📄 WordPress AI Engine: ChatGPT Chatbot 1.9.98 Shell Upload

This is a proof of concept that demonstrates the CVE-2023-51409 vulnerability in the WordPress AI Engine plugin in a controlled, safe, and non-destructive manner. It detects the plugin, tests unauthenticated access to the vulnerable endpoint, performs safe file uploads with non-executable content...

`time_calibrator` was removed from crates.io due to malicious code

It was reported timecalibrator contained malicious code, that would try to upload .env files to a server. The malicious crate had only 1 version published at 2026-02-28 and no evidence of actual usage. The crate was removed from crates.io and the user account was locked. There were no crates...

Path Traversal via Prefix Match Bypass in `_get_os_path`

This report is not public...

GHSA-P5VF-5754-X7P3 `polymarket-client-sdks` was removed from crates.io for malicious code

It appeared to be typosquatting existing crate polymarket-client-sdk sdks vs sdk and attempting to steal credentials from local files. The malicious crate had 1 version published on 2026-02-09 and had been downloaded only 33 times. There were no crates depending on this crate on crates.io. Thanks...

CVE-2026-1560

creationtimestamp| type| source ---|---|--- 2026-02-11 09:00:34+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mel4hgvx7e2a 2026-02-11 09:00:37+00:00| seen| https://infosec.exchange/users/offseq/statuses/116051177122807179 2026-02-11 09:59:59+00:00| seen|...

CVE-2025-9974

creationtimestamp| type| source ---|---|--- 2026-02-02 17:15:06+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mdvdvgl5k324 2026-07-09 08:53:47+00:00| seen| https://bsky.app/profile/femboyfurry.net/post/3mq7b3dqwks2b...

CVE-2026-1449

creationtimestamp| type| source ---|---|--- 2026-01-27 03:52:15+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mdeuadas2b23...

CVE-2026-22469

creationtimestamp| type| source ---|---|--- 2026-01-22 17:41:38+00:00| seen| https://gist.github.com/Darkcrai86/719f145d4565873b89d957c00caad383...

CVE-2026-22807

creationtimestamp| type| source ---|---|--- 2026-01-21 22:18:58+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mcxpbqntmt22 2026-01-22 02:37:45+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mcy5qja7p22t...

CVE-2026-21951

...

EUVD-2026-3455

Incorrect security UI in Google Chrome on Android prior to 144.0.7559.59 allowed a remote attacker to spoof the contents of the Omnibox URL bar via a crafted HTML page. Chromium security severity: Low...

EUVD-2026-2859

MCPJam inspector is the local-first development platform for MCP servers. Versions 1.4.2 and earlier are vulnerable to remote code execution RCE vulnerability, which allows an attacker to send a crafted HTTP request that triggers the installation of an MCP server, leading to RCE. Since MCPJam...

EUVD-2026-2953

Cross-site scripting vulnerability exists in multiple Network Cameras TRIFORA 3 series provided by TOA Corporation. If an attacking administrator configures the affected product with some malicious input, an arbitrary script may be executed on the web browser of a victim administrator who accesse...

EUVD-2026-2493

In the Linux kernel, the following vulnerability has been resolved: ACPICA: Avoid walking the Namespace if startnode is NULL Although commit 0c9992315e73 "ACPICA: Avoid walking the ACPI Namespace if it is not there" fixed the situation when both startnode and acpigblrootnode are NULL, the Linux...

EUVD-2026-1905

A security flaw has been discovered in UTT 进取 520W 1.7.7-180627. This impacts the function strcpy of the file /goform/ConfigWirelessBase. Performing a manipulation of the argument ssid results in buffer overflow. The attack is possible to be carried out remotely. The exploit has been released to...

EUVD-2026-1911

Malicious code in conmiyagi-map npm...

CVE-2023-49618

Improper buffer restrictions in some IntelR System Security Report and System Resources Defense firmware may allow a privileged user to potentially enable escalation of privilege via local access...

EUVD-2026-1479

OPEXUS eCASE Audit allows an authenticated attacker to save JavaScript as a comment in the "Estimated Staff Hours" field. The JavaScript is executed whenever another user visits the Project Cost tab. Fixed in OPEXUS eCASE Audit 11.14.2.0...

CVE-2025-68874

creationtimestamp| type| source ---|---|--- 2026-01-08 10:28:33+00:00| seen| https://gist.github.com/Darkcrai86/5c5965912c633226a27ad1629df01b77 2026-01-08 10:51:06+00:00| seen| https://gist.github.com/Darkcrai86/e95e49ad41679988a60dbc54c9d690f9 2026-01-08 12:54:12+00:00| seen|...

CVE-2026-22257

creationtimestamp| type| source ---|---|--- 2026-01-08 08:04:13+00:00| published-proof-of-concept| https://github.com/salvo-rs/salvo/security/advisories/GHSA-54m3-5fxr-2f3j 2026-01-08 19:40:50+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mbwqezghqa2u 2026-01-08...