mirror of
https://github.com/trickest/cve.git
synced 2026-11-07 04:29:23 -10:00
Update Wed Sep 9 12:12:28 UTC 2026
This commit is contained in:
trickest-workflows committed
1 parent
11265fa5d0
commit
d41ac80dcb
124 files changed
+1447
-46
No files matched your search
@@ -0,0 +1,17 @@
|
||||
### [CVE-2007-1362](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1362)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
Mozilla Firefox 1.5.x before 1.5.0.12 and 2.x before 2.0.0.4, and SeaMonkey 1.0.9 and 1.1.2, allows remote attackers to cause a denial of service via (1) a large cookie path parameter, which triggers memory consumption, or (2) an internal delimiter within cookie path or name values, which could trigger a misinterpretation of cookie data, aka "Path Abuse in Cookies."
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- http://www.redhat.com/support/errata/RHSA-2007-0401.html
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -11,6 +11,7 @@ The APOP protocol allows remote attackers to guess the first 3 characters of a p
|
||||
|
||||
#### Reference
|
||||
- http://www.novell.com/linux/security/advisories/2007_14_sr.html
|
||||
- http://www.redhat.com/support/errata/RHSA-2007-0401.html
|
||||
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9782
|
||||
|
||||
#### Github
|
||||
|
||||
@@ -10,7 +10,7 @@ Multiple vulnerabilities in the layout engine for Mozilla Firefox 1.5.x before 1
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
No PoCs from references.
|
||||
- http://www.redhat.com/support/errata/RHSA-2007-0401.html
|
||||
|
||||
#### Github
|
||||
- https://github.com/ARPSyndicate/cve-scores
|
||||
|
||||
@@ -10,7 +10,7 @@ Multiple vulnerabilities in the JavaScript engine for Mozilla Firefox 1.5.x befo
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
No PoCs from references.
|
||||
- http://www.redhat.com/support/errata/RHSA-2007-0401.html
|
||||
|
||||
#### Github
|
||||
- https://github.com/ARPSyndicate/cve-scores
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2007-2869](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2869)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The form autocomplete feature in Mozilla Firefox 1.5.x before 1.5.0.12, 2.x before 2.0.0.4, and possibly earlier versions, allows remote attackers to cause a denial of service (persistent temporary CPU consumption) via a large number of characters in a submitted form.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- http://www.redhat.com/support/errata/RHSA-2007-0401.html
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2007-2871](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2871)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
Mozilla Firefox 1.5.x before 1.5.0.12 and 2.x before 2.0.0.4, and SeaMonkey 1.0.9 and 1.1.2, allows remote attackers to spoof or hide the browser chrome, such as the location bar, by placing XUL popups outside of the browser's content pane. NOTE: this issue can be leveraged for phishing and other attacks.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- http://www.redhat.com/support/errata/RHSA-2007-0401.html
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -11,6 +11,7 @@ SQL injection vulnerability in storecat.php in JCE-Tech Overstock 1 allows remot
|
||||
|
||||
#### Reference
|
||||
- http://packetstormsecurity.org/1006-exploits/overstock-sql.txt
|
||||
- http://www.exploit-db.com/exploits/13946
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -11,6 +11,7 @@ Multiple PHP remote file inclusion vulnerabilities in Seagull 0.6.7 allow remote
|
||||
|
||||
#### Reference
|
||||
- http://packetstormsecurity.org/1008-exploits/seagull-rfi.txt
|
||||
- http://www.exploit-db.com/exploits/14841
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2013-0879](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0879)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
Google Chrome before 25.0.1364.97 on Windows and Linux, and before 25.0.1364.99 on Mac OS X, does not properly implement web audio nodes, which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown vectors.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- http://googlechromereleases.blogspot.com/2013/02/stable-channel-update_21.html
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -10,7 +10,7 @@ Use-after-free vulnerability in Google Chrome before 25.0.1364.97 on Windows and
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
No PoCs from references.
|
||||
- http://googlechromereleases.blogspot.com/2013/02/stable-channel-update_21.html
|
||||
|
||||
#### Github
|
||||
- https://github.com/Live-Hack-CVE/CVE-2013-0880
|
||||
|
||||
@@ -10,7 +10,7 @@ Google Chrome before 25.0.1364.97 on Windows and Linux, and before 25.0.1364.99
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
No PoCs from references.
|
||||
- http://googlechromereleases.blogspot.com/2013/02/stable-channel-update_21.html
|
||||
|
||||
#### Github
|
||||
- https://github.com/Live-Hack-CVE/CVE-2013-0881
|
||||
|
||||
@@ -10,7 +10,7 @@ Google Chrome before 25.0.1364.97 on Windows and Linux, and before 25.0.1364.99
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
No PoCs from references.
|
||||
- http://googlechromereleases.blogspot.com/2013/02/stable-channel-update_21.html
|
||||
|
||||
#### Github
|
||||
- https://github.com/Live-Hack-CVE/CVE-2013-0882
|
||||
|
||||
@@ -10,7 +10,7 @@ Skia, as used in Google Chrome before 25.0.1364.97 on Windows and Linux, and bef
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
No PoCs from references.
