CVE-2026-69083

creationtimestamp| type| source ---|---|--- 2026-08-03 22:00:06+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/96493 2026-08-04 00:00:12+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/96493...

Team WordPress Plugin (TLP Team) <= 5.0.9 - SQL Injection

Team WordPress plugin = 5.0.11 contains a SQL injection caused by improper sanitization and escaping of a parameter in an AJAX action accessible to unauthenticated users, letting remote attackers execute arbitrary SQL commands. id: CVE-2025-14124 info: name: Team WordPress Plugin TLP Team = 5.0.9...

CZ Loan Management <= 1.1 - SQL Injection

The CZ Loan Management WordPress plugin through 1.1 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection. id: CVE-2024-5975 info: name: CZ Loan Management = 1.1 - SQL Injection author...

offensive-security-labs

Offensive Security Labs A collection of hands-on offensive cy...

SUSE CVE-2026-52815

Gogs is an open source self-hosted Git service. Prior to 0.14.3, Gogs has an unauthenticated information disclosure vulnerability. The GET /api/v1/orgs/:orgname/teams endpoint at internal/route/api/v1/orgteam.go:8 returns all teams for any organization without requiring authentication. The route...

GHSA-JR9P-4H4J-6C58

creationtimestamp| type| source ---|---|--- 2026-07-30 07:00:03+00:00| seen| https://t.me/GithubRedTeam/95796 2026-07-30 14:00:04+00:00| seen| Telegram/47AGWfAWFIwZKzQclsisfXazYjpo74QYaHVlY-riLjwoTE 2026-07-31 00:00:29+00:00| published-proof-of-concept|...

PT-2026-66609

Name of the Vulnerable Software and Affected Versions LazyOwn RedTeam/APT Framework versions prior to 0.2.154 Description LazyOwn ships with default C2 credentials in payload.json and core/payload schema.py, which are passed unchanged to lazyc2.py for HTTP Basic authentication. This allows a...

Technology-Enhanced Tabletop Exercises for Cybersecurity Education: Lessons Learned

This innovative practice full paper examines the integration of technology-enhanced tabletop exercises TTXs into computing education, focusing on cybersecurity curricula. The motivation is to better prepare students for complex, collaborative problem solving typical of incident response and IT...

CVE-2026-12703

TeamViewer Full Client and Host for macOS before version 15.80 contain a business logic error that can allow an authenticated attacker to bypass a configured 2FA for Connections approval flow via Unattended Access and establish a remote connection to an affected macOS host...

CVE-2026-16475

creationtimestamp| type| source ---|---|--- 2026-07-29 12:01:54+00:00| seen| https://t.me/GithubRedTeam/95671 2026-07-29 20:00:03+00:00| seen| Telegram/Ig8EiCACgPrEXQ5i-DIyVp2gol1J9WigCZpGPavBW5BRY 2026-07-29 20:00:04+00:00| seen| Telegram/TzHuoTQGGjrCLjvjb-w7G7VP2W7wuY36FTVRC7C2rNjBX8 2026-07-30...

CVE-2026-65893

creationtimestamp| type| source ---|---|--- 2026-07-28 14:00:06+00:00| seen| https://t.me/GithubRedTeam/95522 2026-07-28 21:00:05+00:00| seen| https://t.me/GithubRedTeam/95588 2026-07-29 00:00:08+00:00| seen| Telegram/Q1yPTM1HokNzfLpkFc6iUNC00bXozy1Qi57vCkUVkSVfE8 2026-07-29 00:00:12+00:00| seen|...

PT-2026-65625

Name of the Vulnerable Software and Affected Versions goshs versions prior to 2.1.5 Description The multipart upload handler in the httpserver/updown.go file splits the part.FileName on the path separator but fails to reject the .. sequence. This allows an unauthenticated user to upload a file wi...

CVE-2026-9830

creationtimestamp| type| source ---|---|--- 2026-07-27 21:00:03+00:00| seen| Telegram/jZonNK9LGMSvoC2Djs86LRDYxmpyv3NgFItsHIOxESbAXI 2026-07-27 21:00:03+00:00| seen| Telegram/MNUQPIGpAGeGg3WQfZgMMHal6jpwzokF-mfI2PhU7te8xo 2026-07-27 21:00:03+00:00| seen| https://t.me/GithubRedTeam/95407 2026-07-2...

CVE-2026-16624

CVE-2026-16624 affects Cal.com OSS, where there is an authorization bypass on webhook creation via unvalidated teamId injection. Any authenticated user can create a webhook on any team and potentially exfiltrate booking data (e.g., organizer/attendee emails and custom responses) and, in some case...

EUVD-2026-47769

Cal.com OSS ships lacks authorization on webhook teamId creation, allowing any authenticated user to create a webhook on any team via unvalidated teamId injection, then steal booking data, including fields like organizer/attendee emails and custom responses, and conditionally video-call passwords...

CVE-2026-16624 CVE-2026-16624

Cal.com OSS ships lacks authorization on webhook teamId creation, allowing any authenticated user to create a webhook on any team via unvalidated teamId injection, then steal booking data, including fields like organizer/attendee emails and custom responses, and conditionally video-call passwords...

CVE-2026-16624 CVE-2026-16624

Cal.com OSS ships lacks authorization on webhook teamId creation, allowing any authenticated user to create a webhook on any team via unvalidated teamId injection, then steal booking data, including fields like organizer/attendee emails and custom responses, and conditionally video-call passwords...

PT-2026-63446

Name of the Vulnerable Software and Affected Versions Cal.com OSS affected versions not specified Description An authorization flaw exists during the creation of webhooks. An authenticated user can perform an unvalidated injection of the teamId variable to create a webhook for any team. This allo...

GHSA-H56G-4QW7-2MXG Gitea: Public-only API token restriction is not enforced on team API routes

Summary Gitea's /api/v1/teams/id API routes do not correctly enforce the public-only access token restriction. A public-only token is intended to limit API access to public repositories and public organizations. However, several team API routes continue to return private team repository metadata...

SUSE CVE-2026-64190

In the Linux kernel, the following vulnerability has been resolved: net: team: fix NULL pointer dereference in teamxmit during mode change teamchangemode clears team-ops with memset before restoring safe dummy handlers via teamadjustops. A concurrent teamxmit running under RCU on another CPU can...