mirror of
https://github.com/trickest/cve.git
synced 2026-11-07 04:29:23 -10:00
Update Sat Oct 3 12:33:01 UTC 2026
This commit is contained in:
trickest-workflows committed
1 parent
0a11ab945b
commit
de57b3a5c1
188 files changed
+3023
-12
No files matched your search
@@ -0,0 +1,17 @@
|
||||
### [CVE-2004-0906](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0906)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The XPInstall installer in Mozilla Firefox before the Preview Release, Mozilla before 1.7.3, and Thunderbird before 0.8 sets insecure permissions for certain installed files within xpi packages, which could allow local users to overwrite arbitrary files or execute arbitrary code.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- http://www.redhat.com/support/errata/RHSA-2005-323.html
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2004-1380](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-1380)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
Firefox before 1.0 and Mozilla before 1.7.5 allows inactive (background) tabs to launch dialog boxes, which can allow remote attackers to spoof the dialog boxes from web sites in other windows and facilitate phishing attacks, aka the "Dialog Box Spoofing Vulnerability."
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- http://www.redhat.com/support/errata/RHSA-2005-323.html
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2004-1613](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-1613)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
Mozilla allows remote attackers to cause a denial of service (application crash from null dereference or infinite loop) via a web page that contains a (1) TEXTAREA, (2) INPUT, (3) FRAMESET or (4) IMG tag followed by a null character and some trailing characters, as demonstrated by mangleme.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- http://www.redhat.com/support/errata/RHSA-2005-323.html
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2005-0141](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-0141)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
Firefox before 1.0 and Mozilla before 1.7.5 allow remote attackers to load local files via links "with a custom getter and toString method" that are middle-clicked by the user to be opened in a new tab.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- http://www.redhat.com/support/errata/RHSA-2005-323.html
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2005-0144](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-0144)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
Firefox before 1.0 and Mozilla before 1.7.5 display the secure site lock icon when a view-source: URL references a secure SSL site while an insecure page is being loaded, which could facilitate phishing attacks.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- http://www.redhat.com/support/errata/RHSA-2005-323.html
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -10,6 +10,7 @@ Firefox before 1.0 and Mozilla before 1.7.5, when configured to use a proxy, res
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- http://www.redhat.com/support/errata/RHSA-2005-323.html
|
||||
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9578
|
||||
|
||||
#### Github
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2005-0149](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-0149)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
Thunderbird 0.6 through 0.9 and Mozilla 1.7 through 1.7.3 does not obey the network.cookie.disableCookieForMailNews preference, which could allow remote attackers to bypass the user's intended privacy and security policy by using cookies in e-mail messages.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- http://www.redhat.com/support/errata/RHSA-2005-323.html
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -11,6 +11,7 @@ Firefox 1.0 allows remote attackers to modify Boolean configuration parameters f
|
||||
|
||||
#### Reference
|
||||
- http://marc.info/?l=bugtraq&m=110781055630856&w=2
|
||||
- http://www.redhat.com/support/errata/RHSA-2005-323.html
|
||||
- http://www.redhat.com/support/errata/RHSA-2005-384.html
|
||||
|
||||
#### Github
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2005-0399](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-0399)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
Heap-based buffer overflow in GIF2.cpp in Firefox before 1.0.2, Mozilla before to 1.7.6, and Thunderbird before 1.0.2, and possibly other applications that use the same library, allows remote attackers to execute arbitrary code via a GIF image with a crafted Netscape extension 2 block and buffer size.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- http://www.redhat.com/support/errata/RHSA-2005-323.html
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -11,6 +11,7 @@ Cross-site scripting (XSS) vulnerability in index.php in QwikiWiki 1.4 allows re
|
||||
|
||||
#### Reference
|
||||
- http://securityreason.com/securityalert/510
|
||||
- http://sourceforge.net/forum/forum.php?forum_id=438526
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -11,6 +11,7 @@ The http-index-format MIME type parser (nsDirIndexParser) in Firefox 3.x before
|
||||
|
||||
#### Reference
|
||||
- http://www.redhat.com/support/errata/RHSA-2008-0977.html
|
||||
- http://www.redhat.com/support/errata/RHSA-2008-0978.html
|
||||
- http://www.vupen.com/english/advisories/2009/0977
|
||||
- https://bugzilla.mozilla.org/show_bug.cgi?id=443299
|
||||
|
||||
|
||||
@@ -11,6 +11,7 @@ jslock.cpp in Mozilla Firefox 3.x before 3.0.2, Firefox 2.x before 2.0.0.18, Thu
|
||||
|
||||
#### Reference
|
||||
- http://www.redhat.com/support/errata/RHSA-2008-0977.html
|
||||
- http://www.redhat.com/support/errata/RHSA-2008-0978.html
|
||||
- http://www.vupen.com/english/advisories/2009/0977
|
||||
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9157
|
||||
|
||||
|
||||
@@ -10,6 +10,7 @@ Mozilla Firefox 3.x before 3.0.4 assigns chrome privileges to a file: URI when i
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- http://www.redhat.com/support/errata/RHSA-2008-0978.html
|
||||
- http://www.vupen.com/english/advisories/2009/0977
|
||||
|
||||
#### Github
|
||||
|
||||
@@ -11,6 +11,7 @@ The layout engine in Mozilla Firefox 3.x before 3.0.4, Thunderbird 2.x before 2.
|
||||
|
||||
#### Reference
|
||||
- http://www.redhat.com/support/errata/RHSA-2008-0977.html
|
||||
- http://www.redhat.com/support/errata/RHSA-2008-0978.html
|
||||
- http://www.vupen.com/english/advisories/2009/0977
|
||||
|
||||
#### Github
|
||||
|
||||
@@ -11,6 +11,7 @@ Integer overflow in xpcom/io/nsEscape.cpp in the browser engine in Mozilla Firef
|
||||
|
||||
#### Reference
|
||||
- http://www.redhat.com/support/errata/RHSA-2008-0977.html
|
||||
- http://www.redhat.com/support/errata/RHSA-2008-0978.html
|
||||
- http://www.vupen.com/english/advisories/2009/0977
|
||||
|
||||
#### Github
|
||||
|
||||
@@ -11,6 +11,7 @@ The JavaScript engine in Mozilla Firefox 3.x before 3.0.4, Firefox 2.x before 2.