|
||||
- http://googlechromereleases.blogspot.com/2013/02/stable-channel-update_21.html
|
||||
|
||||
#### Github
|
||||
- https://github.com/Live-Hack-CVE/CVE-2013-0883
|
||||
|
||||
@@ -10,7 +10,7 @@ Google Chrome before 25.0.1364.97 on Windows and Linux, and before 25.0.1364.99
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
No PoCs from references.
|
||||
- http://googlechromereleases.blogspot.com/2013/02/stable-channel-update_21.html
|
||||
|
||||
#### Github
|
||||
- https://github.com/Live-Hack-CVE/CVE-2013-0884
|
||||
|
||||
@@ -10,7 +10,7 @@ Google Chrome before 25.0.1364.97 on Windows and Linux, and before 25.0.1364.99
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
No PoCs from references.
|
||||
- http://googlechromereleases.blogspot.com/2013/02/stable-channel-update_21.html
|
||||
|
||||
#### Github
|
||||
- https://github.com/Live-Hack-CVE/CVE-2013-0885
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2013-0886](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0886)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
Google Chrome before 25.0.1364.99 on Mac OS X does not properly implement signal handling for Native Client (aka NaCl) code, which has unspecified impact and attack vectors.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- http://googlechromereleases.blogspot.com/2013/02/stable-channel-update_21.html
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -10,7 +10,7 @@ The developer-tools process in Google Chrome before 25.0.1364.97 on Windows and
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
No PoCs from references.
|
||||
- http://googlechromereleases.blogspot.com/2013/02/stable-channel-update_21.html
|
||||
|
||||
#### Github
|
||||
- https://github.com/Live-Hack-CVE/CVE-2013-0887
|
||||
|
||||
@@ -10,7 +10,7 @@ Skia, as used in Google Chrome before 25.0.1364.97 on Windows and Linux, and bef
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
No PoCs from references.
|
||||
- http://googlechromereleases.blogspot.com/2013/02/stable-channel-update_21.html
|
||||
|
||||
#### Github
|
||||
- https://github.com/Live-Hack-CVE/CVE-2013-0888
|
||||
|
||||
@@ -10,7 +10,7 @@ Google Chrome before 25.0.1364.97 on Windows and Linux, and before 25.0.1364.99
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
No PoCs from references.
|
||||
- http://googlechromereleases.blogspot.com/2013/02/stable-channel-update_21.html
|
||||
|
||||
#### Github
|
||||
- https://github.com/Live-Hack-CVE/CVE-2013-0889
|
||||
|
||||
@@ -10,7 +10,7 @@ Multiple unspecified vulnerabilities in the IPC layer in Google Chrome before 25
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
No PoCs from references.
|
||||
- http://googlechromereleases.blogspot.com/2013/02/stable-channel-update_21.html
|
||||
|
||||
#### Github
|
||||
- https://github.com/Live-Hack-CVE/CVE-2013-0890
|
||||
|
||||
@@ -10,7 +10,7 @@ Integer overflow in Google Chrome before 25.0.1364.97 on Windows and Linux, and
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
No PoCs from references.
|
||||
- http://googlechromereleases.blogspot.com/2013/02/stable-channel-update_21.html
|
||||
|
||||
#### Github
|
||||
- https://github.com/Live-Hack-CVE/CVE-2013-0891
|
||||
|
||||
@@ -10,7 +10,7 @@ Multiple unspecified vulnerabilities in the IPC layer in Google Chrome before 25
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
No PoCs from references.
|
||||
- http://googlechromereleases.blogspot.com/2013/02/stable-channel-update_21.html
|
||||
|
||||
#### Github
|
||||
- https://github.com/Live-Hack-CVE/CVE-2013-0892
|
||||
|
||||
@@ -10,7 +10,7 @@ Race condition in Google Chrome before 25.0.1364.97 on Windows and Linux, and be
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
No PoCs from references.
|
||||
- http://googlechromereleases.blogspot.com/2013/02/stable-channel-update_21.html
|
||||
|
||||
#### Github
|
||||
- https://github.com/Live-Hack-CVE/CVE-2013-0893
|
||||
|
||||
@@ -10,6 +10,7 @@ Buffer overflow in the vorbis_parse_setup_hdr_floors function in the Vorbis deco
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- http://googlechromereleases.blogspot.com/2013/02/stable-channel-update_21.html
|
||||
- http://www.ubuntu.com/usn/USN-1790-1
|
||||
|
||||
#### Github
|
||||
|
||||
@@ -10,7 +10,7 @@ Google Chrome before 25.0.1364.97 on Linux, and before 25.0.1364.99 on Mac OS X,
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
No PoCs from references.
|
||||
- http://googlechromereleases.blogspot.com/2013/02/stable-channel-update_21.html
|
||||
|
||||
#### Github
|
||||
- https://github.com/Live-Hack-CVE/CVE-2013-0895
|
||||
|
||||
@@ -10,7 +10,7 @@ Google Chrome before 25.0.1364.97 on Windows and Linux, and before 25.0.1364.99
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
No PoCs from references.
|
||||
- http://googlechromereleases.blogspot.com/2013/02/stable-channel-update_21.html
|
||||
|
||||
#### Github
|
||||
- https://github.com/Live-Hack-CVE/CVE-2013-0896
|
||||
|
||||
@@ -10,7 +10,7 @@ Off-by-one error in the PDF functionality in Google Chrome before 25.0.1364.97 o
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
No PoCs from references.
