CVE-2026-80725

CVE-2026-80725 affects the Linux kernel 's GRO (Generic Receive Offload) BIG TCP aggregation path in skb_gro_receive(). A prior commit (b1a78b9b9886) loosened validation, allowing crafted frames injected via AF_PACKET to pass incorrect headroom checks. When ipv6_gro_complete() inserts a temporary...

CVE-2026-80725 net: gro: properly validate BIG TCP aggregation criteria

In the Linux kernel, the following vulnerability has been resolved: net: gro: properly validate BIG TCP aggregation criteria When GRO attempts to aggregate packets beyond GROLEGACYMAXSIZE 64KB, BIG TCP should only be permitted for plain IPv4 TCP and plain IPv6 TCP with sufficient MAC header room ...

active_c2_ioc_public

+OPTIONS: ^: +TITLE: IOC C2 attivi Nota Presta attenzione alle date firstseen/lastseen in ogni voce. Non giudicare basandoti solo su un indirizzo IP...

EUVD-2026-68062

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.40 does not verify the amount, receiver, currency or status of a payment notification before marking the corresponding order completed, allowing unauthenticated users to complete full-price orders and gain access to paid content by...

EUVD-2026-68043

The SmartAIPress WordPress plugin through 1.2.0 does not perform a capability check on one of its AJAX actions and does not validate a user-supplied URL before fetching it server-side, allowing users with subscriber-level access and above to make the site retrieve arbitrary internal or external...

CVE-2026-16600 SmartAIPress <= 1.2.0 - Subscriber+ Server-Side Request Forgery via smartaipress_openai_upload_and_set_featured_image

The SmartAIPress WordPress plugin through 1.2.0 does not perform a capability check on one of its AJAX actions and does not validate a user-supplied URL before fetching it server-side, allowing users with subscriber-level access and above to make the site retrieve arbitrary internal or external...

mi-x

Am I Exploitable? Autor: 2022 - Now, Rezilion Beschreibung: Schwachstellenvalidierung Entwicklung: Januar 2022 - Now Dokumentation: Siehe Website, README Einführung Beschreibung ‘Am I Exploitable?’ ist ein python Open-Source-Projekt, das dem Bedarf gerecht wird, zu validieren, ob Ihr System für...

CVE-2025-55887

CVE-2025-55887 Descrizione Una vulnerabilità di Cross-Site Scripting XSS è stata scoperta nel servizio di prenotazione pasti ARD. La vulnerabilità esiste nel parametro GET transactionID nella pagina di conferma della transazione. A causa di una convalida dell'input e di una codifica dell'output...

CVE-2025-48593

CVE-2025-48593: Esecuzione di codice remoto zero-click nel sistema Android Autore: LAKSHMIKANTHAN K letchupkt Data: novembre 2025 Gravità: Critica Una vulnerabilità critica di esecuzione di codice remoto zero-click che colpisce i dispositivi Android 13-16. Panoramica della vulnerabilità Attributo...

CVE-2025-11170

CVE-2025-11170 WP移行専用プラグイン for CPI = 1.0.2 - Caricamento Arbitrario di File non Autenticato 🚀 WP移行専用プラグイン for CPI = 1.0.2 - Caricamento Arbitrario di File non Autenticato 📝 Descrizione Il plugin WP移行専用プラグイン for CPI per WordPress è vulnerabile a caricamenti arbitrari di file a causa della mancanza...

CVE-2023-46604-Analysis

Analisi di CVE-2023-46604 Repository tecnico di analisi che riassume le cause, il percorso del codice, i punti di patch e i risultati della riproduzione della vulnerabilità Apache ActiveMQ CVE-2023-46604. Questo documento è materiale didattico per l'analisi tecnica e la difesa dalla vulnerabilità...

CVE-2026-41012

Traffic interception vulnerability in BOSH Director vCenter CPI allows attackers positioned between BOSH Director and vCenter to impersonate vCenter REST API and capture administrator credentials via HTTP Basic auth, leading to complete virtualization infrastructure takeover. An attacker who can...

CVE-2026-41012 BOSH vSphere CPI Improper Cert Validation

Traffic interception vulnerability in BOSH Director vCenter CPI allows attackers positioned between BOSH Director and vCenter to impersonate vCenter REST API and capture administrator credentials via HTTP Basic auth, leading to complete virtualization infrastructure takeover. An attacker who can...

EUVD-2026-68038

Traffic interception vulnerability in BOSH Director vCenter CPI allows attackers positioned between BOSH Director and vCenter to impersonate vCenter REST API and capture administrator credentials via HTTP Basic auth, leading to complete virtualization infrastructure takeover. An attacker who can...

CVE-2026-41012

CVE-2026-41012 is a traffic interception vulnerability in BOSH Director vSphere CPI (all versions prior to v98.0.6 ) caused by insufficient certificate validation and pinning in the communication between BOSH Director and vCenter. An attacker positioned between the two can impersonate the vCenter...

EUVD-2025-210810

IBM Concert 1.0.0 through 2.3.1 could allow a remote attacker to perform unauthorized actions using man in the middle techniques due to improper certificate validation...

EUVD-2025-210809

IBM Integrated Analytics System 1.0.0.0 through 1.0.31.0 does not validate or improperly validates TLS certificate validation, which could allow an attacker to obtain sensitive information using man in the middle techniques...

EUVD-2026-66215

Kimai before 2.62.0 fails to validate createothertimesheet permission in the QuickEntry controller when creating new timesheets. Authenticated users with viewothertimesheet and editothertimesheet permissions can create timesheet records for team members by submitting the QuickEntry form, bypassin...

Linux Distros Unpatched Vulnerability : CVE-2026-73208

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An attacker that holds a token intended for a different purpose can authenticate, because when an OAuth2 token response does not contain a scope claim, the...

PT-2026-83455

Memos through 0.30.0 omits the 100.64.0.0/10 carrier-grade NAT address range from SSRF protection in its link-metadata fetcher, allowing unauthenticated attackers to bypass IP validation. Attackers can make the server request internal hosts in that range including cloud metadata services and read...