|
||||
|
||||
#### Reference
|
||||
- http://www.redhat.com/support/errata/RHSA-2008-0977.html
|
||||
- http://www.redhat.com/support/errata/RHSA-2008-0978.html
|
||||
- http://www.vupen.com/english/advisories/2009/0977
|
||||
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9872
|
||||
|
||||
|
||||
@@ -11,6 +11,7 @@ The session restore feature in Mozilla Firefox 3.x before 3.0.4 and 2.x before 2
|
||||
|
||||
#### Reference
|
||||
- http://www.redhat.com/support/errata/RHSA-2008-0977.html
|
||||
- http://www.redhat.com/support/errata/RHSA-2008-0978.html
|
||||
- http://www.vupen.com/english/advisories/2009/0977
|
||||
|
||||
#### Github
|
||||
|
||||
@@ -11,6 +11,7 @@ nsFrameManager in Firefox 3.x before 3.0.4, Firefox 2.x before 2.0.0.18, Thunder
|
||||
|
||||
#### Reference
|
||||
- http://www.redhat.com/support/errata/RHSA-2008-0977.html
|
||||
- http://www.redhat.com/support/errata/RHSA-2008-0978.html
|
||||
- http://www.vupen.com/english/advisories/2009/0977
|
||||
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9642
|
||||
|
||||
|
||||
@@ -11,6 +11,7 @@ The nsXMLHttpRequest::NotifyEventListeners method in Firefox 3.x before 3.0.4, F
|
||||
|
||||
#### Reference
|
||||
- http://www.redhat.com/support/errata/RHSA-2008-0977.html
|
||||
- http://www.redhat.com/support/errata/RHSA-2008-0978.html
|
||||
- http://www.vupen.com/english/advisories/2009/0977
|
||||
|
||||
#### Github
|
||||
|
||||
@@ -11,6 +11,7 @@ Firefox 3.x before 3.0.4, Firefox 2.x before 2.0.0.18, and SeaMonkey 1.x before
|
||||
|
||||
#### Reference
|
||||
- http://www.redhat.com/support/errata/RHSA-2008-0977.html
|
||||
- http://www.redhat.com/support/errata/RHSA-2008-0978.html
|
||||
- http://www.vupen.com/english/advisories/2009/0977
|
||||
- https://bugzilla.mozilla.org/show_bug.cgi?id=424733
|
||||
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9908
|
||||
|
||||
@@ -11,6 +11,7 @@ Mozilla Firefox 3.x before 3.0.4, Firefox 2.x before 2.0.0.18, Thunderbird 2.x b
|
||||
|
||||
#### Reference
|
||||
- http://www.redhat.com/support/errata/RHSA-2008-0977.html
|
||||
- http://www.redhat.com/support/errata/RHSA-2008-0978.html
|
||||
- http://www.vupen.com/english/advisories/2009/0977
|
||||
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9063
|
||||
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2014-125130](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-125130)
|
||||
|
||||
|
||||
&color=brightgreen)
|
||||
|
||||
### Description
|
||||
|
||||
CodeArt Google MP3 Audio Player plugin (google-mp3-audio-player) for WordPress through 1.0.11 contains an unauthenticated arbitrary file read vulnerability that allows remote attackers to retrieve sensitive files by supplying a path-traversal payload in the file parameter of direct_download.php. Attackers can request paths ../../wp-config.php without authentication to download configuration files containing database credentials and secret keys, leading to full site compromise. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-19.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://www.exploit-db.com/exploits/35460
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -12,6 +12,7 @@ NETGEAR JNR1010 devices before 1.0.0.32 have Incorrect Access Control because th
|
||||
#### Reference
|
||||
- https://cybersecurityworks.com/zerodays/cve-2016-11014-netgear.html
|
||||
- https://github.com/cybersecurityworks/Disclosed/issues/14
|
||||
- https://khalil-shreateh.com/khalil.shtml/it-highlights/593-Netgear-1.0.0.24-Bypass---Improper-Session-Management--.html
|
||||
- https://lists.openwall.net/full-disclosure/2016/01/11/5
|
||||
- https://packetstormsecurity.com/files/135216/Netgear-1.0.0.24-Bypass-Improper-Session-Management.html
|
||||
|
||||
|
||||
@@ -12,6 +12,7 @@ NETGEAR JNR1010 devices before 1.0.0.32 allow webproc?getpage= XSS.
|
||||
#### Reference
|
||||
- https://cybersecurityworks.com/zerodays/cve-2016-11016-netgear.html
|
||||
- https://github.com/cybersecurityworks/Disclosed/issues/12
|
||||
- https://khalil-shreateh.com/khalil.shtml/it-highlights/592-Netgear-1.0.0.24-Cross-Site-Request-Forgery--.html
|
||||
- https://lists.openwall.net/full-disclosure/2016/01/11/1
|
||||
- https://packetstormsecurity.com/files/135194/Netgear-1.0.0.24-Cross-Site-Scripting.html
|
||||
|
||||
|
||||
@@ -12,6 +12,7 @@ The SeedProd coming-soon plugin before 5.1.1 for WordPress allows XSS.
