CVE-2026-14281 Automation Web Platform <= 4.8.6 - Unauthenticated Privilege Escalation via 'wawp_custom_fields' Parameter

The Automation Web Platform – Notifications and OTP for WooCommerce, Advanced Country Code plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.8.6. This is due to missing permission enforcement on the publicly accessible REST route POST...

EUVD-2026-86548

The Automation Web Platform – Notifications and OTP for WooCommerce, Advanced Country Code plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.8.6. This is due to missing permission enforcement on the publicly accessible REST route POST...

CVE-2026-87571

A flaw was found in Google Chrome. Improper certificate validation in the Loader component allows a remote attacker, through social engineering and crafted network traffic, to bypass the web origin policy. This bypass could enable an attacker to circumvent security restrictions designed to isolat...

CVE-2026-87469

A flaw was found in Extensions in Google Chrome. Improper input validation allows a remote attacker to bypass the web origin policy. This can lead to unauthorized access to privileged pages through specially crafted network traffic...

Lurkstrain

Lurkstrain An all in one admin panel crawler for pentesters...

Extracter

Extracter Extracter is a nice tool to find login panels on a website, it will gather information on a robots file or other areas that the site mitgh have. This tool is only made for fun and should not be used to abuse other sites without any permission...

CVE-2026-87577

A flaw was found in Chromium. A remote attacker could exploit an authorization vulnerability by creating a specially designed web page. This could allow the attacker to bypass security restrictions, known as the web origin policy, and access sensitive information or functionality on a privileged...

CVE-2026-87550

A flaw was found in Google Chrome. A remote attacker could exploit improper encoding or escaping of output within the browser's Cascading Style Sheets CSS component. By delivering a specially crafted HTML page, the attacker could potentially bypass the web origin policy. This policy is a critical...

CVE-2026-79261

A flaw was found in Google Chrome. A remote attacker could exploit an incorrect authorization vulnerability by crafting a malicious HTML page. This could allow the attacker to bypass the web origin policy, potentially leading to unauthorized access to sensitive data or actions within the user's...

CVE-2026-79273

A flaw was found in WebView in Google Chrome on Android. Incorrect reference resolution could allow a remote attacker to bypass the web origin policy by enticing a user to visit a specially crafted HTML page. This could lead to unauthorized access to sensitive information or actions within the...

CVE-2026-79251

A flaw was found in Google Chrome. Improper input validation in the Network component allows a remote attacker to potentially bypass the web origin policy. This can be achieved by enticing a user to visit a specially crafted HTML page. The web origin policy is a critical security mechanism that...

CVE-2026-79136

A flaw was found in Chromium. This incorrect authorization vulnerability in the ServiceWorker component allows a remote attacker to bypass the web origin policy. By crafting a malicious HTML page, an attacker can circumvent security restrictions, potentially leading to unauthorized access to...

sql-injection-labs

SQL Injection Labs — PortSwigger Web Security Academy A colle...

OESA-2026-4123 firefox security update

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance and portability. Security Fixes: Use-after-free in the Audio/Video: Web Codecs component. This vulnerability was fixed in Firefox 156, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird...

OESA-2026-4122 firefox security update

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance and portability. Security Fixes: Use-after-free in the Audio/Video: Web Codecs component. This vulnerability was fixed in Firefox 156, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird...

OESA-2026-4121 firefox security update

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance and portability. Security Fixes: Use-after-free in the Audio/Video: Web Codecs component. This vulnerability was fixed in Firefox 156, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird...

OESA-2026-4120 firefox security update

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance and portability. Security Fixes: Use-after-free in the Audio/Video: Web Codecs component. This vulnerability was fixed in Firefox 156, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird...

PT-2026-106309

Summary The /home/file path:path endpoint in web client.py serves static files by directly concatenating the user-supplied file path with the home directory constant. There is no path traversal filtering, no path normalization check, and no authentication required. An attacker can use ../ sequenc...

PT-2026-98871

Name of the Vulnerable Software and Affected Versions Mediawiki - Cargo extension versions prior to 3.9.5 Description Improper neutralization of input during web page generation in the Mediawiki - Cargo extension allows Stored Cross-Site Scripting XSS, a condition where malicious scripts are...

PT-2026-98826

Name of the Vulnerable Software and Affected Versions D-Link DAP-2610 versions prior to 2.06B08r099 Description An authenticated command injection issue exists within the web interface at the '/index.xgi' endpoint. An attacker with authenticated access can exploit specific parameters to execute...