PCTCore64.sys Windows kernel driver contains missing access control vulnerability

Overview The PCTCore64.sys Windows kernel driver from PC Tools Internet Security exposes its \.\PCTCoreDriver device interface with no access control, allowing any user-mode process to interact with the driver and invoke privileged IOCTL I/O Control commands. In a Bring Your Own Vulnerable Driver...

Bdtask Multi-Store Inventory Management System SQL注入漏洞

The Bdtask Multi-Store Inventory Management System is an inventory management system developed by the Bdtask company in Bangladesh. Version 1.0 of the Bdtask Multi-Store Inventory Management System has a SQL injection vulnerability. This vulnerability arises from the accountsreportsearch function...

WordPress WebinarIgnition plugin < 4.08.253 - Privilege Escalation vulnerability

Privilege Escalation vulnerability discovered by hhhai in WordPress Plugin WebinarIgnition versions 4.08.253...

Exploit for OS Command Injection in Thecodingmachine Gotenberg

POCCVE-2026-42589 Local reproduction lab and nuclei template...

CVE-2026-27136 affecting package kube-vip-cloud-provider for versions less than 0.0.10-6

CVE-2026-27136 affecting package kube-vip-cloud-provider for versions less than 0.0.10-6. A patched version of the package is available...

CVE-2026-25680 affecting package prometheus-adapter for versions less than 0.12.0-6

CVE-2026-25680 affecting package prometheus-adapter for versions less than 0.12.0-6. A patched version of the package is available...

CVE-2026-39821 affecting package kubevirt for versions less than 1.7.1-5

CVE-2026-39821 affecting package kubevirt for versions less than 1.7.1-5. A patched version of the package is available...

CVE-2026-48163

Disclaimer: This data contains information about vulnerable...

Exim 安全漏洞

Exim is an open-source message transfer agent MTA developed by Exim Software, running on Unix systems. It primarily handles the routing, forwarding, and delivery of emails. Versions of Exim from 4.88 to 4.99.4 contained security vulnerabilities. These vulnerabilities stemmed from improper handlin...

Linux Distros Unpatched Vulnerability : CVE-2026-47761

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - TinyMCE is an open source rich text editor. Prior to 5.11.1, 7.9.3, and 8.5.1, there is a stored XSS vulnerability in the media plugin. Attackers can inject...

CVE-2026-47266

Formie is a Craft CMS plugin for creating forms. Prior to 2.2.21 and 3.1.26, unauthenticated users could modify existing submissions by posting a known or guessed submission ID to formie/submissions/save-submission. This vulnerability is fixed in 2.2.21 and 3.1.26...

@agenticmail/api (>=0.2.26, <=0.7.21), @agenticmail/claudecode (>=0.1.0, <=0.1.17) +5 more potentially affected by CVE-2026-47255 via @agenticmail/core (>=0.2.26, <=0.7.6)

@agenticmail/core NPM version =0.2.26, =0.2.26, =0.1.0, =0.5.57, =0.2.1, =0.5.40, =0.5.40, =0.3.0, =0.5.56 Source cves: CVE-2026-47255 Source advisory: SNYK:JS-AGENTICMAILCORE-17739017...

@openinc/parse-server-opendash (>=4.0.0, <=4.0.29) potentially affected by CVE-2026-47248 via parse-server (>=9.6.0-alpha.37, <=9.8.0)

parse-server NPM version =9.6.0-alpha.37, =4.0.0, =4.0.29 Source cves: CVE-2026-47248 Source advisory: SNYK:JS-PARSESERVER-17111546...

aati (>=0.10.2, <=0.11.3), ablavema (0.4.2) +1697 more potentially affected by unknown CVE via tar (>=0.2.14, <=0.4.40)

tar CARGO version =0.2.14, =0.10.2, =0.1.0, =0.1.2, =0.23.0, =0.23.0, =0.9.0, =0.2.5-rc.5, =1.2.0, =0.5.4-rc.1, =0.5.4-rc.1, =0.6.0, =0.4.0, =0.4.2 and more Source cves: unknown CVE Source advisory: OSV:GHSA-3PV8-6F4R-FFG2...

CVE-2026-47266 Formie: Unauthenticated front-end submission editing can overwrite existing submissions

Formie is a Craft CMS plugin for creating forms. Prior to 2.2.21 and 3.1.26, unauthenticated users could modify existing submissions by posting a known or guessed submission ID to formie/submissions/save-submission. This vulnerability is fixed in 2.2.21 and 3.1.26...

CVE-2026-48555 Spatie Laravel Media Library < 11.23.0 SSRF via addMediaFromUrl()

Spatie Laravel Media Library before version 11.23.0 contains a server-side request forgery vulnerability that allows remote attackers to cause the server to issue arbitrary outbound HTTP requests by passing user-controlled URLs to the addMediaFromUrl method in InteractsWithMedia.php...

GHSA-RR89-W3H9-M66J ExifReader is vulnerable to denial of service via unbounded decompression of image metadata

Impact Versions of ExifReader from 4.20.0 through 4.38.1 do not bound the size of decompressed metadata blocks. When a caller invokes the asynchronous API e.g. ExifReader.loadfile or ExifReader.loadbuffer, async: true on an attacker-supplied image, a small compressed chunk in the file can expand ...

CVE-2026-44649 SillyTavern: Authentication Bypass via SSO Header Injection

SillyTavern is a locally installed user interface that allows users to interact with text generation large language models, image generation engines, and text-to-speech voice models. Prior to 1.18.0, SillyTavern accepts Remote-User Authelia and X-Authentik-Username Authentik HTTP headers to...

@0xwork/connect (>=0.1.0, <=0.1.7), @agentholdings/agent-passport (>=0.1.0, <=0.1.5) +24 more potentially affected by CVE-2026-34507 via openclaw (>=2026.3.22, <=2026.4.26)

openclaw NPM version =2026.3.22, =0.1.0, =0.1.0, =0.8.3-beta.1, =0.1.0, =2026.3.25, =0.0.0, =27.2.5, =1.1.0, =2.1.3, =2026.3.24-3, =0.14.39, =0.1.0, =0.1.1, =0.2.18 and more Source cves: CVE-2026-34507 Source advisory: SNYK:JS-OPENCLAW-17139458...

@0xwork/connect (>=0.1.0, <=0.1.7), @agentholdings/agent-passport (>=0.1.0, <=0.1.5) +27 more potentially affected by CVE-2026-35674 via openclaw (>=2026.3.22, <=2026.5.7)

openclaw NPM version =2026.3.22, =0.1.0, =0.1.0, =0.8.3-beta.1, =0.1.0, =2.2.4, =2026.3.25, =4.0.0, =0.0.0, =27.2.5, =1.1.0, =2.1.3, =2026.3.24-3, =0.14.39, =0.14.42 and more Source cves: CVE-2026-35674 Source advisory: SNYK:JS-OPENCLAW-17139459...