|
||||
#### Reference
|
||||
- http://packetstormsecurity.com/files/158649/WordPress-Maintenance-Mode-By-SeedProd-5.1.1-Cross-Site-Scripting.html
|
||||
- https://wpvulndb.com/vulnerabilities/10283
|
||||
- https://www.getastra.com/blog/911/plugin-exploit/stored-xss-coming-soon-page-maintenance-mode-plugin/
|
||||
|
||||
#### Github
|
||||
- https://github.com/20142995/nuclei-templates
|
||||
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2023-32764](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-32764)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
Fabasoft Cloud Enterprise Client 23.3.0.130 allows a user to escalate their privileges to local administrator.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://www.compass-security.com/fileadmin/Research/Advisories/2023_01_CSNC-2023-002_LPE_Cloud_Client.txt
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -10,6 +10,7 @@ Fumasoft Fumeng Cloud contains a SQL injection vulnerability in the AjaxMethod.a
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/emadshanab/goby-poc/blob/main/fumengyun%20%20AjaxMethod.ashx%20SQL%20injection.json
|
||||
- https://www.vulncheck.com/advisories/fumeng-cloud-sql-injection-via-ajaxmethod-ashx-getempbyname
|
||||
|
||||
#### Github
|
||||
|
||||
@@ -5,7 +5,7 @@
|
||||
|
||||
### Description
|
||||
|
||||
Missing Authorization vulnerability in Dimitri Grassi Salon booking system salon-booking-system allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Salon booking system: from n/a through <= 10.30.23.
|
||||
Missing Authorization vulnerability in Dimitri Grassi Salon booking system salon-booking-system allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Salon booking system: from n/a through 10.31.8.
|
||||
|
||||
### POC
|
||||
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2025-70225](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-70225)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via the curtime parameter to the goform/formEasySetupWWConfig component
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/akuma-QAQ/CVEreport/tree/main/D-link/CVE-2025-70225
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2025-70229](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-70229)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via the curTime parameter to goform/formSchedule.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/akuma-QAQ/CVEreport/tree/main/D-link/CVE-2025-70229
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2025-70616](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-70616)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A stack buffer overflow vulnerability exists in the Wincor Nixdorf wnBios64.sys kernel driver (version 1.2.0.0) in the IOCTL handler for code 0x80102058. The vulnerability is caused by missing bounds checking on the user-controlled Options parameter before copying data into a 40-byte stack buffer (Src[40]) using memmove. An attacker with local access can exploit this vulnerability by sending a crafted IOCTL request with Options > 40, causing a stack buffer overflow that may lead to kernel code execution, local privilege escalation, or denial of service (system crash). Additionally, the same IOCTL handler can leak kernel addresses and other sensitive stack data when reading beyond the buffer boundaries.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/250wuyifan/wnBios64-CVE
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-101159](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-101159)
|
||||
|
||||
|
||||
&color=brightgreen)
|
||||
|
||||
### Description
|
||||
|
||||
The WP Ultimate Review WordPress plugin before 2.4.4 does not properly sanitise and escape reviews submitted through its public review form, which is available to unauthenticated visitors, allowing them to perform Stored Cross-Site Scripting attacks against any user, including administrators, viewing a page displaying the review, when user reviews are enabled.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/1eefa81e-6134-498b-9615-b9a42cd99749/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-101160](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-101160)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The WP Ultimate Review WordPress plugin before 2.4.4 does not validate that a submitted review rating is numeric before storing it and later using it in numeric operations when rendering reviews, allowing unauthenticated users to make the reviewed content fail with a fatal error for all visitors until the review is removed (a persistent denial of service), when user reviews are enabled.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/d728523f-1f33-470f-b64f-e9e286d29b6b/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-101161](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-101161)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The WP Ultimate Review WordPress plugin before 2.4.4 does not prevent unauthenticated users from storing crafted review content that makes the reviewed page fail with a fatal error on every subsequent visit, resulting in a persistent denial of service when the WP Ultimate Review WordPress plugin before 2.4.4's review display settings have never been saved.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/c1c3e2d7-4833-4e51-a3c7-45e6d036a525/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-101162](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-101162)
|
||||
|
||||
|
||||
&color=brightgreen)
|
||||
|
||||
### Description
|
||||
|
||||
The WP Ultimate Review WordPress plugin before 2.4.4 does not escape some of its review overview settings before outputting them in posts, which could allow users with a role as low as author to perform Stored Cross-Site Scripting attacks, when author reviews are enabled.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/b7a66222-4e30-4d70-9e2f-b91d421d285f/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-102626](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-102626)
|
||||
|
||||
|
||||
&color=brightgreen)
|
||||
|
||||
### Description
|
||||
|
||||
An authenticated LimeSurvey Community Edition 7.4.0 user with the global Surveys: create permission can store a JavaScript-breaking value in the date_min attribute of a Date/Time question. When another user renders the affected question, LimeSurvey inserts the stored value into a single-quoted inline JavaScript literal without JavaScript-context encoding.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://fluidattacks.com/advisories/golden
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-103001](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-103001)
|
||||
|
||||
|
||||
&color=brightgreen)
|
||||
|
||||
### Description
|
||||
|
||||
PyJWT is a Python implementation of JSON Web Token standards. From 2.11.0 through 2.13.0, PyJWT's PyJWT._merge_options() method can modify a caller-supplied mutable options mapping when verify_signature is false. If an application reuses that same mapping for a later decode() or decode_complete() call and changes verify_signature to true, the mapping can retain false values for expiration, not-before, issued-at, audience, issuer, subject, and JWT ID checks. A signed token with invalid registered claims can then be accepted without disabling signature verification, but applications that create a fresh options mapping for each call are not affected.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/jpadilla/pyjwt/security/advisories/GHSA-gvp8-978c-rx2q
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-103040](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-103040)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
LightLLM through 1.2.0 contains a remote code execution vulnerability in the router profiler service when started with --enable_profiling flag. The service exposes an unauthenticated RPyC server with pickle deserialization enabled, allowing attackers to execute arbitrary code by sending crafted serialized objects to the profiler command queue.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/ModelTC/LightLLM/issues/1597
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-103042](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-103042)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