|
||||
- http://googlechromereleases.blogspot.com/2013/02/stable-channel-update_21.html
|
||||
|
||||
#### Github
|
||||
- https://github.com/Live-Hack-CVE/CVE-2013-0897
|
||||
|
||||
@@ -10,7 +10,7 @@ Use-after-free vulnerability in Google Chrome before 25.0.1364.97 on Windows and
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
No PoCs from references.
|
||||
- http://googlechromereleases.blogspot.com/2013/02/stable-channel-update_21.html
|
||||
|
||||
#### Github
|
||||
- https://github.com/Live-Hack-CVE/CVE-2013-0898
|
||||
|
||||
@@ -10,7 +10,7 @@ Integer overflow in the padding implementation in the opus_packet_parse_impl fun
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
No PoCs from references.
|
||||
- http://googlechromereleases.blogspot.com/2013/02/stable-channel-update_21.html
|
||||
|
||||
#### Github
|
||||
- https://github.com/Live-Hack-CVE/CVE-2013-0899
|
||||
|
||||
@@ -10,7 +10,7 @@ Race condition in the International Components for Unicode (ICU) functionality i
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
No PoCs from references.
|
||||
- http://googlechromereleases.blogspot.com/2013/02/stable-channel-update_21.html
|
||||
|
||||
#### Github
|
||||
- https://github.com/Live-Hack-CVE/CVE-2013-0900
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2013-2268](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2268)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
Unspecified vulnerability in the MathML implementation in WebKit in Google Chrome before 25.0.1364.97 on Windows and Linux, and before 25.0.1364.99 on Mac OS X, has unknown impact and remote attack vectors, related to a "high severity security issue."
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- http://googlechromereleases.blogspot.com/2013/02/stable-channel-update_21.html
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -12,6 +12,7 @@ Use-after-free vulnerability in Microsoft Internet Explorer 6 through 11 allows
|
||||
#### Reference
|
||||
- http://www.signalsec.com/cve-2014-1776-ie-0day-analysis/
|
||||
- https://www.vicarius.io/vsociety/posts/cve-2014-1776-use-after-free-vulnerability-in-microsoft-internet-explorer-detection-script
|
||||
- https://www.vicarius.io/vsociety/posts/cve-2014-1776-use-after-free-vulnerability-in-microsoft-internet-explorer-mitigation-scripts
|
||||
|
||||
#### Github
|
||||
- https://github.com/CyberMonitor/APT_CyberCriminal_Campagin_Collections
|
||||
|
||||
@@ -10,6 +10,7 @@ The Microsoft (1) VBScript 5.7 and 5.8 and (2) JScript 5.7 and 5.8 engines, as u
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-108
|
||||
- https://www.exploit-db.com/exploits/40798/
|
||||
|
||||
#### Github
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2015-6052](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-6052)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The Microsoft (1) VBScript 5.7 and 5.8 and (2) JScript 5.7 and 5.8 engines, as used in Internet Explorer 8 through 11 and other products, allow remote attackers to bypass the ASLR protection mechanism via a crafted web site, aka "VBScript and JScript ASLR Bypass."
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-108
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -10,7 +10,7 @@ The Microsoft (1) VBScript 5.7 and 5.8 and (2) JScript 5.7 and 5.8 engines, as u
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
No PoCs from references.
|
||||
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-108
|
||||
|
||||
#### Github
|
||||
- https://github.com/ARPSyndicate/cve-scores
|
||||
|
||||
@@ -10,7 +10,7 @@ The Microsoft (1) VBScript 5.7 and 5.8 and (2) JScript 5.7 and 5.8 engines, as u
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
No PoCs from references.
|
||||
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-108
|
||||
|
||||
#### Github
|
||||
- https://github.com/ARPSyndicate/cve-scores
|
||||
|
||||
@@ -12,6 +12,7 @@ Information disclosure and authentication bypass vulnerability exists in the Apa
|
||||
#### Reference
|
||||
- http://seclists.org/bugtraq/2017/Feb/6
|
||||
- http://seclists.org/fulldisclosure/2017/Feb/11
|
||||
- https://github.com/ZoneMinder/ZoneMinder/pull/1697
|
||||
|
||||
#### Github
|
||||
- https://github.com/asaotomo/CVE-2016-10140-Zoneminder-Poc
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2022-37930](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-37930)
|
||||
|
||||
%2C%205.3.0.0%20(GA)%20&color=brightgreen)
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A security vulnerability has been identified in HPE Nimble Storage Hybrid Flash Arrays and HPE Nimble Storage Secondary Flash Arrays which could potentially allow local disclosure of sensitive information.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst04361en_us
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -5,7 +5,7 @@
|
||||
|
||||
### Description
|
||||
|
||||
An issue discovered in provectus kafka-ui 0.4.0 through 0.7.1 allows remote attackers to execute arbitrary code via the q parameter of /api/clusters/local/topics/{topic}/messages.
|
||||
An issue discovered in provectus kafka-ui 0.4.0 through 0.7.2 allows remote attackers to execute arbitrary code via the q parameter of /api/clusters/local/topics/{topic}/messages. No fixed release is available; the project has had no commit since 2024-04-08.
