CVE-2026-62671

In Grav Login Plugin versions before 3.8.11, the taskRegenerate2FASecret() function is reachable via a top-level GET request with no nonce, Origin, or Referer check. Under SameSite=Lax, an off-site navigation can overwrite a logged-in user's TOTP secret, forcing 2FA re-enrollment. CVSS 5.4 MEDIUM...

secator v0.42.0

The pentester's swiss knife. Features • Supported commands • Installation • Usage • Documentation • Join us on Discord ! secator is a task and workflow runner used for security assessments. It supports dozens of well-known security tools and it is designed to improve productivity for pentesters a...

Agent Local Store (Zig)

Bootstrap encrypted local task storage on the implant before callback !/usr/bin/env python3 -- coding: utf-8 -- """Bootstrap encrypted agent-side task storage before callback Zig emitter.""" from typing import Any, Dict from kittysploit import from core.payloadgeneration.prestage.emitters.zig...

Agent Local Store (PowerShell)

Bootstrap encrypted local task storage on the implant before callback !/usr/bin/env python3 -- coding: utf-8 -- """Bootstrap encrypted agent-side task storage before callback PowerShell emitter.""" from typing import Any, Dict from kittysploit import from...

CVE-2026-72152

A flaw was found in the Linux kernel's Trusted Platform Module TPM TIS SPI driver. The waiteventinterruptibletimeout function incorrectly evaluates its condition after setting the task state, which can trigger a warning when debugging atomic sleeps and using the Interrupt Request IRQ wait path...

com.github.cafdataprocessing:data-processing-queue-helper (>=1.1.0-20, <=1.3.0-70), com.github.cafdataprocessing:data-processing-task-receiver (>=1.1.0-20, <=1.3.0-70) +35 more potentially affected by CVE-2026-63336 via com.rabbitmq:amqp-client (3.5.3)

com.rabbitmq:amqp-client MAVEN version 3.5.3 is affected by a known vulnerability. The following packages have a transitive dependency on com.rabbitmq:amqp-client and may be impacted: - com.github.cafdataprocessing:data-processing-queue-helper =1.1.0-20, =1.1.0-20, =1.1.0-20, =1.0.0-212, =2.0.0-3...

com.ahome-it:ahome-tooling-server-core (1.1.0-release), com.ahome-it:ahome-tooling-server-hazelcast (1.1.0-release) +153 more potentially affected by CVE-2026-63335 via com.rabbitmq:amqp-client (3.5.7)

com.rabbitmq:amqp-client MAVEN version 3.5.7 is affected by a known vulnerability. The following packages have a transitive dependency on com.rabbitmq:amqp-client and may be impacted: - com.ahome-it:ahome-tooling-server-core 1.1.0-release - com.ahome-it:ahome-tooling-server-hazelcast 1.1.0-releas...

CVE-2026-75778

A vulnerability was identified in code-projects Task Management System 1.0. This affects the function Operation::selectwithmultiplecondition of the file /index.php of the component Login Form. Such manipulation of the argument email leads to sql injection. It is possible to launch the attack...

EUVD-2026-60732

A vulnerability was identified in code-projects Task Management System 1.0. This affects the function Operation::selectwithmultiplecondition of the file /index.php of the component Login Form. Such manipulation of the argument email leads to sql injection. It is possible to launch the attack...

CVE-2026-75778 code-projects Task Management System Login Form index.php select_with_multiple_condition sql injection

A vulnerability was identified in code-projects Task Management System 1.0. This affects the function Operation::selectwithmultiplecondition of the file /index.php of the component Login Form. Such manipulation of the argument email leads to sql injection. It is possible to launch the attack...

CVE-2026-75778

Task Management System 1.0 has a SQL injection in Operation::select_with_multiple_condition within /index.php of the Login Form; the email argument is unparameterized. CVSS 7.3 (HIGH), exploitable remotely with no auth; proof-of-concept exploit is publicly available. No patch or workaround is doc...

BIT-AIRFLOW-2026-67587 Apache Airflow: DAG-author remote code execution on the Scheduler via a Serde `Callback` deserialization gadget

Apache Airflow's Task SDK rebuilt a Callback object from serialized data by re-running its constructor, which imports the module named by the stored callback path. Because SyncCallback is itself an Airflow class it passes the default alloweddeserializationclasses allow-list, so tightening that...

PT-2026-76965

Name of the Vulnerable Software and Affected Versions code-projects Task Management System version 1.0 Description An issue exists in the Login Form component within the /index.php file. Specifically, the Operation::select with multiple condition function is susceptible to SQL injection, a...

CVE-2026-75778: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was identified in code-projects Task Management System 1.0. This affects the function Operation::selectwithmultiplecondition of the file /index.php of the component Login Form. Such manipulation of the argument email leads to sql injection. It is possible to launch the attack...

CVE-2026-75109

Determined fails to authorize requests on the generic task kill, pause, and unpause endpoints in the API handlers. Authenticated attackers can disrupt other users' workloads by terminating, pausing, or unpausing tasks they do not own...

CVE-2026-75109

Determined's API handlers in internal/api_generic_tasks.go lack authorization checks on generic task kill, pause, and unpause endpoints. Authenticated low-privilege users can terminate, pause, or unpause tasks owned by other users, causing high availability impact (CVSS 7.1 HIGH). Exploitation st...

CVE-2026-75109 Determined Missing Authorization Check on Generic Task Endpoints

Determined fails to authorize requests on the generic task kill, pause, and unpause endpoints in the API handlers. Authenticated attackers can disrupt other users' workloads by terminating, pausing, or unpausing tasks they do not own...

EUVD-2026-60388

Determined fails to authorize requests on the generic task kill, pause, and unpause endpoints in the API handlers. Authenticated attackers can disrupt other users' workloads by terminating, pausing, or unpausing tasks they do not own...

CVE-2026-75109 Determined Missing Authorization Check on Generic Task Endpoints

Determined fails to authorize requests on the generic task kill, pause, and unpause endpoints in the API handlers. Authenticated attackers can disrupt other users' workloads by terminating, pausing, or unpausing tasks they do not own...

CVE-2026-75109 Determined Missing Authorization Check on Generic Task Endpoints

Determined fails to authorize requests on the generic task kill, pause, and unpause endpoints in the API handlers. Authenticated attackers can disrupt other users' workloads by terminating, pausing, or unpausing tasks they do not own...