CVE-2026-19486

A Server-Side Request Forgery SSRF vulnerability in Google Cloud Gemini Enterprise Agent Platform App Builder versions prior to 2026-06-01 on Google Cloud Platform allows an unauthenticated attacker to leak the Compute Engine default service account access token. This vulnerability was patched on...

CVE-2026-87859 morgan vulnerable to Log Injection via unescaped double quote in quoted log fields

morgan is an HTTP request logger middleware for Node.js. In versions before 1.12.1, its escapeLogField function does not escape the double quote character, which delimits the quoted fields of the Apache combined log format that morgan emits. An unauthenticated remote attacker who controls a value...

EUVD-2026-76027

morgan is an HTTP request logger middleware for Node.js. In versions before 1.12.1, its escapeLogField function does not escape the double quote character, which delimits the quoted fields of the Apache combined log format that morgan emits. An unauthenticated remote attacker who controls a value...

CVE-2026-69083_exploit

CVE-2026-69083 — SiYuan 인증되지 않은 SQL 인젝션 SiYuanGo 기반 지식 베이스 앱의 asset-content 검색 엔드포인트를 통한 인증되지 않은 SQL 인젝션입니다. POST /api/search/fullTextSearchAssetContent는 사용자가 제어하는 query 값을 이스케이프 없이 REGEXP 절에 직접 연결하여 원시 SQL 문을 구성합니다 kernel/model/assetcontent.go, assetContentFieldRegexp: root@kitploit: SELECT FROM...

GHSA-763M-79HH-57F2 vulnerabilities

Vulnerabilities for packages: open-webui...

CVE-2026-19486

CVE-2026-19486 is a Server-Side Request Forgery (SSRF) vulnerability in Google Cloud Gemini Enterprise Agent Platform App Builder (versions prior to 2026-06-01 on Google Cloud Platform). An unauthenticated attacker can exploit it to leak the Compute Engine default service account access token , r...

EUVD-2026-76021

A Server-Side Request Forgery SSRF vulnerability in Google Cloud Gemini Enterprise Agent Platform App Builder versions prior to 2026-06-01 on Google Cloud Platform allows an unauthenticated attacker to leak the Compute Engine default service account access token. This vulnerability was patched on...

CVE-2026-19486 SSRF in Gemini Enterprise Agent Platform App Builder

A Server-Side Request Forgery SSRF vulnerability in Google Cloud Gemini Enterprise Agent Platform App Builder versions prior to 2026-06-01 on Google Cloud Platform allows an unauthenticated attacker to leak the Compute Engine default service account access token. This vulnerability was patched on...

CVE-2026-89179

WeenyGenius, a computer lab management system by Howyar Technologies, has a Missing Support for Integrity Check vulnerability. Unauthenticated attackers on the same network can intercept a student's connection packet and replay it, thereby forging the appearance that the student remains connected...

CVE-2026-89174

Smart Video Intercom System developed by Kingdom Communication Associated has a Missing Brute-force Protection vulnerability. Unauthenticated remote attackers can gain access to valid accounts through a large number of login attempts...

CVE-2026-89178

WeenyGenius, a computer lab management system by Howyar Technologies, has an Origin Validation Error vulnerability. Unauthenticated attackers on the same network can spoof the teacher workstation and send broadcast packets, causing student computers to attempt to establish a connection with the...

CVE-2026-89177

WeenyGenius, a computer lab management system by Howyar Technologies, has a Use of Insecure Protocol vulnerability. Due to the reliance on ZMTP Null mode, unauthenticated attackers on the same network can capture packets to leak transmitted data, or perform replay attacks with forged commands to...

CVE-2026-89175

Smart Video Intercom System developed by Kingdom Communication Associated has a Client-Side Authentication vulnerability. Unauthenticated remote attackers can bypass authentication to access specific pages and obtain partial system configuration values...

CVE-2026-89173

Smart Video Intercom System developed by Kingdom Communication Associated has a Sensitive Data Exposure vulnerability. Unauthenticated remote attackers can enumerate valid user accounts by exploiting differences in system responses...

EUVD-2026-76020

a-blog cms Ver. 3.2.33 and earlier contains a path traversal vulnerability, which allows an unauthenticated attacker to read or delete arbitrary files on the affected product...

CVE-2026-87727

a-blog cms Ver. 3.2.33 and earlier contains a path traversal vulnerability, which allows an unauthenticated attacker to read or delete arbitrary files on the affected product...

CVE-2026-87727

a-blog cms Ver. 3.2.33 and earlier contains a path traversal vulnerability, which allows an unauthenticated attacker to read or delete arbitrary files on the affected product...

CVE-2025-15679

CVE-2025-15679 affects the BMC (Baseboard Management Controller) root account , which can become active without a password under certain circumstances such as a reset to factory default operation. This grants unauthenticated local access with HIGH impact on confidentiality, integrity, and availab...

CVE-2025-11262-Lab

CVE-2025-11262 - Link Whisper Free 인증되지 않은 저장형 블라인드 XSS 요약 이 저장소는 WordPress 플러그인 Link Whisper Free 에 영향을 미치는 인증되지 않은 저장형 크로스 사이트 스크립팅 문제인 CVE-2025-11262 를 재현하기 위한 로컬 Docker 랩을 포함합니다. 이 랩은 두 가지 플러그인 버전을 비교합니다:...

CVE-2026-41940

CVE-2026-41940 - Обход аутентификации cPanel/WHM Этот репозиторий содержит английское отредактированное описание и инструмент проверки на Go для CVE-2026-41940 — обхода аутентификации cPanel/WHM, вызванного CRLF-инъекцией в обработке базовой аутентификации. Все списки живых целей, экспорты активо...