|
||||
|
||||
### POC
|
||||
|
||||
|
||||
@@ -6,12 +6,12 @@
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2025-10693](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-10693)
|
||||
|
||||
|
||||
&color=brightgreen)
|
||||
|
||||
### Description
|
||||
|
||||
When SmartStart Inclusion fails during the onboarding of a Z-Wave PIR sensor, the sensor will join the network as a non-secure device. This vulnerability exists in Silicon Labs' Z-Wave PIR Sensor Reference design delivered as part of SiSDK v2025.6.0 and v2025.6.1.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://community.silabs.com/068Vm00000WN3J0
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
### [CVE-2025-2842](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-2842)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@@ -8,7 +8,7 @@
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@@ -24,7 +24,7 @@
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@@ -28,7 +28,7 @@
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@@ -19,7 +19,7 @@
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@@ -10,6 +10,7 @@ CodeAstro Membership Management System 1.0 contains a missing authentication vul
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://0x0bito.github.io/posts/CVE-2025-70150-Membership-Unauth-Delete/
|
||||
- https://youngkevinn.github.io/posts/CVE-2025-70150-Membership-Unauth-Delete/
|
||||
|
||||
#### Github
|
||||
|
||||
@@ -26,7 +26,7 @@
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@@ -30,7 +30,7 @@
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@@ -3,6 +3,7 @@
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-11641](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-11641)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
Use after free in Bluetooth in Google Chrome on Windows prior to 149.0.7827.103 allowed a remote attacker who convinced a user to engage in specific UI gestures to execute arbitrary code via a crafted HTML page. (Chromium security severity: Critical)
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://issues.chromium.org/issues/517418936
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-11643](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-11643)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
Use after free in Proxy in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to execute arbitrary code via malicious network traffic. (Chromium security severity: Critical)
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://issues.chromium.org/issues/518006379
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-11666](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-11666)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
Insufficient validation of untrusted input in Input in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: High)
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://issues.chromium.org/issues/514009323
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-11675](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-11675)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
Out of bounds read in Skia in Google Chrome prior to 149.0.7827.103 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://issues.chromium.org/issues/516915337
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-11686](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-11686)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
Insufficient validation of untrusted input in Dawn in Google Chrome on macOS prior to 149.0.7827.103 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://issues.chromium.org/issues/517247333
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -13,6 +13,8 @@ A vulnerability was identified in Groww Stock, Mutual Fund, Gold App up to 20260
|
||||
#### Reference
|
||||
- https://github.com/honestcorrupt/CVE-req-Groww-Android-Application-Unsafe-WebView-URL-Handling-Weak-Client-Side-App-Lock-Enforcement
|
||||
- https://github.com/honestcorrupt/Groww-Android-Application-Unsafe-WebView-URL-Handling-Weak-Client-Side-App-Lock-Enforcement.git
|
||||
- https://vuldb.com/vuln/370560
|
||||
- https://vuldb.com/vuln/370560/cti
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-13144](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13144)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The WP Travel WordPress plugin before 12.0.2 does not properly verify that the requester is authorized to modify the targeted booking on one branch of its bank-deposit handler, allowing an unauthenticated attacker who knows the target customer's email address to reset that customer's booking payment to an unpaid state and wipe its stored deposit-reconciliation data.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/6ffdaa34-83fd-4a05-bf36-071b17f280c4/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-13146](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13146)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The WP Travel WordPress plugin before 12.0.2 does not properly verify that the requester owns the booking targeted by its bank-deposit slip submission, allowing an unauthenticated attacker who knows the target customer's email address to change that customer's booking payment state and attach a file to it.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/45ce8cd1-b365-4ea6-ac93-420c1c72ea4b/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,20 @@
|
||||
### [CVE-2026-13585](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13585)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
Allocation of Resources Without Limits and Throttling and Sensitive Information in Resource Not Removed Before Reuse in the ASUS System Control Interface driver and ASUS Business Manager allow a local administrator to disclose sensitive information via crafted IOCTL requests, which, in severe cases, may lead to a Denial of Service (DoS) on the system.Refer to the ' Security Update for ASUS System Control Interface ' section on the ASUS Security Advisory for more information.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- http://seclists.org/fulldisclosure/2026/Jul/26
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-13872](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13872)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
Insufficient validation of untrusted input in WebAppInstalls in Google Chrome on Android prior to 150.0.7871.47 allowed a local attacker to potentially perform a sandbox escape via a malicious file. (Chromium security severity: Medium)
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://issues.chromium.org/issues/497977983
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-14023](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-14023)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
Insufficient validation of untrusted input in SanitizerAPI in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to bypass same origin policy via a crafted HTML page. (Chromium security severity: Medium)
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://issues.chromium.org/issues/518063436
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -11,6 +11,8 @@
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-14420](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-14420)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
Out of bounds read and write in Dawn in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://issues.chromium.org/issues/517031505
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-14962](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-14962)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The ELEX WooCommerce Request a Quote WordPress plugin before 2.4.1 does not properly sanitise and escape a parameter before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks and extract arbitrary data from the database.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/854a0756-ff87-4a65-959a-2e051a302a12/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -13,6 +13,7 @@
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
&color=brightgreen)
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-16769](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-16769)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
An unencrypted 'pause encryption request' message causes a denial of service in the in the RS9116W/SiWx917. See vulnerability B-E10 in the related paper below.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://arxiv.org/pdf/2409.02905
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-16960](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-16960)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The Loops & Logic WordPress plugin before 4.3.0 does not restrict its public template-data action to the data a visitor is permitted to see, allowing unauthenticated users to read arbitrary user records (including email addresses and roles) and arbitrary site options.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/70344f9a-065d-4611-b958-0297af6f2c63/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -1,17 +1,13 @@
|
||||
### [CVE-2026-17523](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-17523)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A flaw was found in the Linux kernel in net/can/bcm.c in can: bcm, where an unprivileged local user can exploit this vulnerability to execute arbitrary code within the kernel, which leads to a local privilege escalation (LPE). This allows the attacker to gain root privileges and take full control of the affected system.
