CVE-2026-129171

The NginxPulse monitoring tool (versions prior to 1.6.26 ) is vulnerable to an unauthenticated SQL injection via the /api/stats/:type endpoint. The root cause is the improper handling of the id and locationType parameters, which allows remote attackers to append SQL commands. Impact includes the ...

EUVD-2026-125596

NginxPulse 1.5.0 before 1.6.26 contains an unauthenticated sql injection vulnerability that allows remote attackers to append SQL via the id and locationType parameters of /api/stats/:type. Attackers can close the quoted table-name identifier and use error-based output to read database contents,...

fb-sleep-stats

fb-sleep-stats: Using Facebook to track your friends' sleep A small tool to show the potential privacy implications modern social media have. By tracking online/offline status of people on Facebook, it is possible to get an accurate image of their sleep pattern. Read the blog post:...

IOCScraper

IOC Scraper IOC Scraper utilises IOCPARSER service to fetch IOCs from different vendor Blogs, PDFs, and CSV files. Parsing IOCs is time-consuming process, using current script one can automatically extract and aggregate IOCs easily. Features Defanged IOCs : Supports extracting and defanging IOCs...

web

Network-wide ad blocking via your own Linux hardware Pi-hole website | Documentation | Discourse Forum | Donate Pi-hole Web Interface Pi-hole®'s Web interface based off of AdminLTE provides a central location to manage your Pi-hole and review the statistics generated by FTLDNS™. Easy-to-interpret...

raven

Raven - Advanced Cyber Threat Map Simplified, customizable and responsive. It uses D3.js with TOPO JSON, has 247 countries, 100,000 cities, and can be used in an isolated environment without external lookups!. Structure Offline - Demo Firefox, Chrome or Safari Live - Regression 500 attacks at onc...

WordPress Visitor Statistics <=5.7 - SQL Injection

WordPress Visitor Statistics plugin through 5.7 contains multiple unauthenticated SQL injection vulnerabilities. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site. id: CVE-2022-33965 info:...

CVE-2026-19794

CVE-2026-19794 WP-Stats = 2.56 - Unauthenticated Stored Cross-Site Scripting Plugin URL https://wordpress.org/plugins/wp-stats/ Description Unauthenticated reflected XSS in the statsauthor GET parameter of statspage. The sanitization filter striptags is applied before urldecode, allowing an...

ENV-CVE-2021-3975

ENV-CVE-2021-3975 — libvirt vulnerability reproduction environment This repository is a snapshot of the reproducible vulnerability environment for CVE-2021-3975 libvirt qemuProcessHandleMonitorEOF use-after-free, CWE-416, exported from the corresponding container image yan5ui/cve-2021-3975:tier1...

CVE-2026-97347

CVE-2026-97347 — Stored XSS in Post Views Stats Counter WordPress plugin | ---|--- Plugin| Post Views Stats Counter Affected version| ≤ 1.1.7 Bug class| Unauthenticated Stored XSS Entry point| User-Agent HTTP header Sink| Admin stats page options-general.php?page=postviewsstatsadminmenu CVSS 3.1|...

CVE-2026-115195

A flaw was found in Mautic. Due to missing permission enforcement in the Stats application programming interface API, internal database tables are accessible by default without proper authorization. An authenticated remote user, even with an account lacking assigned privileges, can query these...

CVE-2026-110525 MCB Stats <= 1.0.0 - Unauthenticated Stored XSS via User-Agent

The MCB WordPress plugin through 1.0.0 does not sanitise or escape request header values before storing them and later rendering them in the administrator statistics grid, allowing unauthenticated attackers to store malicious JavaScript that executes in an administrator's browser session when the...

Astra Linux – vulnerability in linux-6.1, linux-6.12, linux-6.18

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix HV VHCA stats zero-sized buffer allocation mlx5ehvvhcastatscreate is called from mlx5enicenable, prior to mlx5eopen. At that point, priv-statsnch remains zero, as it is only incremented in mlx5echannelstatsalloc,...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: dropmonitor: perform u64stats updates under IRQ-disabled section In netdmpackettracekfreeskbhit and netdmhwtrappacketprobe, u64statsupdatebegin / u64statsinc / u64statsupdateend were called after...

Astra Linux – vulnerability in linux-6.12

In the Linux kernel, the following vulnerability has been resolved: net: ioam6: fix OOB and missing lock When trace-type.bit6 is set: if trace-type.bit6 ... queue = skbgettxqueuedev, skb; qdisc = rcudereferencequeue-qdisc; This code can lead to an out-of-bounds access of the dev-tx array when...

Astra Linux – vulnerability in linux-6.1, linux-6.12, linux-6.18

In the Linux kernel, the following vulnerability has been resolved: dm-stats: fix a crash if allocation of per-cpu data fails If “dmkvzallocpercpuallocsize, cputonodecpu” fails, the code jumps to the “out” label and calls dmstatfree. dmstatfree does “foreachpossiblecpucpu...

PT-2026-135799

The ClusterRenderingService.dump method, accessible to processes holding android.permission.DUMP and android.permission.PACKAGE USAGE STATS, acts as a confused deputy. It allows attackers to write arbitrary values to Settings.Global.OVERLAY DISPLAY DEVICES, an operation normally requiring...

[SECURITY] Fedora 45 Update: plasma-activities-stats-6.8.1-1.fc45

Library to access the usage statistics data collected by the KDE activity man ager...

PT-2026-129077

PostgreSQL Anonymizer contains a vulnerability related to static masking and statistics persistence. Statistics pertaining to the original data remain visible in pg stats until an ANALYZE operation is performed on the table, either manually or by autovacuum. This issue is fixed in PostgreSQL...

Pylint: Arbitrary code execution via pickle deserialization of the stats cache in PYLINT_HOME

Impact Since 2006 / pylint 0.15.2, pylint caches its stats as pickles in PYLINTHOME and reload them on the next run with pickle.load. Someone without access to the configuration or linted code, but with access to the cache directory predictable PYLINTHOME on a multi-user host can write a crafted...