CVE-2026-126389

The software n8n (versions before 1.123.89 ) is vulnerable to an authentication bypass within the Chat Trigger component. When operating in embedded chat mode , the setup GET webhook route fails to enforce user authentication, allowing unauthenticated attackers to send GET requests to the chat we...

EUVD-2026-124854

The Streamit WordPress plugin before 1.3.10 does not perform any authorization or nonce verification on one of its unauthenticated AJAX routes, which invokes an attacker-supplied PHP function with an attacker-supplied argument array, allowing unauthenticated attackers to call arbitrary functions...

cve-2022-22947

Spring Cloud Gateway Actuator API SpEL Code Injection CVE-2022-22947 Build $ git clone https://github.com/twseptian/cve-2022-22947.git $ cd cve-2022-22947 $ docker build . -t cve-2022-22947 $ docker run -p 9000:9000 --name cve-2022-22947 cve-2022-22947 PoC send the following request to add a rout...

rover

rover Proof of Concept code for CVE-2016-5696 Rover is a small python program to discover abitrary client source ports as shown in CVE-2016-569. Once the source port is known, the 4 tuple of information needed to confirm that two host are communicating can be completed. When run, rover establishe...

nextpnr

nextpnr -- a portable FPGA place and route tool nextpnr aims to be a vendor neutral, timing driven, FOSS FPGA place and route tool. Currently nextpnr supports: Lattice iCE40 devices supported by Project IceStorm Lattice ECP5 devices supported by Project Trellis Lattice Nexus devices supported by...

Python Flask-Security-Too <=5.3.2 - Open Redirect

An open redirect vulnerability exists in the python package Flask-Security-Too prior to version 5.3.3. Attackers can abuse the 'next' parameter on the /login and /register routes to redirect unsuspecting users to malicious sites via crafted URLs, which could lead to phishing or other attacks NVD...

MasterStudy LMS WordPress Plugin <= 3.2.5 - SQL Injection

The MasterStudy LMS WordPress Plugin for Online Courses and Education plugin for WordPress is vulnerable to union based SQL Injection via the 'user' parameter of the /lms/stm-lms/order/items REST route in all versions up to, and including, 3.2.5 due to insufficient escaping on the user supplied...

WordPress HTML5 Video Player < 2.5.27 - SQL Injection

The HTML5 Video Player WordPress plugin before 2.5.27 does not sanitize and escape a parameter from a REST route before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks id: CVE-2024-5522 info: name: WordPress HTML5 Video Player 2.5.27 - SQL Injection...

WordPress < 4.8.2 - Authenticated Open Redirect

WordPress versions before 4.8.2 contain an open redirect caused by improper validation in wp-admin/edit-tag-form.php and wp-admin/user-edit.php, letting attackers redirect users to malicious sites, exploit requires access to admin interface. id: CVE-2017-14725 info: name: WordPress 4.8.2 -...

Mastodon - Open Redirect

Mastodon version 4.5.8, 4.4.15, 4.3.21 is vulnerable to unauthenticated Open Redirect vulnerability CWE-601 exists in the /web/ route due to improper handling of URL-encoded path segments. id: CVE-2026-33868 info: name: Mastodon - Open Redirect author: theamanrawat severity: medium description: |...

Divi Plus <= 2.4.0 - Unauthenticated Arbitrary File Read

The Divi Plus WordPress plugin through 2.4.0 exposes the /wp-json/elicus/v1/dipl-modules/svg-animator REST route with a permission callback that returns true unconditionally, and passes the svgimage parameter to filegetcontents without any path restriction, so an unauthenticated attacker can read...

WordPress Paid Memberships Pro <2.9.8 - Blind SQL Injection

WordPress Paid Memberships Pro plugin before 2.9.8 contains a blind SQL injection vulnerability in the 'code' parameter of the /pmpro/v1/order REST route. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of th...

Essential Blocks < 6.4.0 - Information Disclosure

Gutenberg Essential Blocks WordPress plugin 6.4.0 contains an information disclosure caused by unrestricted access to a public REST route exposing non-public WooCommerce sales metrics, letting unauthenticated users read product sales data. id: CVE-2026-13153 info: name: Essential Blocks 6.4.0 -...

aegis

Aegis Aegis is a fully open-source FPGA, from the silicon up. Open-source FPGA efforts have made huge strides: projects like Project IceStorm and Apicula reverse-engineer proprietary bitstream formats, OpenFPGA and FABulous generate open FPGA fabric from architecture descriptions, and Cologne...

CVE-2026-128065

@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. From 1.14.0 through 1.14.1, XdsServer in @grpc/grpc-js-xds can acknowledge Route and VirtualHost resources while failing to apply their RBACPerRoute override configurations. The override parser is n...

CVE-2026-126367

@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Before 1.13.2, and from 1.14.0 through 1.14.1, the @grpc/grpc-js-xds SafeRegexValueMatcher and PathSafeRegexValueMatcher add start and end anchors without grouping a supplied top-level alternation. ...

CVE-2026-126357

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.13.16, mount and app.mount can remove a dynamic mount prefix using the route-pattern length rather than the matched-prefix length, allowing a crafted path to be forwarded as a protected inner route...

RTSPbrute

RTSPBrute Inspired by Cameradar Features Find accessible RTSP streams on any target Brute-force stream routes Brute-force credentials Make screenshots on accessible streams Generate user-friendly report of the results: .txt file with each found stream on new line .html file with screenshot of eac...

CVE-2026-126367: grpc grpc-node: @grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon

@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Before 1.13.2, and from 1.14.0 through 1.14.1, the @grpc/grpc-js-xds SafeRegexValueMatcher and PathSafeRegexValueMatcher add start and end anchors without grouping a supplied top-level alternation. ...

GHSA-R7HQ-Q2XM-6C5M @grpc/grpc-js: safe_regex incorrectly applies partial string matching for patterns with alternation

Summary The StringMatcher/PathMatcher for saferegex builds its RE2 as ^$regex$ with no surrounding group. Because alternation has the lowest precedence, a pattern "a|b|c" compiles to /^a|b|c$/ -- "starts with a" OR "contains b" OR "ends with c" instead of a full match of the whole value...