|
||||
In the Linux kernel, the following vulnerability has been resolved:can: bcm: switch timer to HRTIMER_MODE_SOFT and remove hrtimer_taskletThis patch switches the timer to HRTIMER_MODE_SOFT, which executed thetimer callback in softirq context and removes the hrtimer_tasklet.
|
||||
|
||||
### POC
|
||||
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-17784](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-17784)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
Use after free in Audio in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://issues.chromium.org/issues/513694032
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-17800](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-17800)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
Inappropriate implementation in MediaRecording in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://issues.chromium.org/issues/514480948
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-17831](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-17831)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
Insufficient validation of untrusted input in Passwords in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://issues.chromium.org/issues/517714728
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-18042](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-18042)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The WP Travel WordPress plugin before 12.0.2 does not verify that the requester is authorized to act on the booking targeted by one of its front-end payment-message handlers, allowing unauthenticated attackers to cancel the payment on any customer's booking.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/8fe9eccf-031a-43ad-b88b-b697977dc031/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-19855](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-19855)
|
||||
|
||||
|
||||
&color=brightgreen)
|
||||
|
||||
### Description
|
||||
|
||||
The CleanTalk WordPress plugin before 6.87 does not prevent unauthenticated, user-supplied comment content from being passed to WordPress's shortcode engine, allowing any visitor to have arbitrary shortcodes registered on the site executed server-side and rendered to every subsequent visitor of the page.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/c27f3657-261a-46cd-860c-0bdf5c849190/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -1,5 +1,4 @@
|
||||
### [CVE-2026-23940](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23940)
|
||||
|
||||
|
||||
|
||||
|
||||
@@ -7,7 +6,7 @@
|
||||
|
||||
### Description
|
||||
|
||||
Uncontrolled Resource Consumption vulnerability in hexpm hexpm/hexpm allows Excessive Allocation. Publishing an oversized package can cause Hex.pm to run out of memory while extracting the uploaded package tarball. This can terminate the affected application instance and result in a denial of service for package publishing and potentially other package-processing functionality.This issue affects hexpm: before 495f01607d3eae4aed7ad09b2f54f31ec7a7df01; hex.pm: before 2026-03-10.
|
||||
Uncontrolled Resource Consumption vulnerability in hexpm hexpm/hexpm allows Excessive Allocation.Publishing an oversized package can cause Hex.pm to run out of memory while extracting the uploaded package tarball. This can terminate the affected application instance and result in a denial of service for package publishing and potentially other package-processing functionality.This issue affects hex.pm: before 2026-03-10.
|
||||
|
||||
### POC
|
||||
|
||||
|
||||
@@ -7,7 +7,7 @@
|
||||
|
||||
### Description
|
||||
|
||||
Incorrect Authorization vulnerability in Erlang OTP (inets modules) allows unauthenticated access to CGI scripts protected by directory rules when served via script_alias.When script_alias maps a URL prefix to a directory outside DocumentRoot, mod_auth evaluates directory-based access controls against the DocumentRoot-relative path while mod_cgi executes the script at the ScriptAlias-resolved path. This path mismatch allows unauthenticated access to CGI scripts that directory rules were meant to protect.This vulnerability is associated with program files lib/inets/src/http_server/mod_alias.erl, lib/inets/src/http_server/mod_auth.erl, and lib/inets/src/http_server/mod_cgi.erl.This issue affects OTP from OTP 17.0 before OTP 28.4.2, OTP 27.3.4.10 and OTP 26.2.5.19, corresponding to inets from 5.10 before 9.6.2, 9.3.2.4 and 9.1.0.6.
|
||||
Incorrect Authorization vulnerability in Erlang OTP (inets modules) allows unauthenticated access to CGI scripts protected by directory rules when served via script_alias.When script_alias maps a URL prefix to a directory outside DocumentRoot, mod_auth evaluates directory-based access controls against the DocumentRoot-relative path while mod_cgi executes the script at the ScriptAlias-resolved path. This path mismatch allows unauthenticated access to CGI scripts that directory rules were meant to protect.This vulnerability is associated with program files lib/inets/src/http_server/mod_alias.erl, lib/inets/src/http_server/mod_auth.erl, and lib/inets/src/http_server/mod_cgi.erl.This issue affects OTP from OTP 17.0 before OTP 26.2.5.19, OTP 27.3.4.10, and OTP 28.4.2, corresponding to inets from 5.10 before 9.1.0.6, 9.3.2.4, and 9.6.2. Whether OTP before OTP 17.0, corresponding to inets before 5.10, is affected is unknown.
