GNUnet P2P Framework 0.26.2

GNUnet is a peer-to-peer framework with focus on providing security. All peer-to-peer messages in the network are confidential and authenticated. The framework provides a transport abstraction layer and can currently encapsulate the network traffic in UDP IPv4 and IPv6, TCP IPv4 and IPv6, HTTP, o...

Exploit for SQL Injection in Sequelizejs Sequelize

CVE-2026-30951 Sequelize JSON Cast SQL Injection ★ CVE-2026...

Exploit for SQL Injection in Mikro-Orm Mikroorm

CVE-2026-43220 MikroORM SQL Injection ★ CVE-2026-43220 Mikro...

Exploit for CVE-2026-0603

CVE-2026-0603 Hibernate ORM Injection / Second-Order SQL Injec...

Exploit for Expression Language Injection in Mathjs

CVE-2026-40897 Remote Code Execution in Math.js Expression Par...

Exploit for Eval Injection in Langflow

CVE-2026-33017 Langflow RCE ★ CVE-2026-33017 Langflow Remote...

Exploit for CVE-2026-20896

CVE-2026-20896: Gitea Docker Image Authentication Bypass PoC...

Exploit for CVE-2026-16723

CVE-2026-16723 Fastjson RCE ★ CVE-2026-16723 Fastjson @JSONT...

Exploit for Memory Allocation with Excessive Size Value in Apache Http_Server

CVE-2026-49975 HTTP/2 Bomb ★ CVE-2026-49975 HTTP/2 Bomb PoC ★...

Exploit for SQL Injection in Ghost

CVE-2026-26980 ★ CVE-2026-26980 TryGhost Ghost CMS Content AP...

CVE-2026-65644

Rocket.Chat in versions before 8.8.0, 8.7.1, 8.6.2, 8.5.3, 8.4.6, 8.3.8, 8.2.8, 8.1.8, and 7.10.15 has a REST API endpoint POST /api/v1/livechat/visitor that accepts an unauthenticated, unsanitized name field for Livechat visitors. This name is stored raw and later rendered via...

Exploit for Incorrect Resource Transfer Between Spheres in Openclaw

CVE-2026-25253 OpenClaw 1-Click RCE ★ CVE-2026-25253 OpenClaw...

CVE-2026-18409

The WPForms Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Single Line Text and Paragraph Text Field Values in all versions up to, and including, 2.0.0.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

Exploit for Path Traversal in Langflow

This post is a research article published by EQSTLabhttps://g...

MAL-2026-14343 Malicious code in chai-as-soul (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 244e923b668eb903bcc217cb1eda26ce2227f37bd14abc3699d60c222c4f4e62 [email protected] is a typosquat/repackage of pino: LICENSE, README, docs, and lib/ are copied from pinojs/pino, package.json description is unrelat...

CVE-2026-18409

The WPForms Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Single Line Text and Paragraph Text Field Values in all versions up to, and including, 2.0.0.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

CVE-2026-18409 WPForms Pro <= 2.0.0.2 - Unauthenticated Stored Cross-Site Scripting via Single Line Text and Paragraph Text Field Values

The WPForms Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Single Line Text and Paragraph Text Field Values in all versions up to, and including, 2.0.0.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

EUVD-2026-63812

The WPForms Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Single Line Text and Paragraph Text Field Values in all versions up to, and including, 2.0.0.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

MAL-2026-14342 Malicious code in coin-fees (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f47c61fd59fb65dc8c8932e3e913dd83f18fc8af1d5f06b03cae327228821703 package.json declares a postinstall hook that runs index.js on every install. The script hex-decodes and concatenates a hardcoded destination hostnam...

Malicious code in coin-fees (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f47c61fd59fb65dc8c8932e3e913dd83f18fc8af1d5f06b03cae327228821703 package.json declares a postinstall hook that runs index.js on every install. The script hex-decodes and concatenates a hardcoded destination hostnam...