82544 matches found
CVE-2021-47967 PHP Timeclock 1.04 Multiple Cross-Site Scripting via Parameters
PHP Timeclock 1.04 contains multiple cross-site scripting vulnerabilities that allow unauthenticated attackers to inject arbitrary JavaScript by manipulating URL paths and POST parameters. Attackers can append malicious payloads to login.php, timeclock.php, audit.php, and timerpt.php endpoints, o...
CVE-2021-47967
PHP Timeclock 1.04 contains multiple cross-site scripting vulnerabilities that allow unauthenticated attackers to inject arbitrary JavaScript by manipulating URL paths and POST parameters. Attackers can append malicious payloads to login.php, timeclock.php, audit.php, and timerpt.php endpoints, o...
X-Omega-Hack
X-Omega-Hack X-Omega-Hack v9.0 - Tool hacking all in one buat...
CVE-2026-8554
A type confusion flaw was found in the ANGLE component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=499131214...
CVE-2026-44088
creationtimestamp| type| source ---|---|--- 2026-05-15 03:55:00+00:00| seen| https://cert.pl/en/posts/2026/05/CVE-2026-44088 2026-05-15 11:26:05+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlv7x6j6yd2e...
PT-2026-41417
Claude Mythos Preview case studies also, read your transcripts! https://t.co/drNlAH5mLE "Mythos demonstrates its bug reproduction and exploitation capabilities on CVE-2024-051912, an in-the-wild exploited bug that has no public report nor a working PoC whatsoever in the public domain. This bug ha...
Open WebUI: Read-Only Users Can Toggle Note Pin Status via Incorrect Permission Check (Write via Read-Only Access)
Summary The POST /api/v1/notes/id/pin endpoint performs a write operation toggling the ispinned field but only checks for read permission. Users with read-only access to a shared note can pin/unpin it, which is a state-modifying action that should require write permission. All other write endpoin...
CVE-2026-42159
creationtimestamp| type| source ---|---|--- 2026-05-14 17:59:21+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mltfhkplug2k...
offsec-skills
offsec-exploit-research Elite adaptive whitebox exploit resea...
CVE-2025-14869
creationtimestamp| type| source ---|---|--- 2026-05-14 07:52:53+00:00| seen| https://www.acn.gov.it/portale/w/risolte-vulnerabilita-su-gitlab-ce/ee-14 2026-05-14 18:00:00+00:00| seen| https://www.hkcert.org/security-bulletin/gitlab-multiple-vulnerabilities20260515...
CVE-2026-0240
creationtimestamp| type| source ---|---|--- 2026-05-14 06:51:24+00:00| seen| https://www.acn.gov.it/portale/w/vulnerabilita-in-prodotti-palo-alto-networks-1 2026-07-13 17:29:59+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqk7scfxqw2e...
OSV-2026-736 Heap-buffer-overflow in coap_pdu_parse_header
OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=512517700 Crash type: Heap-buffer-overflow READ 1 Crash state: coappduparseheader coappduparse2 coappduparse...
OSV-2026-726 Use-after-poison in md_build_attribute
OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=512429151 Crash type: Use-after-poison READ 1 Crash state: mdbuildattribute mdprocessallblocks mdparse...
VulnCheck KEV: CVE-2026-28517
openDCIM version 23.04, through commit 4467e9c4, contains an OS command injection vulnerability in reportnetworkmap.php. The application retrieves the 'dot' configuration parameter from the database and passes it directly to exec without validation or sanitization. If an attacker can modify the...
Malicious Package
Overview @kindo/selfbot is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...
CVE-2026-8225
A vulnerability was identified in Open5GS up to 2.7.7. This affects the function pcfnpcfsmpolicycontrolhandledelete of the file src/pcf/sm-sm.c of the component delete Endpoint. The manipulation leads to denial of service. The attack can be initiated remotely. The exploit is publicly available an...
CVE-2026-28873
This issue was addressed with additional entitlement checks. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.4 and iPadOS 26.4. An app may be able to circumvent App Privacy Report logging...
jq: Signed-int overflow in `stack_reallocate` (jq VM stack)
...
Dashboard Import Overwrites ACL — Editor Privilege Escalation to Dashboard Admin
An Editor can overwrite a dashboard not owned by them to acquire admin on that specific dashboard. The user must have write access to the dashboard to escalate privilege...