CVE-2026-73673

CVE-2026-73673: Actualización de firmware no autenticada en Netis NC63 con ausencia de autenticación criptográfica del firmware Investigación original de la vulnerabilidad por Özcan Ersan @ozcanpng. Este repositorio documenta CVE-2026-73673, descubierto y reportado por el autor. Paquete de prueba...

CVE-2026-101139: Missing Authorization

A vulnerability was detected in Webkul Bagisto up to 2.4.6/2.5.0-beta4. This impacts an unknown function of the file /admin/sales/invoices/mass-update/state of the component Invoice Mass Status Update. Performing a manipulation results in missing authorization. The attack can be initiated remotel...

sjcam

Lelouch: Investigación de Firmware SJCAM SJ4000 y Firmware Personalizado Trocar para Português Brasil Notas de ingeniería inversa, herramientas de firmware, código de prueba de concepto y una interfaz de firmware personalizada para la versión Allwinner V3 de la SJCAM SJ4000 Air. Artículo de...

CLSA-2026-1790542520 TuxCare security update for undici (1 CVE)

TuxCare rebuilt undici to address 1 CVE. Fixed in 7.28.0-tuxcare.1...

CLSA-2026-1790541935 TuxCare security update for ws (2 CVEs)

TuxCare rebuilt ws to address 2 CVEs. Fixed in 8.17.1-tuxcare.1...

CLSA-2026-1790541933 TuxCare security update for qs (2 CVEs)

TuxCare rebuilt qs to address 2 CVEs. Fixed in 6.15.3-tuxcare.1...

CVE-2026-23416-POC

CVE-2026-23416 — PoC mm/mseal: corregir el final de VMA correctamente al fusionar Vulnerabilidad descubierta por Antonius / Blue Dragon Security Resumen Campo| Detalle ---|--- ID CVE| CVE-2026-23416 Subsistema| mm/mseal — mm/vma.c Afectado| Kernel de Linux 6.17 hasta 7.0-rc5 Corregido en| Linux...

CVE-2025-48799

Descripción Este es un PoC para CVE-2025-48799, una vulnerabilidad de elevación de privilegios en el servicio de Windows Update. Esta vulnerabilidad afecta a clientes de Windows win11/win10 con al menos 2 discos duros. Cuando la máquina tiene múltiples discos duros, es posible cambiar la ubicació...

CVE-2025-5701

CVE-2025-5701 HyperComments = 1.2.2 - Actualización arbitraria de opciones sin autenticar Subscriber+ Descripción El complemento HyperComments para WordPress es vulnerable a la modificación no autorizada de datos, lo que puede conducir a una escalada de privilegios debido a una falta de...

CLSA-2026-1790520250 TuxCare security update for webpack-dev-middleware (1 CVE)

TuxCare rebuilt webpack-dev-middleware to address 1 CVE. Fixed in 3.0.1-tuxcare.1...

PcanExploit

CVE-2024-44610: PEAK PCAN-Ethernet Gateway FD DR Authenticated Root Exploit What is it? This repository contains a Proof-of-Concept PoC exploit that executed code as root on Peak Ethernet gateways. It requires that you know the credentials to the web interface. How to fix it? The vendor has rapid...

WPS-CVE-2022-24934

STAND WITH UKARINE Putin IS CRIMINAL! Warning THIS PROGRAM USE GENERIC WHICH IS INTRODUCED IN GO 1.18, UPGRADE YOUR COMPILER! CVE-2022-24934 Web Server for exploiting this vuln by utilizing wpsupdate.exe Fake WPS Update Server PoC Research Purpose Only. Download file Set the file you want to send...

CVE-2025-15556-Notepad-WinGUp-Updater-RCE

Software afectado: Versiones de Notepad++ anteriores a la 8.8.9 que usan el actualizador WinGUp. Tipo de vulnerabilidad: Omisión de la verificación de integridad de actualización que conduce a la ejecución arbitraria de código. Descripción: El actualizador WinGUp no verifica adecuadamente la...

CLSA-2026-1790482357 TuxCare security update for @angular (2 CVEs)

TuxCare rebuilt 19 @angular packages to address 2 CVEs. Fixed in 7.2.1-tuxcare.5...

CVE-2024-10557

Versión afectada: BloodBank Management System : 1.0 Información de la vulnerabilidad: Tipo de vulnerabilidad: Cross Site Request Forgery CSRF Gravedad: ALTA Estado: Sin parche Endpoint vulnerable: Ruta: /file/updateprofile.php Descripción de la vulnerabilidad: Existe una vulnerabilidad CSRF en es...

CLSA-2026-1790475892 TuxCare security update for @angular (4 CVEs)

TuxCare rebuilt 17 @angular packages to address 4 CVEs. Fixed in 16.2.11-tuxcare.4...

NetAlertX 23.01.14–24.x < 24.10.12 - Remote Code Execution

NetAlertX 23.01.14 through 24.x before 24.10.12 allows unauthenticated command injection via settings update because function=savesettings lacks an authentication requirement, as exploited in the wild in May 2025. This is related to settings.php and util.php. id: CVE-2024-46506 info: name:...

MinIO Operator Console Authentication Bypass

MinIO Console is a graphical user interface for the for MinIO Operator. MinIO itself is a multi-cloud object storage project. Affected versions are subject to an authentication bypass issue in the Operator Console when an external IDP is enabled. id: CVE-2021-41266 info: name: MinIO Operator...

Mitel 6000 - OS Command Injection

A vulnerability in the Mitel 6800 Series, 6900 Series, and 6900w Series SIP Phones through 6.4 SP4 R6.4.0.4006, and the 6970 Conference Unit through 6.4 SP4 R6.4.0.4006 or version V1 R0.1.0, could allow an unauthenticated attacker to conduct a command injection attack due to insufficient paramete...

Honeywell PM43 Printers - Command Injection

Improper Input Validation vulnerability in Honeywell PM43 on 32 bit, ARM Printer web page modules allows Command Injection.This issue affects PM43 versions prior to P10.19.050004. Update to the latest available firmware version of the respective printers to version MR19.5 e.g. P10.19.050006 id:...