CVE-2026-22905: Improper Limitation of a Pathname to a Restricted Directory

An unauthenticated remote attacker can bypass authentication by exploiting insufficient URI validation and using path traversal sequences e.g., /js/../cgi-bin/post.cgi, gaining unauthorized access to protected CGI endpoints and configuration downloads...

CVE-2026-22904: Stack-based Buffer Overflow

Improper length handling when parsing multiple cookie fields including TRACKID allows an unauthenticated remote attacker to send oversized cookie values and trigger a stack buffer overflow, resulting in a denial‑of‑service condition and possible remote code execution...

CVE-2025-6830: Improper Neutralization of Special Elements used in an SQL Command

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Xpoda Türkiye Information Technology Inc. Password Module allows SQL Injection. This issue affects Password Module: through 11022026...

CVE-2026-25846: Insertion of Sensitive Information into Log File

In JetBrains YouTrack before 2025.3.119033 access tokens could be exposed in Mailbox logs...

CVE-2026-25814: Improper Neutralization of Special Elements in Output Used by a Downstream Component

PlaciPy is a placement management system designed for educational institutions. In version 1.0.0, User-controlled query parameters are passed directly into DynamoDB query/filter construction without validation or sanitization...

XMap: Fast Internet-Wide IPv4 and IPv6 Network Scanner

XMap is an open-source network scanner designed for performing fast Internet-wide IPv4 and IPv6 network research scanning. XMap was initially developed as the research artifact of a paper published at 2021 IEEE/IFIP International Conference on Dependable Systems and Networks DSN '21 and then made...

CVE-2026-2222: Improper Neutralization of Input During Web Page Generation

A weakness has been identified in code-projects Online Reviewer System 1.0. Affected by this vulnerability is an unknown functionality of the file /system/system/admins/manage/users/btnfunctions.php. Executing a manipulation of the argument firstname can lead to cross site scripting. The attack m...

Exploit for CVE-2026-23550

🔥 CVE-2026-23550 Modular DS Scanner Multi-threaded Python scan...

XSS-Vulnerability-Scanner

XSS...

WEB-APPLICATION-VULNERABILITY-SCANNER

WEB-APPLICATION-VULNERABILITY-SCANNER This task focuses on dev...

XSS-Scanner

XSS-Scanner This is a Cross Site Scripting Vulnerability scann...

CVE-2025-13818: Time-of-check Time-of-use (TOCTOU) Race Condition

Local privilege escalation vulnerability via insecure temporary batch file execution in ESET Management Agent...

CVE-2026-2065: Missing Authentication for Critical Function

A security flaw has been discovered in Flycatcher Toys smART Pixelator 2.0. Affected by this issue is some unknown functionality of the component Bluetooth Low Energy Interface. Performing a manipulation results in missing authentication. The attack can only be performed from the local network. T...

CVE-2026-24930: Concurrent Execution using Shared Resource with Improper Synchronization

UAF concurrency vulnerability in the graphics module. Impact: Successful exploitation of this vulnerability may affect availability...

CVE-2026-24917: Use After Free

UAF vulnerability in the security module. Impact: Successful exploitation of this vulnerability may affect availability...

CVE-2026-24916: Exposure of Sensitive Information to an Unauthorized Actor

Identity authentication bypass vulnerability in the window module. Impact: Successful exploitation of this vulnerability may affect service confidentiality...

CVE-2026-24915: Out-of-bounds Read

Out-of-bounds read issue in the media subsystem. Impact: Successful exploitation of this vulnerability will affect availability and confidentiality...

CVE-2026-24914: Use After Free

Type confusion vulnerability in the camera module. Impact: Successful exploitation of this vulnerability may affect availability...

CVE-2026-21626: Exposure of Sensitive Information to an Unauthorized Actor

Access control settings for forum post custom fields are not applied to the JSON output type, leading to an ACL violation vector an information disclosure...

📄 Xiongmai XM530 ONVIF / RTSP Security Scanner

This project is a unified PHP-based security scanner designed to identify critical vulnerabilities in IP cameras, with a primary focus on ONVIF authentication bypass CVE-2025-65856 and unauthenticated RTSP stream exposure. The tool provides a single-file web interface that allows scanning a singl...