LightLLM through 1.2.0 contains a memory exhaustion vulnerability in the NCCL control channel when started with --pd_trans_mode nccl, allowing unauthenticated attackers to exhaust KV-transfer worker memory. Attackers can call the exposed_set_value method to store unbounded key-value pairs without size limits, causing the worker process to crash and triggering node failure.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/ModelTC/LightLLM/issues/1595
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-103043](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-103043)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
anchorme through 3.0.8 contains a regular expression denial of service vulnerability in the IPv6 host extraction regex due to catastrophic backtracking. Attackers can supply specially crafted input strings with repeated patterns to cause exponential regex engine backtracking, blocking the Node.js event loop and denying service to other requests.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://gist.github.com/mmadersbacher/46050b4224eb979431986cdef1dd2ad3
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2026-103053](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-103053)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
AiSOC versions 9.0.0 before 12.0.0 fail to enforce authentication on the response-action API endpoints when AISOC_DEV_MODE is enabled and AISOC_ACTIONS_SERVICE_TOKEN is empty in the default Docker Compose deployment. Unauthenticated attackers can list response-action integrations, submit and approve actions on behalf of arbitrary principals, and dispatch containment actions using vendor credentials.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/beenuar/AiSOC/commit/dac39723404130312daba15d42d19114f09f75b2
|
||||
- https://github.com/beenuar/AiSOC/security/advisories/GHSA-g4h7-p63q-r8r4
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-103054](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-103054)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
AiSOC versions before 12.0.0 contain an authorization bypass vulnerability in the MSSP module that allows authenticated users to add arbitrary tenants to portfolios they own. Attackers can submit tenant UUIDs via the add_tenants_to_portfolio endpoint to claim unclaimed tenants and read their security alerts, incidents, and posture metrics without consent.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/beenuar/AiSOC/security/advisories/GHSA-mcg9-8pxf-j98v
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-103055](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-103055)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
AiSOC versions 7.5.0 before 12.0.0 use a hard-coded constant for JWT verification in the realtime WebSocket and SSE service when the AISOC_REALTIME_JWT_SECRET environment variable is not set. Unauthenticated attackers can forge subscription tickets with arbitrary tenant identifiers to access cross-tenant live alerts, cases, agent events and graph updates through the realtime endpoints.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/beenuar/AiSOC/security/advisories/GHSA-4m55-xhcm-wjcr
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2026-103056](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-103056)
|
||||
|
||||
|
||||
&color=brightgreen)
|
||||
|
||||
### Description
|
||||
|
||||
AiSOC versions 7.2.0 before 12.0.0 contain a command injection vulnerability in the actions service that builds CrowdStrike Real Time Response command strings by interpolating unescaped action parameters in crowdstrike_rtr.py and endpoint.py. Authenticated users can inject single quotes into file_path, path, script_name, or script_args parameters to break out of quoted arguments and execute arbitrary commands on managed endpoints with SYSTEM or root privileges.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/beenuar/AiSOC/commit/dac39723404130312daba15d42d19114f09f75b2
|
||||
- https://github.com/beenuar/AiSOC/security/advisories/GHSA-7q37-2wfw-xrx7
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-103057](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-103057)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
AiSOC versions 5.1.0 before 12.0.0 contain an authentication bypass vulnerability in the realtime service internal endpoints POST /internal/agent-event and POST /internal/push. Attackers can post arbitrary events with spoofed tenant identifiers to broadcast malicious content over WebSocket and Redis SSE channels or send unauthorized notifications to registered devices.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/beenuar/AiSOC/security/advisories/GHSA-mqjp-pcpr-7c37
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-103087](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-103087)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
Uncontrolled recursion in the Gosub browser engine (gosub-engine) through 0.1.0 and main before commit 46868b3 allows a remote attacker to cause a Denial of Service (stack exhaustion and application crash) via an SVG document containing an excessive number of deeply nested elements. Because the engine does not limit the nesting depth of processed SVG nodes, rendering such a document overflows the thread stack and terminates the application. The malicious SVG can be embedded through the SRC attribute of an IMG element, and thus exploitation only requires the victim to visit an attacker-controlled web page.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/gosub-io/gosub-engine/security/advisories/GHSA-c762-mxfh-vwvp
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-103111](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-103111)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
PCRE2 before 10.49, when there is an attacker-controlled regular expression and certain JIT API usage, allows an out-of-bounds write with arbitrary data.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-r9hj-j2rw-4q3m
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,21 @@
|
||||
### [CVE-2026-103113](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-103113)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A vulnerability was determined in OS4ED openSIS-Classic up to 9.3. The affected element is the function save action of the file modules/students/Student.php of the component General Information Tab. Executing a manipulation of the argument students can lead to sql injection. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/OS4ED/openSIS-Classic/issues/473
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,21 @@
|
||||
### [CVE-2026-103114](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-103114)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A vulnerability was identified in OS4ED openSIS-Classic up to 9.3. The impacted element is the function DBQuery_assignment of the file modules/grades/Assignments.php of the component Assignment Management Endpoint. The manipulation of the argument Tables leads to sql injection. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/OS4ED/openSIS-Classic/issues/474
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,21 @@
|
||||
### [CVE-2026-103115](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-103115)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A security flaw has been discovered in OS4ED openSIS-Classic up to 9.3. This affects an unknown function of the file functions/CustomFieldsFnc.php of the component Student Search. The manipulation of the argument cust results in sql injection. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/OS4ED/openSIS-Classic/issues/475
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,21 @@
|
||||
### [CVE-2026-103116](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-103116)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A weakness has been identified in OS4ED openSIS-Classic up to 9.3. This impacts the function DBQuery of the file functions/GetStuListFnc.php of the component Student List Search Endpoint. This manipulation of the argument LO_sort causes sql injection. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/OS4ED/openSIS-Classic/issues/476
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,21 @@
|
||||
