CVE-2026-24135

CVE-2026-24135: Arbitrary File Deletion in Gogs via Wiki Path Traversal Severity: High CVSS 7.5 Affected Software: Gogs Patched In: 0.13.4, 0.14.0+dev Advisory: GHSA-jp7c-wj6q-3qf2 Patch: gogs/gogs8099 Summary During a security audit of Gogs a popular self-hosted Git service written in Go, I foun...

ROOT-OS-DEBIAN-12-CVE-2026-66141 CVE-2026-66141 in exim4 - Patched by Root

Root has patched CVE-2026-66141 in the exim4 package for Root:Debian:12. Multiple fixed versions available...

CVE-2026-0603

CVE-2026-0603 Hibernate ORM Injection / Second-Order SQL Injection ★ CVE-2026-0603 Hibernate SQL Injection PoC ★ https://github.com/user-attachments/assets/2e7c3a89-e26f-48cd-af0b-8b82d32ce71f Overview CVE-2026-0603 is a Second-Order SQL Injection vulnerability in Hibernate ORM , a widely used Ja...

CVE-2026-49060-Lab

CVE-2026-49060 - Hippoo Mobile App for WooCommerce Incorrect Privilege Assignment / Privilege Escalation Executive Summary This repository contains a local Docker lab for reproducing and validating CVE-2026-49060, an Incorrect Privilege Assignment vulnerability affecting the WordPress plugin Hipp...

CVE-2023-23397-Patch

CVE-2023-23397 Windows Update Patch CVE-2023-23397 powershell patch script for Windows 10 and 11 This version of the script allows you to check if your device has the most reach sent patches for the latest Microsoft exploit. if the security updates are not found using the Powershell Command...

Important: Red Hat Security Advisory: tesseract security update

An update for tesseract is now available for Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

By-Poloss..-..CVE-2026-12432-PoC

CVE-2026-12432: WP Full Stripe Free = 8.4.4 Published : June 26, 2026 Last Updated : June 27, 2026 Researcher : Netwurm - VTDR e.V.i.G. Vulnerability Description The WP Full Stripe Free plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 8.4.3 via the...

WAVLINK WN533A8 - Improper Access Control

WAVLINK WN533A8 M33A8.V5030.190716 is susceptible to improper access control. An attacker can obtain usernames and passwords via view-source:http://IPADDRESS/sysinit.shtml?r=52300 and searching for logincheckuser; and thereby possibly obtain sensitive information, modify data, and/or execute...

WordPress Elementor Website Builder <3.1.4 - Cross-Site Scripting

WordPress Elementor Website Builder plugin before 3.1.4 contains a DOM cross-site scripting vulnerability. It does not sanitize or escape user input appended to the DOM via a malicious hash. id: CVE-2021-24891 info: name: WordPress Elementor Website Builder 3.1.4 - Cross-Site Scripting author:...

Visualizer <3.3.1 - Blind Server-Side Request Forgery

Visualizer prior to 3.3.1 suffers from a blind server-side request forgery vulnerability via the /wp-json/visualizer/v1/upload-data endpoint. id: CVE-2019-16932 info: name: Visualizer 3.3.1 - Blind Server-Side Request Forgery author: akincibor severity: critical description: | Visualizer prior to...

LOYTEC LGATE-902 6.3.2 - Local File Inclusion

LOYTEC LGATE-902 6.3.2 is susceptible to local file inclusion which could allow an attacker to manipulate path references and access files and directories including critical system files that are stored outside the root folder of the web application running on the device. This can be used to read...

FasterXML jackson-databind - Deserialization Remote Code Execution

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig aka ibatis-sqlmap. This vulnerability allows attackers to execute arbitrary code through deserialization of...

Xiaomi Mi WiFi R3G Routers - Local file Inclusion

Xiaomi Mi WiFi R3G devices before 2.28.23-stable are susceptible to local file inclusion vulnerabilities via a misconfigured NGINX alias, as demonstrated by api-third-party/download/extdisks../etc/config/account. With this vulnerability, the attacker can bypass authentication. id: CVE-2019-18371...

WordPress NotificationX <2.3.9 - SQL Injection

WordPress NotificationX plugin prior to 2.3.9 contains a SQL injection vulnerability. The plugin does not sanitize and escape the nxid parameter before using it in a SQL statement, leading to an unauthenticated blind SQL injection. An attacker can possibly obtain sensitive information, modify dat...

crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages

A flaw was found in the crypto/tls package within the Go golang standard library, specifically affecting TLS 1.3 connections. A remote attacker can exploit this vulnerability by sending multiple key update messages in a single record after the handshake. This can cause the connection to deadlock,...

CVE-2026-73673

CVE-2026-73673: Actualización de firmware no autenticada en Netis NC63 con ausencia de autenticación criptográfica del firmware Investigación original de la vulnerabilidad por Özcan Ersan @ozcanpng. Este repositorio documenta CVE-2026-73673, descubierto y reportado por el autor. Paquete de prueba...

CVE-2026-101139: Missing Authorization

A vulnerability was detected in Webkul Bagisto up to 2.4.6/2.5.0-beta4. This impacts an unknown function of the file /admin/sales/invoices/mass-update/state of the component Invoice Mass Status Update. Performing a manipulation results in missing authorization. The attack can be initiated remotel...

sjcam

Lelouch: SJCAM SJ4000 Firmware Research and Custom Firmware Trocar para Português Brasil Reverse engineering notes, firmware tooling, proof-of-concept code, and a custom firmware interface for the Allwinner V3 version of the SJCAM SJ4000 Air. Research article This repository contains the code and...

CLSA-2026-1790541933 TuxCare security update for qs (2 CVEs)

TuxCare rebuilt qs to address 2 CVEs. Fixed in 6.15.3-tuxcare.1...

CVE-2026-23416-POC

CVE-2026-23416 — PoC mm/mseal: update VMA end correctly on merge Vulnerability discovered by Antonius / Blue Dragon Security Overview Field| Detail ---|--- CVE ID| CVE-2026-23416 Subsystem| mm/mseal — mm/vma.c Affected| Linux kernel 6.17 through 7.0-rc5 Fixed in| Linux 7.0-rc6, stable backports...