400 matches found
CVE-2025-49844
CVE-2025-49844 RediShell AI-made Revshell PoC Untested completition of the Redishell PoC made by AI. Original PoC: https://github.com/raminfp/redisexploit/blob/main/exploitpoc.py Korean Piece: https://github.com/dwisiswant0/CVE-2025-49844/blob/master/CVE-2025-49844.lua Progress ? We later went...
CVE-2026-42089
CVE-2026-42089 A local package installation helper trusted caller-supplied package names too much. In yeoman-environment, missing generators could be installed without user confirmation, turning attacker-controlled project metadata into a package-install and code-execution path. Intro I found thi...
CVE-2026-117601
A flaw was found in electrum. A connected malicious server can exploit this vulnerability to cause theft of funds by replacing a legitimate transaction with a fraudulent transfer. Because the application fails to verify cryptographic signatures on unconfirmed transactions, the attacker can displa...
EUVD-2026-110850
Electrum: Malicious server can replace a just-broadcast tx and try to trick user into RBF-ing it...
CVE-2026-117601
Electrum before 4.8.3 fails to verify signatures of wallet-owned inputs in unconfirmed mempool transactions, allowing malicious servers to replace a just-broadcast transaction with a conflicting one. Attackers can swallow the user's transaction and display an invalid zero-fee copy paying an...
Linux Distros Unpatched Vulnerability : CVE-2026-117601
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Electrum before 4.8.3 fails to verify signatures of wallet-owned inputs in unconfirmed mempool transactions, allowing malicious servers to replace a...
DEBIAN-CVE-2026-117601
Electrum before 4.8.3 fails to verify signatures of wallet-owned inputs in unconfirmed mempool transactions, allowing malicious servers to replace a just-broadcast transaction with a conflicting one. Attackers can swallow the user's transaction and display an invalid zero-fee copy paying an...
CVE-2026-117601
Electrum before 4.8.3 fails to verify signatures of wallet-owned inputs in unconfirmed mempool transactions, allowing malicious servers to replace a just-broadcast transaction with a conflicting one. Attackers can swallow the user's transaction and display an invalid zero-fee copy paying an...
CVE-2026-117601
Electrum before 4.8.3 fails to verify signatures of wallet-owned inputs in unconfirmed mempool transactions, allowing malicious servers to replace a just-broadcast transaction with a conflicting one. Attackers can swallow the user's transaction and display an invalid zero-fee copy paying an...
CVE-2026-117601
Electrum before 4.8.3 fails to verify signatures of wallet-owned inputs in unconfirmed mempool transactions, allowing malicious servers to replace a just-broadcast transaction with a conflicting one. Attackers can swallow the user's transaction and display an invalid zero-fee copy paying an...
VulnCheck KEV: CVE-2026-117601
Electrum before 4.8.3 fails to verify signatures of wallet-owned inputs in unconfirmed mempool transactions, allowing malicious servers to replace a just-broadcast transaction with a conflicting one. Attackers can swallow the user's transaction and display an invalid zero-fee copy paying an...
PT-2026-126431
Name of the Vulnerable Software and Affected Versions Electrum versions prior to 4.8.3 Description The software fails to verify signatures of wallet-owned inputs in unconfirmed mempool transactions. This allows malicious servers to replace a recently broadcast transaction with a conflicting one...
CVE-2026-111948 Profile Builder < 4.0.1 - Reflected XSS via Unconfirmed Emails Row Actions
The User Profile Builder WordPress plugin before 4.0.1 does not escape the current page URL before outputting it in a JavaScript context on one of its admin pages, leading to Reflected Cross-Site Scripting against high-privilege users...
CVE-2026-111948 Profile Builder < 4.0.1 - Reflected XSS via Unconfirmed Emails Row Actions
The User Profile Builder WordPress plugin before 4.0.1 does not escape the current page URL before outputting it in a JavaScript context on one of its admin pages, leading to Reflected Cross-Site Scripting against high-privilege users...
CVE-2026-111948
The User Profile Builder WordPress plugin versions prior to 4.0.1 is vulnerable to Reflected Cross-Site Scripting (XSS) . The root cause is the failure to escape the current page URL before it is outputted within a JavaScript context on one of its admin pages. This vulnerability specifically targ...
PT-2026-116833
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A livelock issue exists in the SCTP implementation where the sctp assoc update retran path function can enter an infinite loop. This occurs when all remaining transports, including the...
PT-2026-128360
In the Linux kernel, the following vulnerability has been resolved: sctp: avoid livelock while updating retransmit path sctp assoc update retran path can loop forever when every remaining transport, including retran path, is SCTP UNCONFIRMED: the state check runs before the wraparound test, so th...
CVE-2026-89510
creationtimestamp| type| source ---|---|--- 2026-09-18 17:40:02+00:00| seen| https://mastodon.social/users/hugovalters/statuses/117293265787549640 2026-10-01 18:00:00+00:00| seen| https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities20261002...
SUSE CVE-2026-90237
In the Linux kernel, the following vulnerability has been resolved: netfilter: nftct: move custom expectation support to helper Originally, the ct expectation support called nfcthelperextadd for confirmed conntracks, which is invalid, triggering a splat. This was fixed by commit 1710eb913bdc...
CVE-2026-85500 `require_confirmed_with` is not enforced on the action and fails open on an unreadable attribute in AshAuthentication
Authentication Bypass by Primary Weakness vulnerability in team-alembic AshAuthentication allows an unconfirmed user to obtain a session, defeating a mandatory email confirmation requirement. AshAuthentication.Strategy.Password.Actions.checkuser/2 decides whether the attribute named by...