### [CVE-2026-103117](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-103117)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A security vulnerability has been detected in OS4ED openSIS-Classic up to 9.3. Affected is the function db_properties of the file functions/DatabaseInc.php of the component Save Data Handler. Such manipulation of the argument values leads to sql injection. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/OS4ED/openSIS-Classic/issues/477
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,21 @@
|
||||
### [CVE-2026-103222](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-103222)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A vulnerability was determined in Blosc C-Blosc2 up to 3.3.2. This impacts the function blosclz_decompress of the file blosc/blosclz.c of the component blosclz Decompression. Executing a manipulation can lead to integer overflow. The attack may be launched remotely. A high complexity level is associated with this attack. The exploitability is said to be difficult. Upgrading to version 3.3.3 will fix this issue. This patch is called fe2964d114d97847f56570a0ab2be2c57ccbeedc. The affected component should be upgraded.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/Blosc/c-blosc2/commit/fe2964d114d97847f56570a0ab2be2c57ccbeedc
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,43 @@
|
||||
### [CVE-2026-103241](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-103241)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A flaw has been found in vllm-project vLLM up to 0.26.0. This vulnerability affects unknown code of the file rust/src/parser/src/unified/gemma4.rs of the component Gemma4UnifiedParser. Executing a manipulation can lead to denial of service. The attack may be launched remotely. The exploit has been published and may be used. Upgrading to version 0.29.1rc0 is able to resolve this issue. This patch is called 3439bad37e68ba9755a46f4f6b44a4aeaf1f60a9. Upgrading the affected component is advised.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://gist.github.com/Yunzez/8e98d656aa667095b513161eb056d28e
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-103243](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-103243)
|
||||
|
||||
|
||||
&color=brightgreen)
|
||||
|
||||
### Description
|
||||
|
||||
LightLLM through 1.2.0 fails to validate image_url and audio_url parameters in multimodal endpoints, allowing unauthenticated attackers to perform server-side request forgery. Attackers can supply arbitrary URLs to fetch internal resources, with vision model processing disclosing content or error responses revealing internal network topology.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/ModelTC/LightLLM/issues/1608
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-103244](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-103244)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
ground-station versions before 0.8.0 contain an authentication bypass vulnerability in the setup.restore command that allows unauthenticated attackers to execute arbitrary SQL during first-run setup mode. Attackers can invoke setup.restore via Socket.IO to plant admin users and forged session tokens, then authenticate as administrator without credentials for complete application takeover.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/sgoudelis/ground-station/security/advisories/GHSA-3mqj-q84c-crjq
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2026-103263](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-103263)
|
||||
|
||||
|
||||
|
||||
&color=brightgreen)
|
||||
|
||||
### Description
|
||||
|
||||
Tornado before 6.5.9 contains a path traversal vulnerability in StaticFileHandler that follows symbolic links inside the static root without confirming the resolved target stays within it. When a symlink pointing outside the static directory exists inside it, unauthenticated attackers can request it to read files such as configuration files, private keys, and application secrets accessible to the process user.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/tornadoweb/tornado/security/advisories/GHSA-c2m8-h5v5-343r
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-103293](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-103293)
|
||||
|
||||
|
||||
&color=brightgreen)
|
||||
|
||||
### Description
|
||||
|
||||
The MPG WordPress plugin before 4.2.3 does not validate that the dataset source supplied when importing a project is a remote URL before treating it as a local filesystem path and copying that file into a publicly accessible uploads folder. This makes it possible for users with the Editor role and above to read the contents of arbitrary files on the server, with the copied file then retrievable by unauthenticated visitors.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/810447c9-4a8b-4d80-af7c-2f5fa8b13609/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-103395](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-103395)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
LightLLM through 1.2.0 visual_only deployments expose an unauthenticated RPyC service with allow_pickle enabled that deserializes attacker-supplied arguments in the remote_infer_images method. Attackers can reach the visual RPyC port and pass objects with __reduce__ methods to execute arbitrary code with service account privileges.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/ModelTC/LightLLM/issues/1610
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-103396](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-103396)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
bbs-go through 4.4.6 contains a permission bypass vulnerability in the AdminMiddleware authorization logic where the read-only dashboard.user.view permission rule matches the /api/admin/user/synccount endpoint before the intended dashboard.user.update rule. Authenticated users with only view permissions can call the synccount endpoint to trigger expensive full-table user recounts and cache invalidations, causing denial of service through repeated concurrent database operations.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/mlogclub/bbs-go/issues/303
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-103471](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-103471)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
restbed through 5.0.0 buffers HTTP request headers without enforcing a maximum size limit, allowing remote unauthenticated attackers to exhaust server memory. Attackers can open TCP connections and stream bytes indefinitely without sending the header delimiter, forcing the server to allocate unbounded heap memory until the process is killed.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/Corvusoft/restbed/issues/558
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-103472](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-103472)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
restbed through 5.0.0 accepts WebSocket frames with declared payload lengths up to 2^63 bytes and buffers the payload without size limits in an unbounded stream buffer. Remote unauthenticated attackers can declare large frame sizes and stream payload data to exhaust server memory, causing denial of service through process crash.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/Corvusoft/restbed/issues/558
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-103514](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-103514)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The WP 2FA WordPress plugin before 4.1.0 does not invalidate a time-based one-time passcode once it has been used, allowing an attacker who knows an account's password and has observed a valid code within its validity window to replay it and bypass two-factor authentication, including on administrator accounts.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/e05aa5a3-cd04-428a-b6bb-0538ca1f6b4a/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,23 @@
|
||||
### [CVE-2026-103532](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-103532)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A vulnerability has been found in immich-app Immich up to 2.7.5. This affects the function checkSharedLinkAccess of the file server/src/utils/access.ts of the component Shared Link Preview Handler. The manipulation of the argument Password leads to improper authorization. The attack may be initiated remotely. The reported GitHub issue was closed with the label "duplicate".
