EUVD-2026-68215

NextChat versions from 2.15.8 through 2.16.1 contain an improper URL validation vulnerability in the proxy endpoint that allows attackers to obtain the server's OpenAI API key. The x-base-url header is validated using substring matching instead of hostname parsing, allowing any URL containing...

CVE-2026-82637

browser-use web-ui versions 2.0.0 through 3.0.0 contain an arbitrary directory creation vulnerability in the run_agent_task function. The affected parameters (save_recording_path , save_trace_path , save_agent_history_path , save_download_path ) accept unvalidated absolute paths, and the attack i...

EUVD-2026-68213

browser-use web-ui versions 2.0.0 through 3.0.0 fail to validate browser settings paths in runagenttask, allowing attackers to create directories at arbitrary locations by supplying absolute paths to saverecordingpath, savetracepath, saveagenthistorypath, or savedownloadpath parameters. Attackers...

CVE-2026-82637 browser-use web-ui 2.0.0 through 3.0.0 Arbitrary Directory Creation

browser-use web-ui versions 2.0.0 through 3.0.0 fail to validate browser settings paths in runagenttask, allowing attackers to create directories at arbitrary locations by supplying absolute paths to saverecordingpath, savetracepath, saveagenthistorypath, or savedownloadpath parameters. Attackers...

CVE-2020-0601

ChainOfFools 又名 CurveBall 又名 CVE-2020-0601 CVE-2020-0601（ChainOfFools | CurveBall）资源合集 概述 来自 NSA 公告 的摘要指出： NSA 发现了一个影响微软 Windows®1 加密功能的严重漏洞（CVE-2020-0601）。该证书验证漏洞允许攻击者破坏 Windows 验证加密信任的方式，并可能导致远程代码执行。该漏洞影响 Windows 10、Windows Server 2016/2019 以及依赖 Windows...

CVE-2024-32002-PoC_Chinese

CVE-2024-32002 Vulnerability Overview ⚠️Caution!: Do not clone this repository!!!⚠️ Description CVE-2024-32002 is a critical security vulnerability discovered in Git software. This vulnerability allows remote attackers to execute arbitrary code on affected systems through specially crafted Git...

ssl-kill-switch2

SSL Kill Switch 2 Herramienta de caja negra para deshabilitar la validación de certificados SSL/TLS - incluido el anclaje de certificados certificate pinning - dentro de aplicaciones iOS y macOS. Segunda iteración de https://github.com/iSECPartners/ios-ssl-kill-switch . Descripción Una vez cargad...

CVE-2025-68930

🔍 Analysis of CVE-2025-68930: WebSocket Hijacking Vulnerability in Traccar The CVE-2025-68930 exposes a critical Cross-Site WebSocket Hijacking CSWSH vulnerability in Traccar , the open-source GPS tracking system. Below are the key details: 🛡️ Vulnerability Details Affected endpoint : /api/socket...

CVE-2026-15980

The MyHome Core plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 4.4.5. This is due to missing authorization in the sendlink AJAX handler and improper token validation in the activate function. This makes it possible for unauthenticated attackers t...

CVE-2026-15980 MyHome Core <= 4.4.5 - Authentication Bypass to Account Takeover via Activation Token

The MyHome Core plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 4.4.5. This is due to missing authorization in the sendlink AJAX handler and improper token validation in the activate function. This makes it possible for unauthenticated attackers t...

EUVD-2026-68149

The MyHome Core plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 4.4.5. This is due to missing authorization in the sendlink AJAX handler and improper token validation in the activate function. This makes it possible for unauthenticated attackers t...

OESA-2026-3527 iperf3 security update

Iperf is a tool for active measurements of the maximum achievable bandwidth on IP networks. It supports tuning of various parameters related to timing, protocols, and buffers. Security Fixes: A flaw was found in iperf3. A remote attacker can exploit this vulnerability by sending crafted...

langflow-exploit

CVE-2025-3248 - Langflow कोड सत्यापन एंडपॉइंट RCE Langflow के कोड सत्यापन एंडपॉइंट में रिमोट कोड निष्पादन भेद्यता को प्रदर्शित करने वाला एक प्रूफ-ऑफ-कॉन्सेप्ट एक्सप्लॉइट। यह भेद्यता Langflow के 1.3.0 से पहले के संस्करणों को प्रभावित करती है, जिससे बिना प्रमाणीकरण के हमलावर क्राफ्टेड HTTP अनुरोधों...

Linux Distros Unpatched Vulnerability : CVE-2026-82467

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Rodauth before 2.47.0 fails to validate protocol-relative return-to paths in confirmpassword, loginreturntorequestedlocation, and...

PT-2026-83520

Name of the Vulnerable Software and Affected Versions MyHome Core versions prior to 4.4.6 Description An authentication bypass exists in the MyHome Core plugin for WordPress. The issue stems from missing authorization in the send link AJAX handler and improper token validation within the activate...

CVE-2023-43340

creationtimestamp| type| source ---|---|--- 2026-08-29 23:00:18+00:00| seen| Telegram/mygM17KSjyX1ytBX-vC2bUSC6Quyw0MIzjWP6u1Kpz11D0 2026-08-29 23:00:18+00:00| seen| Telegram/tcvPlgy4RT-8DYuUczCHAOelno4AcU1hpFFn5ph0Pb3yXE 2026-08-30 00:00:26+00:00| seen|...

CVE-2017-7494

Exploit di SambaCry CVE-2017-7494 CVE-2017-7494/SambaCry consente agli utenti autenticati di caricare una libreria condivisa in una cartella scrivibile e di eseguire un attacco di esecuzione utilizzando le librerie caricate. Spiegazione della vulnerabilità SambaCry è una vulnerabilità di...

CVE-2025-43929

CVE-2025-43929 Prova di concetto per CVE-2025-43929, una vulnerabilità ad alta severità in KiTTY che permette l'esecuzione di eseguibili locali senza conferma dell'utente in determinate circostanze Tipo di vulnerabilità CWE-346: CWE-346 Origin Validation Error Descrizione della vulnerabilità...

CVE-2024-29973

CVE-2024-29973 – Sicherheitslücke zur Remote-Befehlsinjektion Beschreibung Bei CVE-2024-29973 handelt es sich um eine kritische Sicherheitslücke in bestimmten Netzwerkgeräten von Zyxel. Diese Schwachstelle ermöglicht es einem nicht authentifizierten Angreifer, beliebige Befehle auf dem Zielgerät...

CVE-2025-60787_PoC

CVE-2025-60787 - MotionEye RCE RCE autenticata in MotionEye = 0.43.1b4 tramite bypass della convalida lato client sul campo imagefilename. Utilizzo root@kitploit: nc -lvnp 4444 python exploit.py -t http://127.0.0.1:8765 -p password -lh IP -lp 4444 Opzioni...