizado de vulnerabilidades para detectar CVE-2025-54068 en aplicaciones Laravel que utilizan Livewire v3.0.0-beta.1 hasta v3.6.3. Descripción general Esta herramienta analiza una lista de sitios web en busca de indicadores de l...