CVE-2026-54072

Authorizer , an open-source self-hostable authentication and authorization server, is affected by an unvalidated redirect_uri in its /authorize endpoint prior to version 2.2.1 . When response_type=token or response_type=id_token, the server appends access_token , id_token , and refresh_token as q...

EUVD-2026-76193

Concrete CMS 9 through 9.5.2 is vulnerable to Server-Side Template Injection SSTI in Theme Customizer via Unvalidated Style Values. Values submitted through the customizer color channels and other style properties handled by ColorStyle and sibling Style classes such as FontFamilyStyle and...

Win10Pcap-Exploit

Win10Pcap-Exploit 致谢 https://twitter.com/R00tkitSMM [email protected] telegram 用户名：https://telegram.me/firozi 不久前，我在 win10pcap 驱动程序中发现了可导致权限提升的漏洞。我已报告该漏洞，现在该 bug 已修复： www.win10pcap.org/download/ 因此我决定发布示例漏洞利用代码 Win10Pcap 是一个基于 WinPcap 的新型以太网数据包捕获库。 与原始 WinPcap 不同，Win10Pcap 兼容 NDIS 6.x...

CVE-2026-66753-HTTP-Header-Injection-via-Unvalidated-CR-and-LF-in-Header-Values-tiny_http-

安全公告：未验证的 CR 和 LF 导致 HTTP 头注入（tinyhttp） 分配的 CVE ID： CVE-2026-66753 概要 tinyhttp 不会拒绝 HTTP 头值中的回车或换行，无论方向如何。 在请求侧，readnextline 仅在 CRLF 处结束一个头行，因此单独的 LF 会保留在解析后的值中并到达应用程序。在响应侧，Header::frombytes 仅验证字节是 ASCII，而响应写入器会原样发出值，因此包含 CRLF 的值会拆分响应。 将请求头值反射到响应头中，或将请求头重新序列化到另一连接的应用程序，因此会继承一个注入原语，且没有任何迹象表明有问题。...

CVE-2026-89148

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains an open redirect in objects/playlistSort.php. Because the endpoint is not a .json.php script, AVideo's automatic CSRF guard autoCSRFGuard/forbidIfIsUntrustedRequest does not run, and when the request includes the sort paramet...

EUVD-2026-76050

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains an open redirect in objects/playlistSort.php. Because the endpoint is not a .json.php script, AVideo's automatic CSRF guard autoCSRFGuard/forbidIfIsUntrustedRequest does not run, and when the request includes the sort paramet...

CVE-2026-88053

A flaw was found in Tesseract, an open-source Optical Character Recognition OCR engine. A local attacker could provide a specially crafted .traineddata file, which, when processed, could lead to a heap out-of-bounds write. This vulnerability occurs due to unvalidated counts used as loop bounds...

CVE-2025-15695

The Translate WordPress with GTranslate WordPress plugin before 3.0.10 does not validate one of its settings before the bundled front-end scripts build markup from it, allowing users with a role as high as administrator to store JavaScript that runs in the session of any visitor to the site...

EUVD-2025-210888

The Translate WordPress with GTranslate WordPress plugin before 3.0.10 does not validate one of its settings before the bundled front-end scripts build markup from it, allowing users with a role as high as administrator to store JavaScript that runs in the session of any visitor to the site...

CVE-2025-15695

The Translate WordPress with GTranslate plugin before 3.0.10 contains a stored cross-site scripting (XSS) vulnerability. One of its settings is not validated before the bundled front-end scripts build markup from it, allowing users with the administrator role or higher to store JavaScript that ex...

CVE-2025-15695 GTranslate < 3.0.10 - Admin+ Stored XSS

The Translate WordPress with GTranslate WordPress plugin before 3.0.10 does not validate one of its settings before the bundled front-end scripts build markup from it, allowing users with a role as high as administrator to store JavaScript that runs in the session of any visitor to the site...

CVE-2026-89060

Stolostron multicluster-observability-addon is affected by a cross-namespace secret disclosure flaw. A managed-cluster identity can reference configuration resources outside its designated namespace, allowing an attacker-controlled managed cluster to access sensitive hub Secrets . The CVSS 3.1 sc...

PT-2026-90147

In the Linux kernel, the following vulnerability has been resolved: platform/chrome: sensorhub: Bound the EC-reported sensor number Each EC FIFO event carries an 8-bit sensor number in-sensor num. cros ec sensorhub ring handler validates the FIFO event count, the per-read count and the ring bound...

PT-2026-90159

In the Linux kernel, the following vulnerability has been resolved: platform/x86: ISST: Validate level in perf mask ioctls isst if get perf level mask and isst if get base freq mask use the user-provided level as an index into perf levels via read pp level info and read bf level info, but neither...

PT-2026-90522

A file-upload handler redirects the authenticated client's browser to a URL taken directly from that same request's Referer header, without validating it against the application's own origin. This allows an authenticated attacker to craft a request that causes another user's browser to be...

PT-2026-90290

In the Linux kernel, the following vulnerability has been resolved: dm array: validate array block headers on read array block check validates blocknr and csum and nothing else, while node check, next to it, has bounded the structural fields since both were written. dm array cursor next takes its...

PT-2026-90067

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7915: bound the device EEPROM address before the EFUSE copy mt7915 mcu get eeprom copies a fixed EFUSE block into the driver's dev-mt76.eeprom.data buffer at the offset reported by the MCU response res-addr, a...

PT-2026-90137

In the Linux kernel, the following vulnerability has been resolved: ipmi: ipmb: validate write message length ipmb write read message fields before validating the length byte. A zero or short write can read uninitialized stack bytes. A length smaller than the SMBus header underflows the block wri...

PT-2026-90210

In the Linux kernel, the following vulnerability has been resolved: ocfs2: validate lengths in dlm mig lockres handler A node receiving a DLM MIG LOCKRES message trusts several fields of the peer-supplied dlm migratable lockres without validation. num locks and lockname len are bounded only on th...

CVE-2021-21551

CVE-2021-21551 CVE-2021-21551 を悪用してシステム cmd を起動し LPE を達成するためのシンプルな PoC。 https://vulners.com/cve/CVE-2021-21551 署名された Dell Windows ドライバー dbutil23.sys に脆弱性が見つかり、ローカルシステム全体が侵害される可能性があります。このドライバーの ioctl ディスパッチルーチンは、ユーザーが提供するバッファの検証を欠いています。 IOCTL どのユーザーでもハンドルを作成し、以下の ioctl コードに対して ioctl...