WebView2-Cookie-Stealer

Blog Post Please read this blog post to get more information. Source Code This code is a modified version of Microsoft's WebView2 Code. The current code can be cleaned up and made much better. Demo Launch Example Usage Example Usage Tested on Windows 10 & 11. When the binary is executed...

CVE-2026-121458

Instatic before 0.0.21 contains a missing authorization vulnerability in its AI/MCP content read tools that allows low-privileged authenticated users with ai.chat and content.edit.own capabilities to access data rows belonging to other users by calling contentgetdocument and contentlistdocuments...

CVE-2026-121458 Instatic before 0.0.21 Authorization Bypass via MCP Content Read Tools

Instatic before 0.0.21 contains a missing authorization vulnerability in its AI/MCP content read tools that allows low-privileged authenticated users with ai.chat and content.edit.own capabilities to access data rows belonging to other users by calling contentgetdocument and contentlistdocuments...

CVE-2026-121458

Versions of Instatic prior to 0.0.21 are vulnerable to a missing authorization flaw in the AI/MCP content read tools . The root cause is a lack of object-level authorization checks in the content_get_document and content_list_documents functions, which are otherwise enforced by the standard HTTP ...

EUVD-2026-115812

Instatic before 0.0.21 contains a missing authorization vulnerability in its AI/MCP content read tools that allows low-privileged authenticated users with ai.chat and content.edit.own capabilities to access data rows belonging to other users by calling contentgetdocument and contentlistdocuments...

YesWiki < 4.6.4 - Unauthenticated SQL Injection

YesWiki before version 4.6.4 contains an unauthenticated SQL injection vulnerability in the Bazar form-import path. The bnidnature parameter in FormManager::create is concatenated into an INSERT statement without sanitization, allowing unauthenticated attackers to inject arbitrary SQL and read th...

ListingPro < 2.6.1 - Sensitive Data Disclosure

The ListingPro - WordPress Directory & Listing Theme for WordPress is vulnerable to Sensitive Data Exposure in versions before 2.6.1 via the /listingpro-plugin/functions.php file. This makes it possible for unauthenticated attackers to extract sensitive data including usernames, full names, email...

CVE-2023-35078

CVE-2023-35078 Exploit Tool ██████╗ ███╗ ██╗███████╗███████╗ ██████╗ ██╔═████╗████╗ ██║██╔════╝██╔════╝██╔════╝ ██║██╔██║██╔██╗ ██║███████╗█████╗ ██║ ████╔╝██║██║╚██╗██║╚════██║██╔══╝ ██║ ╚██████╔╝██║ ╚████║███████║███████╗╚██████╗ ╚═════╝ ╚═╝ ╚═══╝╚══════╝╚══════╝ ╚═════╝ + CVE-2023-35078 - Ivan...

CVE-2026-11107-Insecure-Direct-Object-Reference-with-Predictable-UUIDv1

CVE-2026-11107 – Insecure Direct Object Reference with Predictable UUIDv1 Program Code Python Flask idorserver.py - API with UUIDv1 user IDs import uuid, time from flask import Flask, request, jsonify app = Flaskname Generate predictable UUIDv1 based on timestamp + MAC users = struuid.uuid1:...

OneDev < 4.0.3 - User Access Token Leak

OneDev before version 4.0.3 contains an insecure endpoint that allows retrieval of arbitrary user details, including access tokens, due to missing security checks on /users/id, letting attackers leak sensitive data and impersonate users, exploit requires no special conditions. id: CVE-2021-21246...

CLEANSTART-2024-VE33970 Improper neutralization of user data in the DjVu file format in ExifTool versions 7

Security vulnerability affects the perl-image-exiftool package. Improper neutralization of user data in the DjVu file format in ExifTool versions 7...

CVE-2026-19478-PoC

CVE-2026-19478 PoC Unauthenticated remote code-injection in GitLab's GraphQL layer that lets an attacker modify or delete public projects and user data with a single crafted query. No authentication, no user interaction, no special privileges. | ---|--- Severity| 9.4 Critical —...

import-users-from-csv-with-meta

import-users-from-csv-with-meta Import Users From CSV with Meta 1.15 - Unauthorised Authenticated Users Export...

CLEANSTART-2024-GD40306 malicious installed WebExtension could open arbitrary URLs, which under the right circumstance could be leveraged to collect sensitive user data

CVE-2023-5725 affects multiple packages. A malicious installed WebExtension could open arbitrary URLs, which under the right circumstance could be leveraged to collect sensitive user data. See references for individual vulnerability details...

CVE-2026-112602

An authorization issue was addressed with improved state management. This issue is fixed in Xcode 27.2. An app may be able to access sensitive user data...

CVE-2026-112602

An authorization issue in Xcode was identified where an app could potentially access sensitive user data . The root cause was addressed by improving state management . This vulnerability is fixed in Xcode 27.2 . No specific exploit details or in-the-wild exploitation data are provided in the docu...

CVE-2026-112602

An authorization issue was addressed with improved state management. This issue is fixed in Xcode 27.2. An app may be able to access sensitive user data...

EUVD-2026-113445

An authorization issue was addressed with improved state management. This issue is fixed in Xcode 27.2. An app may be able to access sensitive user data...

CVE-2026-112602: Apple Xcode: An authorization issue was addressed with improved state management

An authorization issue was addressed with improved state management. This issue is fixed in Xcode 27.2. An app may be able to access sensitive user data...

PT-2026-132864

Name of the Vulnerable Software and Affected Versions Xcode versions prior to 27.2 Description An authorization issue exists due to improper state management, which could allow an application to access sensitive user data. Recommendations Update to Xcode version 27.2...