CVE-2026-34926

⚠️ セキュリティ研究および法的免責事項 📌 このリポジトリの目的 このリポジトリは、教育、学術、および承認されたサイバーセキュリティ研究の目的にのみ 厳格に提供されます。 以下の理解を支援することを意図しています: 制御された環境におけるセキュリティ脆弱性と悪用の概念 サンドボックス分離メカニズムとその制限 安全なソフトウェア設計と防御的なセキュリティ慣行 🚫 承認された使用のみ このリポジトリは、明示的な許可が与えられた環境でのみ使用されなければなりません。例えば: 個人用または管理された仮想マシン Dockerまたは隔離されたラボ環境 承認されたペネトレーションテスト業務...

CVE-2026-56681: Reliance on Untrusted Inputs in a Security Decision

9Router is an AI router & token saver. Prior to 0.5.6, 9Router deployments that allow requests to reach Next.js without the sanitizing custom-server.js wrapper trust the client-supplied X-9r-Real-Ip header in src/dashboardGuard.js when isLocalRequest decides whether canAccessPublicLlmApi may skip...

Exploit for CVE-2026-19478

cve-id Donate Support the maintenance of this project wit...

golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: Security bypass due to improper handling of key restrictions

A flaw was found in golang.org/x/crypto/ssh/agent. When a key was added to a remote agent, security restrictions, known as constraint extensions, were not properly processed during the request. This allowed these restrictions to be silently removed when keys were forwarded, leading to the...

ABIS BAPSİS 安全漏洞

ABIS BAPSİS is a research information system developed by the Turkish company ABIS, aimed at university research projects, academic budgets, and administrative processes management. Previous versions of ABIS BAPSİS, such as v.202604152042, contained security vulnerabilities. These vulnerabilities...

CVE-2026-40904 Chartbrew: Incorrect Access Control in dataset and dataRequest routes via team-scoped permission checks

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. In version 4.9.0, Chartbrew exposes multiple dataset and dataRequest endpoints that authorize low-privileged project members at the team level instead of binding the...

Keycloak services allows the issuance of access and refresh tokens for disabled users

A flaw was found in the keycloak-services component of Keycloak. This vulnerability allows the issuance of access and refresh tokens for disabled users, leading to unauthorized use of previously revoked privileges, via a business logic vulnerability in the Token Exchange implementation when a...

EUVD-2020-28378

Malware in sbrugna...

EUVD-2023-57845

Malicious code in bioql PyPI...

EUVD-2024-50035

Malicious code in bioql PyPI...

CVE-2025-46018: Authentication Bypass by Spoofing

CSC Pay Mobile App 2.19.4 fixed in version 2.20.0 contains a vulnerability allowing users to bypass payment authorization by disabling Bluetooth at a specific point during a transaction. This could result in unauthorized use of laundry services and potential financial loss...

Opay Mobile application 安全漏洞

Opay Mobile application is a lightweight application from Opay Inc. It is used to manage all banking or payment requirements. A security vulnerability exists in Opay Mobile application version 2.19.4, which originated from allowing a user to bypass payment authorization by disabling Bluetooth at ...

Exploit for CVE-2025-2294

CVE-2025-2294 - WordPress Kubio AI Page Builder Request/Res...

Exploit for Path Traversal in Splunk

CVE 2024-36991 - A path-traversal vulnerability that allows an...

Exploit for Improper Access Control in Lerouxyxchire Client_Database_Management_System

CVE-2025-5840 CVE-2025-5840 Exploit In Python By hax / haxerr9...

Exploit for Code Injection in Xwiki

CVE-2025-24893-EXP Affected Versions xwiki-platform = 5.3...

Exploit for SQL Injection in Plechevandrey Wp-Recall

cve-2025-1323 WP-Recall Plugin SQL Injection ⚠️ Legal Dis...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in Linux kernel, which stems from a lack of range checking in bitmapipuadt in the netfilter component, which could lead to unauthorized operatio...

Exploit for Missing Authentication for Critical Function in Cyberpanel

CVE-2024-51567 Exploit Script CVE-2024-51567 is a Python...

CVE-2024-9583

The RSS Aggregator – RSS Import, News Feeds, Feed to Post, and Autoblogging plugin for WordPress is vulnerable to unauthorized use of functionality due to a missing capability check on the wprssajaxsendpremiumsupport function in all versions up to, and including, 4.23.12. This makes it possible f...