|
||||
|
||||
### POC
|
||||
|
||||
|
||||
@@ -5,7 +5,7 @@
|
||||
|
||||
### Description
|
||||
|
||||
A client-side authorization flaw in Lightspeed Classroom v5.1.2.1763770643 allows unauthenticated attackers to impersonate users by bypassing integrity checks and abusing client-generated authorization tokens, leading to unauthorized control and monitoring of student devices.
|
||||
A client-side authorization flaw in Lightspeed Systems Classroom v5.1.2.1763770643 allows unauthenticated attackers to impersonate users by bypassing integrity checks and abusing client-generated authorization tokens, leading to unauthorized control and monitoring of student devices.
|
||||
|
||||
### POC
|
||||
|
||||
|
||||
@@ -6,7 +6,7 @@
|
||||
|
||||
### Description
|
||||
|
||||
Uncontrolled Resource Consumption vulnerability in ericmj decimal allows unauthenticated remote Denial of Service.The decimal library does not bound the exponent on parsed input. Storing a decimal with a very large exponent (e.g. Decimal.new("1e1000000000")) is accepted without error. Subsequent calls to arithmetic functions (Decimal.add/2, Decimal.sub/2, Decimal.div/2), Decimal.to_string/2 with :normal or :xsd format, Decimal.to_integer/1, Decimal.round/3, or Decimal.compare/3 with a threshold allocate memory proportional to the exponent value, which can exhaust available memory and crash the BEAM VM.Any application that accepts user-supplied decimal input and subsequently performs arithmetic, rounding, conversion to integer, or string formatting on it is exposed. A single malicious request is sufficient to cause an out-of-memory crash.This issue affects decimal: from 0.1.0 before 3.0.0.
|
||||
Uncontrolled Resource Consumption vulnerability in ericmj decimal allows unauthenticated remote Denial of Service.The decimal library does not bound the exponent on parsed input. Storing a decimal with a very large exponent (e.g. Decimal.new("1e1000000000")) is accepted without error. Subsequent calls to arithmetic functions (Decimal.add/2, Decimal.sub/2, Decimal.div/2M), Decimal.to_string/2M with :normalM or :xsdM format, Decimal.to_integer/1M, Decimal.round/3M, or Decimal.compare/3M with a threshold allocate memory proportional to the exponent value, which can exhaust available memory and crash the BEAM VM.Any application that accepts user-supplied decimal input and subsequently performs arithmetic, rounding, conversion to integer, or string formatting on it is exposed. A single malicious request is sufficient to cause an out-of-memory crash.This issue affects decimal: from 0.1.0 before 3.0.0.
|
||||
|
||||
### POC
|
||||
|
||||
|
||||
@@ -10,6 +10,7 @@ Reachy Mini is an SDK for controlling Reachy Mini robots. Prior to 1.8.2, the Re
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/pollen-robotics/reachy_mini/pull/1209
|
||||
- https://github.com/pollen-robotics/reachy_mini/security/advisories/GHSA-m2pc-3q4q-w6jr
|
||||
|
||||
#### Github
|
||||
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2026-57499](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-57499)
|
||||
|
||||
|
||||
|
||||
&color=brightgreen)
|
||||
|
||||
### Description
|
||||
|
||||
Liman is open source server management software. Prior to 2.2.2 - 1103, an OS command injection vulnerability in the log rotation configuration endpoint allows an authenticated administrator to execute arbitrary operating system commands on the Liman server. The `ip_address` parameter is embedded directly into a shell command without sanitization, enabling shell escape via single-quote injection. This is fixed in 2.2.2 - 1103.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/limanmys/core/security/advisories/GHSA-3jrp-54r2-9g63
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2026-61517](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-61517)
|
||||
|
||||
|
||||
|
||||
&color=brightgreen)
|
||||
|
||||
### Description
|
||||
|
||||
Netis NX10 firmware V4.0.1.5808 and V3.0.0.4142 contain an OS command injection vulnerability in the ping diagnostic handler that allows authenticated administrators to execute arbitrary shell commands as root by injecting into the IpAddr parameter. The parameter is interpolated directly into a shell command executed through system() with an incomplete denylist that only blocks spaces, pipes, semicolons, and ampersands, leaving command substitution and alternate field separator expansion available for exploitation.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://hackwithmike.com/research/advisories/netis/cve-2026-61517
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-65976](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-65976)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
Deskflow is a keyboard and mouse sharing app. From 1.17.0 until continuous build 1.26.0.300, a connected peer can send repeated DCLP DataChunk messages to ClipboardChunk::assemble() in src/lib/deskflow/ClipboardChunk.cpp, causing the server path in src/lib/server/ClientProxy1_6.cpp or client path in src/lib/client/ServerProxy.cpp to append data beyond the DataStart declared size and configured clipboard limit before DataEnd validation, exhausting receiver memory. This issue is fixed in continuous build 1.26.0.300.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/deskflow/deskflow/security/advisories/GHSA-jf7g-qghg-p54x
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2026-73309](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-73309)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
XenForo before 2.3.13 contains an authentication bypass vulnerability in the OAuth2 token endpoint that allows unauthenticated attackers to obtain valid token pairs by submitting empty values for client_secret and code_verifier parameters. Attackers can exploit PHP truthy evaluation logic, which treats empty strings as false and skips client secret validation and PKCE code verifier validation, to exchange a valid authorization code for a token pair without proving client identity or holding the PKCE commitment.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://bombobombone.github.io/posts/cve-2026-73309/
|
||||
- https://www.vulncheck.com/advisories/xenforo-authentication-bypass-via-oauth2-token-endpoint
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2026-73310](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-73310)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
XenForo before 2.3.13 contains an authorization flaw in the OAuth2 token endpoint that allows attackers controlling any allowlisted redirect URI to bypass redirect URI binding by submitting a different allowlisted URI than the one recorded at authorization time. Attackers can exchange an intercepted authorization code using a mismatched redirect URI to steal OAuth2 tokens from intercepted authorization flows.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://bombobombone.github.io/posts/cve-2026-73310/