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/immich-app/immich/issues/29599
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,19 @@
|
||||
### [CVE-2026-103533](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-103533)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A vulnerability was found in David-Crty databasement up to 1.7.1. This impacts the function https:/github.com/David-Crty/databasement/pull/511 of the file app/Http/Requests/Api/V1/RestoreRequest.php of the component database-servers API Endpoint. The manipulation of the argument schema_name results in path traversal. The attack may be launched remotely. A high complexity level is associated with this attack. The exploitability is said to be difficult. The exploit has been made public and could be used. Upgrading to version 1.7.2 will fix this issue. You should upgrade the affected component.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/David-Crty/databasement/security/advisories/GHSA-x225-463f-pgww
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,20 @@
|
||||
### [CVE-2026-103534](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-103534)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A vulnerability was determined in David-Crty databasement up to 1.7.1. Affected is the function SnapshotPolicy.viewAny/SnapshotPolicy.view of the file /api/v1/snapshots of the component Snapshot Model. This manipulation causes improper access controls. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. Upgrading to version 1.7.2 is able to address this issue. The affected component should be upgraded.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/David-Crty/databasement/security/advisories/GHSA-vx6q-v2gv-5fhv
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2026-103536](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-103536)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A vulnerability was identified in ZongXR Supermarket 1.0.0.0. Affected by this vulnerability is the function OrderController.addOrder of the file order/src/main/java/com/supermarket/order/controller/OrderController.java of the component save Endpoint. Such manipulation of the argument userId leads to missing authentication. The attack can be executed remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/ZongXR/SuperMarket/issues/32
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2026-103538](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-103538)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A security flaw has been discovered in ZongXR SuperMarket 1.0.0.0. Affected by this issue is the function OrderController.deleteOrder of the file order/src/main/java/com/supermarket/order/controller/OrderController.java of the component Order Deletion Endpoint. Performing a manipulation of the argument orderId results in missing authentication. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/ZongXR/SuperMarket/issues/31
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2026-103539](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-103539)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A weakness has been identified in ZongXR SuperMarket 1.0.0.0. This affects the function startBuy of the file instant-buy/src/main/java/com/supermarket/instantbuy/controller/InstantBuyController.java of the component Instant Buy. Executing a manipulation of the argument Username can lead to missing authentication. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/ZongXR/SuperMarket/issues/30
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,20 @@
|
||||
### [CVE-2026-103540](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-103540)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A security vulnerability has been detected in formtools.org Form Tools up to 3.1.1. This vulnerability affects the function Clients::updateClientSettingsTab of the file global/code/Clients.class.php of the component Client Settings. The manipulation of the argument page_titles leads to improper neutralization of special elements used in a template engine. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/formtools/core/issues/956
|
||||
- https://github.com/wawyw/cve_report/blob/main/formtools_1.md
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,20 @@
|
||||
### [CVE-2026-103541](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-103541)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A vulnerability was detected in formtools.org Form Tools up to 3.1.1. This issue affects the function Files::uploadFile of the file global/code/actions.php of the component Ajax Handler. The manipulation results in unrestricted upload. It is possible to launch the attack remotely. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/formtools/core/issues/957
|
||||
- https://github.com/wawyw/cve_report/blob/main/formtools_2.md
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,19 @@
|
||||
### [CVE-2026-103542](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-103542)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A flaw has been found in formtools.org Form Tools up to 3.1.1. Impacted is the function smart_fill of the file /global/code/actions.php of the component AJAX Endpoint. This manipulation of the argument url causes server-side request forgery. The attack can be initiated remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/formtools/core/issues/958
|
||||
- https://github.com/wawyw/cve_report/blob/main/formtools_3.md
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2026-103543](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-103543)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A vulnerability has been found in itsourcecode Leave Management System 1.0. The affected element is an unknown function of the file /module/leavetype/controller.php. Such manipulation of the argument LEAVTID leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/ltranquility/submit_repository/issues/17
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,19 @@
|
||||
### [CVE-2026-103544](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-103544)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A vulnerability was found in datadrivenconstruction OpenConstructionERP up to 14.8.1. The impacted element is an unknown function of the file backend/app/modules/ai/ai_client.py of the component Al Provider Configuration Handler. Performing a manipulation results in exposure of data element to wrong session. The attack may be initiated remotely. The exploit has been made public and could be used. Upgrading to version 15.0.0 is sufficient to resolve this issue. It is suggested to upgrade the affected component.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/datadrivenconstruction/OpenConstructionERP/security/advisories/GHSA-wfpw-cv5v-64j5
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-103648](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-103648)
|
||||
|
||||
|
||||
&color=brightgreen)
|
||||
|
||||
### Description
|
||||
|
||||
Path traversal in image-downloader 4.3.0 allows an attacker who can control the download URL to cause downloaded response data to be written outside the configured destination directory.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://gitlab.com/demsking/image-downloader/-/work_items/32
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,34 @@
|
||||
### [CVE-2026-103686](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-103686)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A flaw has been found in rhukster dom-sanitizer up to 1.0.15. Impacted is the function DOMSanitizer::isDangerousUrl of the file src/DOMSanitizer.php of the component URL Validation. This manipulation causes cross site scripting. It is possible to initiate the attack remotely. The exploit has been published and may be used. Upgrading to version 1.0.16 is recommended to address this issue. Patch name: 4623b565d060bc02ca5a07d8c8241fe28e2edfda. It is suggested to upgrade the affected component.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/rhukster/dom-sanitizer/security/advisories/GHSA-mrpv-6x26-mf6c
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,34 @@
|
||||
