78731 matches found
GeoVision LPC2011/LPC2211 DdnsSetting.cgi OS command injection vulnerability
Summary A OS command injection vulnerability exists in the DdnsSetting.cgi functionality of LPC2011/LPC2211 versions: 1.10. A specially crafted DDNS configuration can lead to arbitrary command execution. An attacker can modify a configuration value to trigger this vulnerability. Confirmed...
Security update for restic (important)
openSUSE Security Update: Security update for restic Announcement ID: openSUSE-SU-2026:0206-1 Rating: important References: 1240262 1265915 1266211 1266795 Cross-References: CVE-2026-33814 CVSS scores: CVE-2026-33814 SUSE: 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: openSU...
Security update for cheat (important)
openSUSE Security Update: Security update for cheat Announcement ID: openSUSE-SU-2026:0205-1 Rating: important References: 1264943 1265539 1266184 1267330 Cross-References: CVE-2026-1229 CVE-2026-39827 CVE-2026-39828 CVE-2026-39829 CVE-2026-39830 CVE-2026-39831 CVE-2026-39832 CVE-2026-39833...
PT-2026-49288
Name of the Vulnerable Software and Affected Versions OpenSIPS Control Panel versions prior to 9.3.3 Description A Time-Based Blind SQL Injection in the alias management module allows authenticated attackers to execute arbitrary SQL commands. This occurs via the 'table' GET parameter in the 'alia...
PT-2026-49340
Name of the Vulnerable Software and Affected Versions GStreamer affected versions not specified Description A flaw exists in the RealMedia demuxer within the gst-plugins-ugly package. When processing a RealMedia file with a specially crafted FILEINFO metadata section, the demuxer uses the re skip...
Linux Distros Unpatched Vulnerability : CVE-2026-53704
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in GStreamer's RealMedia demuxer in the gst-plugins-ugly package. When processing a RealMedia file containing a specially crafted FILEINFO...
GeoVision GV-VMS V20 WebCam Server Login stack overflow vulnerability
Summary A stack overflow vulnerability exists in the WebCam Server Login functionality of GV-VMS V20 versions: 20.0.2. A specially crafted HTTP request can lead to an arbitrary code execution. An attacker can make an unauthenticated HTTP request to trigger this vulnerability. Confirmed Vulnerable...
Exploit for CVE-2026-42945
CVE-2026-42945 NGINX Rift RCE PoC with Reverse Shell Remote...
PT-2026-50586
Name of the Vulnerable Software and Affected Versions Gitea versions 1.25.0 and later Description Gitea is subject to stored cross-site scripting XSS through the built-in 3D file viewer, which utilizes the Online3DViewer library. The issue occurs when a .gltf file contains an unsupported extensio...
openSUSE 16 Security Update : grafana (openSUSE-SU-2026:20940-1)
The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:20940-1 advisory. Changes in grafana: - CVE-2026-39821: Fix validation bypass and privilege escalation by updating golang.org/x/net to version 0.55.0 bsc1266600 -...
Malicious code in @gbrlxvi/ts-form-utils (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 20e77262ebb59497687fabfba394959da9ce6afbaf436aa5fcf654b2c8a44a32 Package advertises trivial form-validation helpers notEmpty/isEmail/isPhone/maxLen/minLen but on require/import of the main module performs an...
MAL-2026-5753 Malicious code in @gbrlxvi/ts-form-utils (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 20e77262ebb59497687fabfba394959da9ce6afbaf436aa5fcf654b2c8a44a32 Package advertises trivial form-validation helpers notEmpty/isEmail/isPhone/maxLen/minLen but on require/import of the main module performs an...
OffSploit
OffSploit: Autonomous Exploit Adaptation & C2 Framework !Py...
Exploit for CVE-2026-42647
CVE-2026-42647 - JoomSport Unauthenticated Time-Based Blind SQ...
CVE-2026-9109
The GPTranslate – Multilingual AI Translation for WordPress: Automatically Translate Websites plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REST API Translation Storage in all versions up to, and including, 2.31 due to insufficient input sanitization and output escaping...
CVE-2026-9109 GPTranslate <= 2.31 - Unauthenticated Stored Cross-Site Scripting via REST API Translation Storage
The GPTranslate – Multilingual AI Translation for WordPress: Automatically Translate Websites plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REST API Translation Storage in all versions up to, and including, 2.31 due to insufficient input sanitization and output escaping...
EUVD-2026-36642
The GPTranslate – Multilingual AI Translation for WordPress: Automatically Translate Websites plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REST API Translation Storage in all versions up to, and including, 2.31 due to insufficient input sanitization and output escaping...
CVE-2026-9109
CVE-2026-9109 : Stored Cross-Site Scripting in GPTranslate – Multilingual AI Translation for WordPress (versions ≤ 2.31) due to insufficient input sanitization and output escaping in REST API Translation Storage. Unauthenticated users can inject scripts; the API key (SHA-256 of site URL) is print...
CVE-2026-9109 GPTranslate <= 2.31 - Unauthenticated Stored Cross-Site Scripting via REST API Translation Storage
The GPTranslate – Multilingual AI Translation for WordPress: Automatically Translate Websites plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REST API Translation Storage in all versions up to, and including, 2.31 due to insufficient input sanitization and output escaping...