|
||||
- https://www.vulncheck.com/advisories/xenforo-oauth2-authorization-code-token-theft-via-redirect-uri-bypass
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2026-73311](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-73311)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
XenForo before 2.3.13 contains an OAuth2 authorization code reuse vulnerability that allows attackers to obtain unauthorized token pairs by submitting a previously used authorization code. Attackers can exploit the failure to invalidate or mark authorization codes as consumed after initial token issuance to receive an independent token pair for the same user and scopes, bypassing the single-use guarantee of the OAuth2 authorization code flow.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://bombobombone.github.io/posts/cve-2026-73311/
|
||||
- https://www.vulncheck.com/advisories/xenforo-oauth2-authorization-code-reuse
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2026-73312](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-73312)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
XenForo before 2.3.13 contains a refresh token replay vulnerability that allows attackers to reuse a refresh token multiple times by exploiting the failure to mark tokens as consumed when the parent access token has expired. Attackers can repeatedly submit the same refresh token to generate additional independent token pairs, achieving persistent unauthorized access for the token's full lifetime.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://bombobombone.github.io/posts/cve-2026-73312/
|
||||
- https://www.vulncheck.com/advisories/xenforo-refresh-token-replay-via-expired-access-token
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2026-73313](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-73313)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
XenForo before 2.3.13 contains a multi-factor authentication bypass vulnerability in the passkey TFA provider that allows an authenticated attacker to complete login as another user by submitting their own registered passkey credential during the WebAuthn assertion step. The passkey verification path performs a global credential lookup without validating that the matched credential belongs to the user whose login is pending, enabling an attacker who knows a target account's password to sign the challenge with their own passkey and bypass multi-factor authentication on both public forum and ACP login paths.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://bombobombone.github.io/posts/cve-2026-73313/
|
||||
- https://www.vulncheck.com/advisories/xenforo-mfa-bypass-via-passkey-tfa-provider
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2026-73314](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-73314)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
XenForo before 2.3.13 contains a signature verification logic error in the PayPal REST webhook handler that allows unauthenticated attackers to bypass payment signature validation by submitting a webhook request with an unsupported auth_algo header value. When the algorithm cannot be mapped to a supported hash function, the verification function incorrectly returns true instead of failing, causing the caller to treat the fabricated request as verified and process the payment event without a valid PayPal signature.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://bombobombone.github.io/posts/cve-2026-73314/
|
||||
- https://www.vulncheck.com/advisories/xenforo-signature-verification-bypass-via-paypal-rest-webhook
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2026-73315](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-73315)
|
||||
|
||||
|
||||
&color=brightgreen)
|
||||
|
||||
### Description
|
||||
|
||||
XenForo before 2.3.13 contains a server-side request forgery vulnerability in the PayPal REST webhook handler that allows unauthenticated attackers to cause the server to make outbound HTTP requests to arbitrary destinations by supplying a crafted certificate URL in webhook headers without scheme, hostname, or allowlist validation. Attackers can submit a crafted POST to the PayPal webhook callback endpoint to reach internal network resources including cloud instance metadata services, potentially disclosing IAM credentials or enabling secondary internal service exploitation.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://bombobombone.github.io/posts/cve-2026-73315/
|
||||
- https://www.vulncheck.com/advisories/xenforo-ssrf-via-paypal-rest-webhook-handler
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2026-73316](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-73316)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
XenForo before 2.3.13 contains a payment replay vulnerability in the PayPal REST payment provider that allows attackers to process the same webhook payload multiple times by exploiting a missing duplicate transaction ID check. Attackers can replay a valid webhook payload to trigger duplicate payment events, resulting in repeated subscription activations and unauthorized account upgrades.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://bombobombone.github.io/posts/cve-2026-73316/
|
||||
- https://www.vulncheck.com/advisories/xenforo-payment-replay-via-paypal-rest-payment-provider
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2026-73317](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-73317)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
XenForo before 2.3.13 contains a missing authorization vulnerability in the ACP cache-rebuild dispatcher that allows limited administrators with only the rebuildCache permission to perform unauthorized approval queue actions by supplying an arbitrary job class and actor user ID in the POST body. Attackers can invoke the approval queue job under any user identity to approve queued user registrations without holding the required approval-queue or moderator permissions, causing the moderation log to attribute actions to an impersonated account.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://bombobombone.github.io/posts/cve-2026-73317/
|
||||
- https://www.vulncheck.com/advisories/xenforo-missing-authorization-via-acp-cache-rebuild-dispatcher
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2026-73318](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-73318)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
