CVE-2026-38751

CVE-2026-38751 — OpenSTAManager Module Upload RCE Authenticated RCE via unvalidated ZIP upload in the module update endpoint. Affected: OpenSTAManager = 2.10.x Requirements pip install requests Usage Reverse shell Penelope or any listener python3 exploit.py -u http://TARGET -U admin -P admin...

CVE-2024-22145

CVE-2024-22145 InstaWP Connect = 0.1.0.8 - Missing Authorization to Arbitrary Options Update Subscriber+ Description: The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the...

CVE-2026-93540 Fleet applies namespace labels and annotations without the bundle's service account privileges

A privilege mismatch was found in Fleet. When a bundle requested namespace labels or annotations through the namespaceLabels and namespaceAnnotations options, the resulting namespace metadata update was not subject to the same authorization as the rest of the bundle's deployment. As a result, a...

nuc-winring0-fix

Intel NUC WinRing0 Vulnerable Driver - Permanent Removal Guide Windows Defender flags OpenHardwareMonitorLib.sys WinRing0 driver as VulnerableDriver:WinNT/Winring0 due to CVE-2020-14979. This driver is bundled with Intel's NUC Software Studio service and gets reinstalled via Windows Update. This...

Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: loki3.6: loki3.6-3.6.17-0.3.hum1 aarch64, x8664 loki3.6-canary-3.6.17-0.3.hum1 aarch64, x8664 loki3.6-logcli-3.6.17-0.3.hum1 aarch64, x8664 loki3.6-3.6.17-0.3.hum1.src src Security Fixes: loki3.6...

CLSA-2026-1790604941 TuxCare security update for postcss (6 CVEs)

TuxCare rebuilt postcss to address 6 CVEs. Fixed in 6.0.1-tuxcare.1...

CLSA-2026-1790604921 TuxCare security update for browserslist (1 CVE)

TuxCare rebuilt browserslist to address 1 CVE. Fixed in 1.7.7-tuxcare.1...

CLSA-2026-1790604852 TuxCare security update for minimatch (2 CVEs)

TuxCare rebuilt minimatch to address 2 CVEs. Fixed in 0.4.0-tuxcare.1...

CLSA-2026-1790604779 TuxCare security update for multer (2 CVEs)

TuxCare rebuilt multer to address 2 CVEs. Fixed in 2.2.0-tuxcare.1...

CVE-2025-2266

🚨 CVE-2025-2266 — WordPress Plugin Exploit 🔍 Vulnerability Summary The Checkout Mestres do WP for WooCommerce plugin for WordPress is affected by an unauthenticated arbitrary options update vulnerability in versions 8.6.5 through 8.7.5. The vulnerable function cwmpUpdateOptions lacks proper...

CVE-2026-1122-IoT-Firmware-Update-Signature-Bypass-via-Low-Order-Point-Injection

5. CVE-2026-1122 – IoT Firmware Update Signature Bypass via Low‑Order Point Injection Overview An IoT device’s OTA firmware verification uses a flawed Ed25519 implementation that does not reject public keys with small‑order components, allowing an attacker to forge a valid signature for malicious...

CLSA-2026-1790598013 TuxCare security update for markdown-it (1 CVE)

TuxCare rebuilt markdown-it to address 1 CVE. Fixed in 13.0.2-tuxcare.2...

Important: Red Hat Security Advisory: vim security update

An update for vim is now available for Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is availab...

CVE-2016-3309_Reloaded

Kernel Exploitation Case Study - "Wild" Pool Overflow on Win10 x64 RS2 CVE-2016-3309 Reloaded This Github repo contains exploits for the recently-patched win32kfull!bFill vulnerability. Executing the Palette or Bitmap exploit will give you SYSTEM privileges on the affected system. The exploits...

WordPress Testimonials Widget plugin <= 4.0.4 - Unauthenticated Arbitrary Post Update vulnerability

Unauthenticated Arbitrary Post Update vulnerability discovered by Naiches in WordPress Plugin Testimonials Widget versions = 4.0.4...

CVE-2026-24135

CVE-2026-24135: Arbitrary File Deletion in Gogs via Wiki Path Traversal Severity: High CVSS 7.5 Affected Software: Gogs Patched In: 0.13.4, 0.14.0+dev Advisory: GHSA-jp7c-wj6q-3qf2 Patch: gogs/gogs8099 Summary During a security audit of Gogs a popular self-hosted Git service written in Go, I foun...

ROOT-OS-DEBIAN-12-CVE-2026-66141 CVE-2026-66141 in exim4 - Patched by Root

Root has patched CVE-2026-66141 in the exim4 package for Root:Debian:12. Multiple fixed versions available...

CVE-2026-0603

CVE-2026-0603 Hibernate ORM Injection / Second-Order SQL Injection ★ CVE-2026-0603 Hibernate SQL Injection PoC ★ https://github.com/user-attachments/assets/2e7c3a89-e26f-48cd-af0b-8b82d32ce71f Overview CVE-2026-0603 is a Second-Order SQL Injection vulnerability in Hibernate ORM , a widely used Ja...

CVE-2026-49060-Lab

CVE-2026-49060 - Hippoo Mobile App for WooCommerce Incorrect Privilege Assignment / Privilege Escalation Executive Summary This repository contains a local Docker lab for reproducing and validating CVE-2026-49060, an Incorrect Privilege Assignment vulnerability affecting the WordPress plugin Hipp...

CVE-2023-23397-Patch

CVE-2023-23397 Windows Update Patch CVE-2023-23397 powershell patch script for Windows 10 and 11 This version of the script allows you to check if your device has the most reach sent patches for the latest Microsoft exploit. if the security updates are not found using the Powershell Command...