CVE-2026-119661 ShowDoc through 3.9.5 Authorization Bypass via paramDescLib deleteEntries

ShowDoc through 3.9.5 contains an authorization bypass vulnerability in the api/paramDescLib/deleteEntries endpoint that checks edit permission only for the first supplied entry id. Authenticated attackers can place their own entry id first and append other users' entry ids to permanently delete...

CVE-2026-119661

ShowDoc versions through 3.9.5 are susceptible to an authorization bypass vulnerability in the api/paramDescLib/deleteEntries endpoint. The root cause is that the system only validates edit permissions for the first entry ID provided in the request. This allows authenticated attackers to bypass s...

CVE-2026-119659

The software Blossom (versions through 1.17.1 ) is vulnerable to an authorization bypass in its folder endpoints. The root cause is that the FolderService queries filter exclusively on the folder id , failing to verify ownership. This allows authenticated users to access other users' folders by p...

CVE-2026-119653 Nging through 5.3.5 Directory Listing Disclosure via /user/autocomplete_path

Nging through 5.3.5 contains an information disclosure vulnerability that allows any authenticated backend user to list host directories by abusing the public-tagged /user/autocompletepath endpoint. Low-privileged users without file-manager permission can supply arbitrary paths in the query...

CVE-2026-119653

The Nging through 5.3.5 application is vulnerable to an information disclosure vulnerability due to missing authorization. Authenticated backend users can abuse the public-tagged /user/autocomplete_path endpoint to list host directories. By supplying arbitrary paths in the query parameter, low-pr...

CVE-2026-119600 tcpflow through 1.6.1 Out-of-Bounds Read via TCP Demultiplexer Payload Length

tcpflow through 1.6.1 contains an out-of-bounds read vulnerability that allows unauthenticated attackers to read process memory by sending packets with forged IP payload lengths. Attackers can inject crafted IPv4 or IPv6 TCP packets into captured traffic or pcap files to leak adjacent memory into...

CVE-2026-119600

The software tcpflow through version 1.6.1 is vulnerable to an out-of-bounds read via the TCP Demultiplexer payload length. An unauthenticated attacker can trigger this by injecting crafted IPv4 or IPv6 TCP packets into captured traffic or pcap files . The vulnerability, rooted in CWE-130 , allow...

CVE-2026-119565 Plausible Analytics through 3.2.1 Mass Assignment via Traffic Change Notification Update

Plausible Analytics through 3.2.1 contains a mass assignment vulnerability in updatetrafficchangenotification that allows authenticated site editors to reassign notifications by supplying a siteid parameter. Attackers can submit trafficchangenotificationsiteid set to another site's primary key vi...

CVE-2026-119565 Plausible Analytics through 3.2.1 Mass Assignment via Traffic Change Notification Update

Plausible Analytics through 3.2.1 contains a mass assignment vulnerability in updatetrafficchangenotification that allows authenticated site editors to reassign notifications by supplying a siteid parameter. Attackers can submit trafficchangenotificationsiteid set to another site's primary key vi...

CVE-2026-119565

Plausible Analytics versions through 3.2.1 are susceptible to a mass assignment vulnerability in the update_traffic_change_notification function. This flaw allows authenticated site editors to reassign notifications by including a site_id parameter in a PUT request to /sites/:domain/traffic-chang...

offsec-osgi-exploits

OSGi Exploits This repository contains exploits for multiple OSGi versions. OSGi v3.7.2 and Below OSGi v3.8-3.20...

CVE-2026-35029-PoC

CVE-2026-35029 — LiteLLM /config/update Broken Access Control LiteLLM 's /config/update endpoint does not check the caller's role privileges. Any authenticated user with a valid API Key without admin privileges can modify the proxy configuration, register malicious Pass-Through endpoints to achie...

EUVD-2026-112817

flat through 6.0.1 contains an uncontrolled resource allocation vulnerability in unflatten that allows attackers to create huge sparse arrays via unbounded numeric keys. Attackers can supply flattened keys such as a.4294967294, causing iteration with forEach, spread or JSON.stringify to block the...

CVE-2026-119051 flat through 6.0.1 Denial of Service via unflatten() Numeric Array Index Keys

flat through 6.0.1 contains an uncontrolled resource allocation vulnerability in unflatten that allows attackers to create huge sparse arrays via unbounded numeric keys. Attackers can supply flattened keys such as a.4294967294, causing iteration with forEach, spread or JSON.stringify to block the...

CVE-2026-113487

The GeoDirectory WordPress plugin before 2.8.196 does not properly sanitise or escape a post badge click-through link value before outputting it in an anchor element on a listing, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks against...

EUVD-2026-111725

The GeoDirectory WordPress plugin before 2.8.196 does not properly sanitise or escape a post badge click-through link value before outputting it in an anchor element on a listing, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks against...

SUSE CVE-2026-116744

ntop nDPI through 6.0 contains an out-of-bounds read vulnerability in dissectsoftetherhostfqdn in softether.c that compares hostname using the consumed byte count instead of data length. Remote attackers can send crafted short UDP datagrams on already-classified SoftEther flows, causing strncmp t...

PT-2026-127842

The GeoDirectory WordPress plugin before 2.8.196 does not properly sanitise or escape a post badge click-through link value before outputting it in an anchor element on a listing, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks against...

CVE-2020-25398

CVE-2020-25398 CSV Injection exists in InterMind iMind Server through 3.13.65 via the csv export functionality. Information Description: Attacker can configure specific data, which could be exported to malicious csv file with code execution payload and runs after opening on user's machine...

EUVD-2026-110492

ntop nDPI through 6.0 contains an out-of-bounds read vulnerability in dissectsoftetherhostfqdn in softether.c that compares hostname using the consumed byte count instead of data length. Remote attackers can send crafted short UDP datagrams on already-classified SoftEther flows, causing strncmp t...