XenForo before 2.3.13 contains a missing authorization vulnerability in the force-agreement controller that allows any ACP administrator to access and submit force-agreement forms regardless of their assigned permissions. Attackers can bypass the option permission declared in the navigation configuration to update the global policy last-updated timestamp, forcing all users to re-agree to the privacy policy or terms of service.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://bombobombone.github.io/posts/cve-2026-73318/
|
||||
- https://www.vulncheck.com/advisories/xenforo-missing-authorization-via-force-agreement-controller
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2026-73319](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-73319)
|
||||
|
||||
|
||||
&color=brightgreen)
|
||||
|
||||
### Description
|
||||
|
||||
XenForo before 2.3.13 contains a cross-site scripting vulnerability in the dynamic redirect handler that allows unauthenticated attackers to execute arbitrary JavaScript in the board origin by crafting a malicious javascript: URI that bypasses host validation. Attackers can embed the board hostname in the URI authority component and use percent-encoded newlines to evade server-side filters, causing authenticated users who perform a Follow action to execute attacker-supplied JavaScript in their browser.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://bombobombone.github.io/posts/cve-2026-73319/
|
||||
- https://www.vulncheck.com/advisories/xenforo-xss-via-dynamic-redirect-handler
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2026-73320](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-73320)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
XenForo before 2.3.13 contains an unauthenticated information disclosure vulnerability that allows unauthenticated attackers to retrieve private unfurl records by supplying predictable auto-increment primary key IDs to the unfurl endpoint. Attackers can enumerate or predict result IDs and query the endpoint without any session, user, or visibility checks to obtain rendered preview HTML, original URLs, and query strings from private conversations and other restricted content.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://bombobombone.github.io/posts/cve-2026-73320/
|
||||
- https://www.vulncheck.com/advisories/xenforo-unauthenticated-information-disclosure-via-unfurl-endpoint
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2026-73321](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-73321)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
XenForo before 2.3.13 contains an uncontrolled recursion vulnerability in the BBCode parser that allows authenticated attackers to cause persistent denial of service by submitting a post with deeply nested BBCode tags. Attackers can craft a single malicious post with sufficient nesting depth to exceed PHP's stack limit, causing fatal errors that repeatedly terminate PHP-FPM workers for all visitors rendering the affected thread.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://bombobombone.github.io/posts/cve-2026-73321/
|
||||
- https://www.vulncheck.com/advisories/xenforo-uncontrolled-recursion-dos-via-bbcode-parser
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2026-74239](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74239)
|
||||
|
||||
|
||||
&color=brightgreen)
|
||||
|
||||
### Description
|
||||
|
||||
XenForo before 2.3.13 contains a path traversal vulnerability in the style archive importer on Windows deployments that allows authenticated non-super administrators with style permissions to write arbitrary files outside the intended extraction directory by using backslash-based traversal sequences in ZIP member names. Attackers can craft a malicious ZIP archive with backslash path separators that bypass forward-slash validation to write arbitrary bytes to any web-server-writable path, including the public web root, achieving persistent code execution as the web-server account.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://bombobombone.github.io/posts/cve-2026-74239/
|
||||
- https://www.vulncheck.com/advisories/xenforo-path-traversal-via-style-archive-importer-on-windows
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-75861](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-75861)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The Ultimate Gift Cards for WooCommerce WordPress plugin before 3.2.10 does not verify that the user redeeming a gift card is its intended recipient, allowing any authenticated user, such as a subscriber, to redeem gift cards belonging to other users, zeroing their balance and crediting the value to themselves.In 3.2.9 an ownership check was added on one of the two affected redemption paths; the one that remains requires a companion Ultimate Gift Cards for WooCommerce WordPress plugin before 3.2.10 from the same vendor to be active.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/a08125a6-e528-49f1-82c4-191df80af26c/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-78738](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78738)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
Silverpeas Core 6.4.6 is vulnerable to Cross Site Scripting (XSS) via the Document management file upload feature.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://hekk.one/posts/research/cve-2026-78738/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-78741](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78741)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
Silverpeas Core <=6.4.6 is vulnerable to Cross Site Scripting (XSS) in the wysiwyg-CKEditor image upload feature.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://hekk.one/posts/research/cve-2026-78741/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-78742](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78742)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
Silverpeas Core <=6.4.6 is vulnerable to Cross Site Scripting (XSS) via the Multimedia library application introduction.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://hekk.one/posts/research/cve-2026-78742/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-79721](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-79721)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
Code execution can occur in versions of the MLflow platform running version 0.0.1 or newer, enabling a maliciously crafted model artifact to execute arbitrary code on an end user's system when loaded by the project.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://www.hiddenlayer.com/sai-security-advisory/2026-09-mlflow
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
Loaded 100 of 124 files, more files were not shown because too many files have changed in this diff.
Show more
Reference in new issue
Block a user