CVE-2026-30945-PoC

🗑️ CVE-2026-30945 StudioCMS IDOR — Revocación Arbitraria de Tokens API que Conduce a Denegación de Servicio NVD • Advisory • CWE-639 Resumen El endpoint DELETE /studiocmsapi/dashboard/api-tokens en StudioCMS ≤ 0.3.0 permite que cualquier usuario autenticado con privilegios de editor o superiores...

CVE-2026-30944-PoC

🔓 CVE-2026-30944 Escalada de Privilegios en StudioCMS mediante Generación Insegura de Tokens API NVD • Advisory • CWE-639 Resumen El endpoint POST /studiocmsapi/dashboard/api-tokens en StudioCMS ≤ 0.3.0 permite que cualquier usuario autenticado como mínimo con rol Editor genere tokens API para...

CVE-2026-39987-lab-or-marimo-cve-lab

Guía de Laboratorio CVE-2026-39987 Ejecución Remota de Código Pre-Autenticación mediante Bypass de Autenticación en WebSocket de Terminal Un laboratorio Docker educativo para comprender, reproducir y parchear esta vulnerabilidad crítica en marimo. Tabla de Contenidos Descripción General...

CVE-2026-93543

An out-of-bounds read in libXi's XI2 class parser in libXi before 1.8.4 could be used by malicious X servers to crash an attached X client...

Security Bulletin: IBM Integration Designer is vulnerable to multiple CVEs

Summary Vulnerability in the IBM® Runtime Environment Java™ Version 8 used by IBM Integration Designer. IBM Integration Designer has addressed the following CVEs: CVE-2026-61308 and CVE-2026-60589 Vulnerability Details CVEID:CVE-2026-61308 DESCRIPTION: Difficult to exploit vulnerability allows...

CVE-2026-29000

Script sencillo que explota CVE-2026-29000. Todo lo que necesitas es la clave pública en formato PEM y puedes usarlo. Para más información sobre la vulnerabilidad lee: https://www.codeant.ai/security-research/pac4j-jwt-authentication-bypass-public-key...

CVE-2026-23723-POC

PoC CVE-2026-23723 - Ayudante de Explotación de Inyección SQL Autenticada en WeGIA Inyección SQL Basada en Errores Autenticada en WeGIA ≤ 3.6.1 GHSA-xfmp-2hf9-gfjp | Aviso Oficial Autor Original del PoC / Reportante : ViniCastro2001 GHSA Publicado por : nilsonLazarin mantenedor del proyecto Este...

Critical: Red Hat Security Advisory: unbound security update

An update for unbound is now available for Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

unbound: Unbound: Heap buffer overflow and possible Remote Code Execution when digesting DNSKEY

A flaw was found in Unbound's DNSSEC validator. A remote attacker can exploit this vulnerability by controlling a malicious zone and sending a specially crafted DNSKEY record. This can lead to a heap buffer overflow, potentially resulting in a denial of service or remote code execution...

CVE-2026-41651

CVE-2026-41651 - Vulnerabilidad Pack2TheRoot Resumen CVE-2026-41651, también conocida como la vulnerabilidad Pack2TheRoot, es una falla de seguridad crítica que afecta a ciertos sistemas Linux. Permite a un atacante escalar privilegios, obteniendo potencialmente acceso root o comprometiendo el...

Security Bulletin: Multiple Vulnerabilities affect IBM Decision Optimization for Cloud Pak for Data.

Summary Multiple Vulnerabilities were addressed in IBM Decision Optimization for Cloud Pak for Data version 5.3.1 before Patch 13 Vulnerability Details CVEID:CVE-2026-41254 DESCRIPTION: Little CMS lcms2 through 2.18 has an integer overflow in CubeSize in cmslut.c because the overflow check is...

CVE-2021-25741

Acerca de Es un exploit para la vulnerabilidad CVE-2021-25741. Esta vulnerabilidad permite montar el sistema de archivos de Node dentro de un nuevo POD con privilegios de lectura y escritura. Puedes leer más sobre la vulnerabilidad aquí:...

unbound: Unbound: Heap buffer overflow and possible Remote Code Execution when digesting DNSKEY

A flaw was found in Unbound's DNSSEC validator. A remote attacker can exploit this vulnerability by controlling a malicious zone and sending a specially crafted DNSKEY record. This can lead to a heap buffer overflow, potentially resulting in a denial of service or remote code execution...

Critical: Red Hat Security Advisory: unbound security update

An update for unbound is now available for Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

CVE-2026-42281

CVE-2026-42281: MagicMirror² ≤ 2.35.0 - SSRF sin autenticación vía endpoint /cors Descubierto y reportado por: Astaruf Informe completo: https://nstsec.com/en/posts/magicmirror-ssrf-cve-2026-42281/ Aviso oficial: Avisos de seguridad de MagicMirrorOrg/MagicMirror Entrada NVD:...

CVE-2026-41653

CVE-2026-41653: BentoPDF ≤ 2.8.2 - XSS Almacenado → Exfiltración de Archivos Descubierto y reportado por: Astaruf Informe completo: https://nstsec.com/en/posts/bentopdf-xss-cve-2026-41653/ Aviso upstream: Aviso GHSA de alam00000/bentopdf Entrada NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-4165...

CVE-2026-40487

CVE-2026-40487 - Postiz = 2.21.5 - Subida Arbitraria de Archivos mediante Suplantación de MIME-Type a XSS Almacenado y Toma de Control de Cuenta Descubierto y reportado por: Astaruf Informe completo: https://nstsec.com/en/posts/postiz-xss-cve-2026-40487/ Entrada NVD:...

Mass-Scanner-CVE-2026-3891

Escáner Masivo CVE-2026-3891 Una presentación limpia y animada de GitHub para un Escáner Masivo CVE-2026-3891 basado en Python, enfocado en validar un comportamiento específico de AJAX en WordPress dentro de entornos controlados. Este repositorio está destinado estrictamente a pruebas de segurida...

4jfinder.github.io

Searchable Log4j database Searchable page for CISA Log4j CVE-2021-44228 Affected Vendor & Software List, maintained by the US Cybersecurity and Infrastructure Security Agency CISA. How to use Download the index.html and cisalist.css files and run from your local computer. Hosted version at...

gstreamer-plugins-good: GStreamer: Remote Code Execution via MRF file parsing heap-based buffer overflow

A flaw was found in GStreamer. A remote attacker could exploit a heap-based buffer overflow vulnerability when parsing specially crafted MRF Multimedia Research Forum files. This vulnerability arises from insufficient validation of user-supplied data length before copying it to a heap-based buffe...