CVE-2026-35029-PoC

CVE-2026-35029 — LiteLLM /config/update Broken Access Control LiteLLM 's /config/update endpoint does not check the caller's role privileges. Any authenticated user with a valid API Key without admin privileges can modify the proxy configuration, register malicious Pass-Through endpoints to achie...

CVE-2020-25398

CVE-2020-25398 CSV Injection exists in InterMind iMind Server through 3.13.65 via the csv export functionality. Information Description: Attacker can configure specific data, which could be exported to malicious csv file with code execution payload and runs after opening on user's machine...

Exploit for CVE-2026-96451

CVE-2026-96451 WordPress Ultimate Member plugin = 2.13.1 -...

CVE-2026-104477 Showdown through 2.1.0 XSS via unescaped quote in href and src attributes

Showdown through 2.1.0 contains a cross-site scripting vulnerability in the makehtml link and image subparsers, which fail to escape double quotes in destination URLs placed into href and src attributes. Attackers can craft markdown links or images containing a double quote followed by onerror or...

CVE-2026-104477 Showdown through 2.1.0 XSS via unescaped quote in href and src attributes

Showdown through 2.1.0 contains a cross-site scripting vulnerability in the makehtml link and image subparsers, which fail to escape double quotes in destination URLs placed into href and src attributes. Attackers can craft markdown links or images containing a double quote followed by onerror or...

CVE-2026-104477 Showdown through 2.1.0 XSS via unescaped quote in href and src attributes

Showdown through 2.1.0 contains a cross-site scripting vulnerability in the makehtml link and image subparsers, which fail to escape double quotes in destination URLs placed into href and src attributes. Attackers can craft markdown links or images containing a double quote followed by onerror or...

CVE-2026-104475 IDURAR ERP CRM through 4.1.1 Stored XSS via SVG Upload

IDURAR ERP CRM through 4.1.1 contains a stored cross-site scripting vulnerability that allows authenticated users to inject scripts by uploading unsanitized SVG files. Attackers can upload JavaScript-laden SVGs via the profile update or settings upload endpoints, which execute in victims' browser...

offsec-osgi-exploits

OSGi Exploits This repository contains exploits for multiple OSGi versions. OSGi v3.7.2 and Below OSGi v3.8-3.20...

CVE-2026-56098

A flaw in rubygem-katello allows an authorization bypass within the RegistryProxiesController component. The vulnerability is caused by an execution fall-through in the registry_authorize filter, where a missing return statement fails to halt execution after identifying an unauthorized request. T...

CVE-2026-56098

A flaw was found in rubygem-katello. The RegistryProxiesController in Katello contains an authorization bypass vulnerability due to an execution fall-through in the registryauthorize filter. While the application identifies unauthorized requests and triggers an error response via the unauthorized...

CVE-2026-56098: Observable Discrepancy

A flaw was found in rubygem-katello. The RegistryProxiesController in Katello contains an authorization bypass vulnerability due to an execution fall-through in the registryauthorize filter. While the application identifies unauthorized requests and triggers an error response via the unauthorized...

CLEANSTART-2025-LA45180 runc through 1

Security vulnerability affects the containerd package. runc through 1...

CLEANSTART-2025-NR50910 runc through 1

Security vulnerability affects the containerd package. runc through 1...

CVE-2026-19445

A remote, unauthenticated TLS client can make a server crash or call through a freed pointer if its snicallback assigns a different context to SSLSocket.context the documented way to select a certificate per server name and nothing else keeps the original ssl.SSLContext alive. Typical cases are...

CVE-2026-103396

bbs-go through version 4.4.6 is vulnerable to a permission bypass within the AdminMiddleware authorization logic. The root cause is that the dashboard.user.view permission rule incorrectly matches the /api/admin/user/synccount endpoint before the required dashboard.user.update rule is evaluated. ...

CVE-2026-103396 bbs-go through 4.4.6 Incorrect Authorization via /api/admin/user/synccount

bbs-go through 4.4.6 contains a permission bypass vulnerability in the AdminMiddleware authorization logic where the read-only dashboard.user.view permission rule matches the /api/admin/user/synccount endpoint before the intended dashboard.user.update rule. Authenticated users with only view...

CVE-2026-103043

The anchorme library (versions through 3.0.8 ) is vulnerable to a Regular Expression Denial of Service (ReDoS) . The issue resides in the IPv6 host extraction regex , where catastrophic backtracking can be triggered by specially crafted input strings with repeated patterns. This causes exponentia...

CVE-2026-84154

The GEOVIA Geospatial Data Manager software, spanning Release 3DEXPERIENCE R2024x through R2026x , is impacted by a Code Injection vulnerability. This flaw could enable an attacker to execute arbitrary code on the server . While the vulnerability has a CRITICAL severity score of 9.9, the provided...

CVE-2026-100836

Contrast through 1.20.0 contains a panic vulnerability in the transit-engine endpoint's ciphertextContainer.UnmarshalJSON function that fails to validate decoded ciphertext length before slicing. An authenticated workload with a valid mesh certificate can trigger a runtime panic by submitting a...

CVE-2026-100836 Edgeless Systems Contrast through 1.20.0 Denial of Service via ciphertextContainer

Contrast through 1.20.0 contains a panic vulnerability in the transit-engine endpoint's ciphertextContainer.UnmarshalJSON function that fails to validate decoded ciphertext length before slicing. An authenticated workload with a valid mesh certificate can trigger a runtime panic by submitting a...