Claude Opus 5 Helped Researchers Take Over OpenAI Staff Accounts via Chained Flaws

Three researchers at the security firm Hacktron used Anthropic's Claude Opus 5 to chain two flaws and take over the ChatGPT and Codex accounts of several OpenAI employees, then reach an internal OpenAI code repository. The chain began with a bug in the software that runs OpenAI's public help foru...

EUVD-2026-83601

A flaw was found in the Admin REST API of Keycloak, an open-source identity and access management solution. The issue occurs in the group-membership endpoints where the system fails to check if a group grants administrative privileges before allowing a user to be added. This allows a delegated...

CVE-2026-18346 TikTok <= 1.4.1 - Missing Authorization to Unauthenticated TikTok Integration Takeover via 'auth_code' Parameter

The TikTok plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.4.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to overwrite the merchant's stor...

CVE-2026-86591

The Botiga Pro WordPress plugin before 1.6.5 does not perform any authorisation checks on one of its REST routes, allowing unauthenticated users to update arbitrary WordPress options with arbitrary values, which could lead to privilege escalation and a full site takeover. The same route also allo...

CVE-2026-86814

The UsersWP WordPress plugin before 1.5.10 does not verify that a social login provider has confirmed ownership of an email address before using it to resolve an existing account, allowing unauthenticated attackers to log in as any user, including administrators, whose email address they can asse...

CVE-2026-92421

The Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin (versions 1.1.0 through

CVE-2026-92421 Hydra Booking 1.1.0 - < 1.2.3 - Hydra Host+ Host Profile Takeover via IDOR

The Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin before 1.2.3 does not verify that the host record being modified belongs to the user making the request, allowing authenticated users holding a Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin...

CVE-2026-86814

The UsersWP WordPress plugin before 1.5.10 fails to verify that a social login provider has confirmed ownership of an email address before using it to resolve an existing account. This allows unauthenticated attackers to take over any user account—including administrators—by asserting a victim's ...

CVE-2026-86591

The Botiga Pro WordPress plugin before 1.6.5 is missing authorization checks on its Templates Builder REST route , allowing unauthenticated users to update arbitrary WordPress options with arbitrary values. This can lead to privilege escalation and a full site takeover . The same route also permi...

EUVD-2026-83506

The UsersWP WordPress plugin before 1.5.10 does not verify that a social login provider has confirmed ownership of an email address before using it to resolve an existing account, allowing unauthenticated attackers to log in as any user, including administrators, whose email address they can asse...

CVE-2026-86814 UsersWP - Social Login < 1.5.10 - Unauthenticated Account Takeover via Unverified Provider Email

The UsersWP WordPress plugin before 1.5.10 does not verify that a social login provider has confirmed ownership of an email address before using it to resolve an existing account, allowing unauthenticated attackers to log in as any user, including administrators, whose email address they can asse...

EUVD-2026-83505

The Botiga Pro WordPress plugin before 1.6.5 does not perform any authorisation checks on one of its REST routes, allowing unauthenticated users to update arbitrary WordPress options with arbitrary values, which could lead to privilege escalation and a full site takeover. The same route also allo...

ai-exploits

Эксплойты AI У мира ИИ есть проблема безопасности, и она не ограничивается только вводимыми данными для LLM, таких как ChatGPT. Основываясь на исследованиях, проведенных Protect AI и независимыми экспертами по безопасности на платформе Huntr Bug Bounty, существуют гораздо более эффективные и...

second-order

Second Order Scans web applications for second-order subdomain takeover by crawling the app, and collecting URLs and other data that match certain rules, or respond in a certain way. Installation From binary Download a prebuilt binary from the releases page and unzip it. From source Go version 1....

second-order

Second Order Сканирует веб-приложения на перехват поддоменов второго порядка, обходя приложение и собирая URL и другие данные, соответствующие определённым правилам или отвечающие определённым образом. Установка Из бинарного файла Скачайте предварительно собранный бинарный файл со страницы релизо...

CVE-2020-35262

CVE-2020-35262: Хранимый межсайтовый скриптинг XSS в роутере Digisol DG-HR3400 Описание уязвимости Было обнаружено, что уязвимая конечная точка не имеет проверки входных данных на стороне сервера и не фильтрует на стороне клиента внедрение вредоносных скриптов. Злоумышленник может использовать эт...

kanha

Kanha - Набор для пентестинга веб-приложений, написанный на rust 🦀 Installation ⦾ Subcommands ⦾ Contribute Kanha — это инструмент, который может помочь вам выполнять различные атаки на основе целевого домена. С помощью одного только kanha вы можете выполнять, Fuzzing, Reverse dns lookup, common...

CVE-2024-50483

CVE-2024-50483 Meetup = 0.1 - Обход аутентификации через захват учётной записи Описание: Плагин Meetup для WordPress уязвим к обходу аутентификации во всех версиях до 0.1 включительно. Это связано с тем, что плагин не проверяет должным образом личность пользователя перед его аутентификацией через...

CVE-2024-29868

CVE-2024-29868: Использование криптографически слабого ГПСЧ при генерации токена восстановления Этот репозиторий содержит proof of concept, связанный с CVE-2024-29868 , который затрагивает Apache StreamPipes с версии v0.69.0 по 0.93.0. Описание : Уязвимость, связанная с использованием...

CVE-2025-59501

CVE-2025-59501 Entra ID統合が有効なSCCMのAdminService APIを悪用して、フル管理者に昇格しSCCM階層を乗っ取るためのPoCです。詳細はこちらのブログをご覧ください。 必要条件 uv インストール root@kitploit: git clone https://github.com/garrettfoster13/CVE-2025-59501.git cd CVE-2025-59501/ uv sync 使用方法 このツールにはtokenとadminの2つのモジュールがあります。 root@kitploit: ➜ CVE-2025-59501...