### [CVE-2026-103687](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-103687)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A vulnerability has been found in rhukster dom-sanitizer up to 1.0.15. The affected element is the function url of the file src/DOMSanitizer.php of the component SVG Sanitization. Such manipulation leads to incomplete blacklist. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.0.16 is sufficient to fix this issue. The name of the patch is 139c46c3d7c9bc81542b7b5a58d5cde5d0e0195a. Upgrading the affected component is recommended.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/rhukster/dom-sanitizer/security/advisories/GHSA-cjfg-j8jp-5xvc
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2026-103690](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-103690)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A flaw has been found in itsourcecode Leave Management System 1.0. This vulnerability affects unknown code of the file /module/leave/controller.php. Executing a manipulation of the argument LEAVEID can lead to sql injection. The attack may be performed from remote. The exploit has been published and may be used.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/ltranquility/submit_repository/issues/18
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2026-103757](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-103757)
|
||||
|
||||
|
||||
|
||||
&color=brightgreen)
|
||||
|
||||
### Description
|
||||
|
||||
Budibase through 3.41.0 contains a server-side request forgery vulnerability in AI table generation because the uploadUrl function in packages/server/src/utilities/fileUtils.ts uses raw node-fetch instead of fetchWithBlacklist. Authenticated builder users can send a prompt to POST /api/ai/tables that places an internal URL in an attachment column, causing the server to fetch it and return a presigned object-storage URL containing the response, such as cloud metadata credentials.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/Budibase/budibase/security/advisories/GHSA-3c52-v5v2-3r56
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-103761](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-103761)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
Mooncake transfer engine through 0.3.13.post1 contains a memory exhaustion vulnerability in TransferMetadata::receivePeerNotify that allows unauthenticated attackers to grow process memory without limit. Attackers can repeatedly send notify frames up to 1 MB to the handshake RPC port, filling the uncapped notifys vector until the out-of-memory killer terminates the engine.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/kvcache-ai/Mooncake/issues/4445
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2026-103762](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-103762)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
SiYuan before v3.8.5 contains a missing authorization vulnerability in the getRefCreateSavePath, getShorthandSavePath, and getDocCreateSavePath endpoints that allows read-only publish visitors to learn unpublished notebook box IDs. Attackers with read-only or anonymous publish access can POST any open notebook ID to receive the global save-box ID and save-path template, revealing a hidden notebook's existence and creation time.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/siyuan-note/siyuan/security/advisories/GHSA-2mrf-mx66-vv6g
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2026-103763](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-103763)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
SiYuan before v3.8.5 contains an information disclosure vulnerability that allows read-only publish readers to learn metadata of publish-excluded documents through the getNotebookInfo endpoint. Attackers, including anonymous visitors when no reader password is set, can query publish-visible notebooks to obtain document count, size and modification timestamps of hidden documents.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/siyuan-note/siyuan/security/advisories/GHSA-ccxp-q3vg-jvgj
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-103764](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-103764)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
Mooncake transfer engine before 0.3.13 contains an untrusted pointer dereference in ServerSession::readHeader that allows unauthenticated attackers to read and write arbitrary process memory via the TCP transport data port. Attackers can send a crafted SessionHeader with arbitrary addr and size values using READ or WRITE opcodes to disclose KV cache contents, prompts and secrets or corrupt memory toward code execution.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/kvcache-ai/Mooncake/issues/4441
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-103765](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-103765)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
Mooncake through 0.3.13.post1 contains a missing authentication vulnerability in the HTTP metadata server /metadata handler that allows unauthenticated attackers to read, overwrite, and delete transfer engine metadata keys. Attackers can poison segment descriptors such as tcp_data_port or re-create rpc_meta entries to redirect KV cache transfers to attacker-controlled listeners, or exhaust server memory.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/kvcache-ai/Mooncake/issues/4444
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-104733](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-104733)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
User Impersonation in ProcessOnes XMMP Server ejabberd <= 26.04 allows an attacker to impersonate arbitrary users via unvalidated authzid parameter in SASL-PLAIN mechanism.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://www.nsideattacklogic.de/advisories/NSIDE-SA-2026-004/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-105043](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-105043)
|
||||
|
||||
|
||||
%20Misrepresentation%20of%20Critical%20Information&color=brightgreen)
|
||||
|
||||
### Description
|
||||
|
||||
MathWorks Simulink before R2026b, when showing a crafted .slx file, can have blocks that are never visible in the Simulink Editor but will cause code execution.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://alexanderboll.dev/disclosures/simulink-vulnerability-concealed-blocks/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2026-105090](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-105090)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
Formbricks before 5.4.4 and 6 before 6.0.1 allows stored XSS. The survey-level Custom Head Scripts feature did not enforce the documented Manage permission boundary. A workspace member holding only readWrite permission could configure Custom Head Scripts on a survey, an operation the documentation restricts to the Manage role. Because the configured scripts execute in the authenticated browser session of any user who opens the affected survey, a lower-privileged member can run arbitrary JavaScript (stored cross-site scripting) in the session of higher-privileged users. Fixed versions require Manage access to modify survey Custom Head Scripts.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://www.sec4check.pl/blog/posts/cve-formbricks-broken-access-control-stored-xss-custom-head-scripts.html
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -15,6 +15,8 @@ A weakness has been identified in unitedbyai droidclaw up to 0.5.3. Affected by
|
||||
|
||||
#### Reference
|
||||
- https://github.com/unitedbyai/droidclaw/issues/18
|
||||
- https://vuldb.com/vuln/383396
|
||||
- https://vuldb.com/vuln/383396/cti
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-19856](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-19856)
|
||||
|
||||
|
||||
&color=brightgreen)
|
||||
|
||||
### Description
|
||||
|
||||
The All in One SEO WordPress plugin before 5.0.2.1 does not correctly determine which shortcodes are present in content derived from user input before deciding which ones to strip, allowing unauthenticated users to execute arbitrary shortcodes registered on the site. On sites upgraded from older versions the protection is disabled outright, making the issue reachable without any crafted input.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/e35365d3-65de-45a7-9629-17aacd5299c7/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -11,6 +11,7 @@ Hoverfly is an open source API simulation tool. Prior to version 1.12.8, when Ho
