PT-2026-80993

A stored OS command injection vulnerability exists in the parent-control module of TP-Link Archer BE3600 V1. An authenticated adjacent attacker with administrative access may store a crafted profile name containing shell metacharacters, which is later processed unsafely during daily cloud report...

PT-2026-79797

Ghostwriter through 7.2.6 does not apply per-object authorization on its report template lint endpoints. RoleBasedAccessControlMixin.test func returns only request.user.is active unless a view overrides it, and neither the endpoint that lints a report template nor the endpoint that returns stored...

CVE-2026-78204: Missing Authorization

Ghostwriter through 7.2.6 does not apply per-object authorization on its report template lint endpoints. RoleBasedAccessControlMixin.testfunc returns only request.user.isactive unless a view overrides it, and neither the endpoint that lints a report template nor the endpoint that returns stored...

papa

Papa, l'analizzatore WireShark - PRO Uso: Inserisci il tuo file .pcapng nella directory di papa root@kitploit: python .\papa.py python3 .\papa.py Controlla il tuo report HTML...

CVE-2026-66917

creationtimestamp| type| source ---|---|--- 2026-08-23 17:00:03+00:00| seen| https://t.me/GithubRedTeam/99370 2026-08-24 00:00:07+00:00| seen| https://t.me/GithubRedTeam/99370 2026-08-24 21:00:04+00:00| seen| Telegram/SUyvNys0dzEwjXvrLl9vzt4eSnd4PMMSmFi1zAltVWOpQ 2026-08-24 21:00:05+00:00| seen|...

notevault-vapt-assessment

Black-Box VAPT Assessment — NoteVault A self-contained, repro...

CVE-2019-1235

creationtimestamp| type| source ---|---|--- 2026-08-22 21:00:05+00:00| seen| https://t.me/nuancesprognews/560 2026-08-23 00:00:13+00:00| seen| https://t.me/nuancesprognews/560...

CVE-2026-75870

creationtimestamp| type| source ---|---|--- 2026-08-22 18:35:27+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/63qno7kptuotr...

CVE-2026-77068

creationtimestamp| type| source ---|---|--- 2026-08-22 05:20:03+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mtnjnv52532y...

CVE-2026-53525

creationtimestamp| type| source ---|---|--- 2026-08-22 01:13:03+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3mtn3uaac5i2x 2026-08-22 01:13:25+00:00| seen| https://mastodon.social/users/hugovalters/statuses/117136503782177429...

CVE-2026-19032

creationtimestamp| type| source ---|---|--- 2026-08-21 18:23:44+00:00| published-proof-of-concept| https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wjgm-6hv5-3cvf 2026-09-01 04:15:00+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/774lc6qyuagz3 2026-09-29...

Wordfence Intelligence Weekly WordPress Vulnerability Report (August 10, 2026 to August 16, 2026)

Last week, there were 265 vulnerabilities disclosed in 202 WordPress Plugins and 5 WordPress Themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 144 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabilitie...

CVE-2026-44252

creationtimestamp| type| source ---|---|--- 2026-08-21 16:45:12+00:00| seen| https://www.acn.gov.it/portale/w/wazuh-poc-pubblici-per-lo-sfruttamento-di-varie-vulnerabilita 2026-08-22 12:30:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mtobot72lj2t...

CVE-2026-63343

creationtimestamp| type| source ---|---|--- 2026-08-21 16:09:28+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mtm5iab4xo2t 2026-08-21 19:40:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mtmjatvxh52p 2026-08-21 22:30:04+00:00| seen|...

CVE-2026-62941

creationtimestamp| type| source ---|---|--- 2026-08-21 16:09:08+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mtm5hmwign25 2026-08-21 19:30:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mtmioyjyjj24 2026-08-21 22:20:05+00:00| seen|...

CVE-2026-18290

creationtimestamp| type| source ---|---|--- 2026-08-21 12:07:43+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3mtlpxwzwki2i 2026-08-21 12:07:50+00:00| seen| https://mastodon.social/users/hugovalters/statuses/117133414439759245...

CVE-2026-77768

The report.get procedure in packages/trpc/src/routers/report.ts accepted only a reportId and returned getReportByIdreportId directly. The enforceAccess middleware in packages/trpc/src/trpc.ts evaluates membership only when the input carries a projectId or organizationId key, so an input consistin...

CVE-2026-77769

The report.list procedure in packages/trpc/src/routers/report.ts accepted a projectId and a dashboardId and returned getReportsByDashboardIddashboardId. The enforceAccess middleware in packages/trpc/src/trpc.ts verified membership for the supplied projectId, but nothing verified that the supplied...

CVE-2026-77767 Reconmap Report Preview Endpoint Is Marked AllowAnonymous, Exposing Every Project and Client Organisation Without Authentication

Reconmap's API applies a fallback authorization policy in apps/api/app/Program.cs that requires an authenticated user holding the administrator role, so controllers without their own attribute reject anonymous callers. The report preview action in apps/api/app/Controllers/ReportsController.cs...

CVE-2026-77767

Reconmap , a penetration-testing engagement management platform, has an unauthenticated information disclosure in its report preview endpoint. The PreviewReport action in ReportsController.cs is decorated with [AllowAnonymous], bypassing the API's fallback authorization policy that requires an au...