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/SpectoLabs/hoverfly/pull/1227
|
||||
- https://github.com/SpectoLabs/hoverfly/security/advisories/GHSA-qrh4-p6v4-mrfg
|
||||
|
||||
#### Github
|
||||
|
||||
@@ -0,0 +1,19 @@
|
||||
### [CVE-2026-52993](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52993)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
In the Linux kernel, the following vulnerability has been resolved:tipc: fix double-free in tipc_buf_append()tipc_msg_validate() can potentially reallocate the skb it is validating,freeing the old one. In tipc_buf_append(), it was being called with apointer to a local variable which was a copy of the caller's skbpointer.If the skb was reallocated and validation subsequently failed, the errorhandling path would free the original skb pointer, which had alreadybeen freed, leading to double-free.Fix this by checking if head now points to a newly allocated reassembledskb. If it does, reassign *headbuf for later freeing operations.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://bugzilla.redhat.com/show_bug.cgi?id=2492437
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2026-62286](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-62286)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
Dozzle is a realtime log viewer for docker containers. Prior to 10.6.7, streamEvents in internal/web/events.go applies a restricted user's label filter to container lists but not to the container-stat and container-event channels returned by GET /api/events/stream. In a simple-auth deployment using per-user filters, any authenticated restricted account can receive resource telemetry and lifecycle events for containers outside its authorized label scope. The exposed data includes container names, images, full label maps, CPU and memory use, network and disk totals, and deployment or restart activity across monitored hosts, but does not include log contents, environment values, or exec access. This issue is fixed in version 10.6.7.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/amir20/dozzle/security/advisories/GHSA-xcw9-qmmf-vqxj
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-62308](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-62308)
|
||||
|
||||
|
||||
&color=brightgreen)
|
||||
|
||||
### Description
|
||||
|
||||
Tugtainer is a self-hosted app for automating updates of Docker containers. Prior to version 1.30.6, Tugtainer allows an authenticated user to make the backend server send outbound HTTP requests to arbitrary user-supplied URLs through the notification test endpoint. The /settings/test_notification endpoint accepts a urls field and passes it directly to Apprise without restricting protocols, hostnames, localhost addresses, private IP ranges, or cloud metadata addresses. This can be abused as an authenticated blind server-side request forgery (SSRF). This issue has been patched in version 1.30.6.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/Quenary/tugtainer/security/advisories/GHSA-c2h5-ppv9-7vrq
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,21 @@
|
||||
### [CVE-2026-62911](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-62911)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
Authentication bypass by capture-replay in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/hypnguyen1209/CVE-2026-62911
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-62985](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-62985)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
request-filtering-agent is an http(s).Agent implementation that blocks requests to Private/Reserved IP addresses. Prior to 3.2.1, RequestFilteringHttpAgent and RequestFilteringHttpsAgent synchronously threw from createConnection when rejecting a literal private-IP host such as 169.254.169.254 or 127.0.0.1. Because Node.js http.request and http.get expect connection failures to be delivered asynchronously, the throw bypassed req.on('error') and became an uncaught exception that could terminate the application process. Hostnames resolved through the asynchronous lookup path were not affected by this error-delivery asymmetry. This issue is fixed in version 3.2.1.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/azu/request-filtering-agent/security/advisories/GHSA-r3r9-wp5j-pq5g
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2026-62987](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-62987)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
Fabio is an HTTP(S) and TCP router for deploying applications managed by consul. From 1.6.6 until 1.7.2, the CVE-2025-48865 fix in proxy/http_headers.go uses protectHeaders for a hardcoded set of forwarded headers but omits the operator-configured ClientIPHeader, TLSHeader, and RequestID names. In proxy/http_proxy.go, HTTPProxy.ServeHTTP calls addHeaders to set these trust headers before Go ReverseProxy processes the inbound Connection header, allowing an unauthenticated client to name and remove the configured headers before the request reaches the backend. Deployments that enable the corresponding proxy.header options can therefore lose client-IP, TLS-termination, or request-correlation signals used by backend authorization and auditing; the options are empty by default, and the hardcoded protected forwarded headers are unaffected. This issue is fixed in version 1.7.2.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/fabiolb/fabio/security/advisories/GHSA-fq95-v8xc-jm3v
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-63098](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63098)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
TheHive through 4.1.24 contains an unauthenticated information disclosure vulnerability that allows unauthenticated attackers to retrieve sensitive configuration data by sending a GET request to the /api/status endpoint, which lacks authentication enforcement in the StatusCtrl.scala handler. Attackers can obtain the datastore attachment protection password, configured authentication providers, SSO settings, MFA capabilities, and clustered node addresses and roles without any credentials.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/geo-chen/oss/blob/main/TheHive.md#finding-1-get-apistatus-exposes-attachment-protection-password-without-authentication
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -1,6 +1,7 @@
|
||||
### [CVE-2026-63134](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63134)
|
||||
|
||||
|
||||
|
||||
&color=brightgreen)
|
||||
|
||||
### Description
|
||||
|
||||
@@ -1,6 +1,7 @@
|
||||
### [CVE-2026-63177](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63177)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-63459](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63459)
|
||||
|
||||
|
||||
&color=brightgreen)
|
||||
|
||||
### Description
|
||||
|
||||
Vendure is an open-source headless commerce platform. Prior to 3.6.5, RichTextDescriptionCell in packages/dashboard/src/lib/components/shared/table-cell/order-table-cell-components.tsx attempts to strip markup by assigning an administrator-controlled description to a live element's innerHTML and then reading textContent. Active resource markup can execute an event handler during the innerHTML assignment before textContent is read. A lower-privilege administrator can store such markup in descriptions rendered by the Products list, Collections list, Promotions list, Payment Methods list, or Shipping Methods list, and script executes when another administrator views the affected row. This stored cross-site scripting can compromise the viewing administrator's session and enable cross-privilege or cross-channel administrative actions. This issue is fixed in version 3.6.5.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/vendurehq/vendure/security/advisories/GHSA-xhq9-whgq-49j5
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
Loaded 100 of 188 files, more files were not shown because too many files have changed in this diff.
Show more
Reference in new issue
Block a user