Aggregator

SignUp & SignIn 是一款 WordPress 用户注册/登录插件，提供 AJAX 注册、邮箱验证、密码重置等功能。2026 年该插件 ≤ 1.0.0 版本被披露存在 CVSS 9.8 的严重漏洞（CVE-2026-12417）——其账户激活码由 rand(1000, 9999) 生成，仅 9,000 种可能，且验证端点 wp_ajax_nopriv_pravel_check_acti

在企业环境中，大多数使用的都是域环境，在后渗透中就需要进行域环境的权限维持来造成持续危害。

A vulnerability has been found in Microsoft Edge and classified as problematic. Impacted is an unknown function. This manipulation causes improper access controls. This vulnerability is tracked as CVE-2026-58525. The attack is possible to be carried out remotely. No exploit exists.

Currently trending CVE - Hype Score: 11 - Foxit PDF Reader Doc Object Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in that the target must ...

Currently trending CVE - Hype Score: 13 - Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.1, an Insecure Direct Object Reference (IDOR) vulnerability in /api/v1/responses endpoint allows an authenticated attacker to execute any flow belonging to another user by specifying the ...

Currently trending CVE - Hype Score: 11 - A vulnerability in SP Page Builder for Joomla allows unauthenticated users to upload arbitrary files, ultimately resulting in the upload and execution of PHP code.

Currently trending CVE - Hype Score: 15 - In the Linux kernel, the following vulnerability has been resolved: eventpoll: fix ep_remove struct eventpoll / struct file UAF ep_remove() (via ep_remove_file()) cleared file->f_ep under file->f_lock but then kept using @file inside the critical section (is_file_epoll(), ...

Currently trending CVE - Hype Score: 11 - ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary code execution in the context of the current user. Exploitation of this issue does not ...

Currently trending CVE - Hype Score: 15 - In the Linux kernel, the following vulnerability has been resolved: net/sched: fix pedit partial COW leading to page cache corruption tcf_pedit_act() computes the COW range for skb_ensure_writable() once before the key loop using tcfp_off_max_hint, but the hint does not ...

Currently trending CVE - Hype Score: 15 - In the Linux kernel, the following vulnerability has been resolved: net: skbuff: propagate shared-frag marker through frag-transfer helpers Two frag-transfer helpers (__pskb_copy_fclone() and skb_shift()) fail to propagate the SKBFL_SHARED_FRAG bit in skb_shinfo()->flags ...

Currently trending CVE - Hype Score: 15 - In the Linux kernel, the following vulnerability has been resolved: fuse: reject oversized dirents in page cache fuse_add_dirent_to_cache() computes a serialized dirent size from the server-controlled namelen field and copies the dirent into a single page-cache page. The ...

Currently trending CVE - Hype Score: 1 - Improper authentication in Windows SMB Server allows an authorized attacker to elevate privileges locally.

Currently trending CVE - Hype Score: 22 - Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the _from parameter in a URL is not validated in program/actions/settings/upload.php, leading to PHP Object Deserialization.

A vulnerability, which was classified as critical, was found in Mysterium Network Mysterium Node up to 1.35.x. This issue affects some unknown processing of the file /tequilapi/config/user of the component Config User Endpoint. The manipulation results in improper authorization. This vulnerability is identified as CVE-2026-31309. The attack can be executed remotely. There is not any exploit available.

A vulnerability, which was classified as problematic, has been found in CycloneDX cyclonedx-node-npm up to 4.x. This vulnerability affects unknown code of the component CLI. The manipulation of the argument --workspace leads to os command injection. This vulnerability is referenced as CVE-2026-55849. The attack can only be performed from a local environment. No exploit is available.

A vulnerability classified as critical was found in CoreWCF up to 1.8.0/1.9.0. This affects an unknown part of the component SAML Token Validation. Executing a manipulation can lead to algorithm downgrade. The identification of this vulnerability is CVE-2026-54781. The attack may be launched remotely. There is no exploit available.

A vulnerability classified as problematic has been found in Monsta Limited of New Zealand Monsta FTP up to 2.14.4. Affected by this issue is the function isBlockedIP of the component IP Blocklist Handler. Performing a manipulation of the argument URL results in server-side request forgery. This vulnerability was named CVE-2026-60105. The attack may be initiated remotely. There is no available exploit.

A vulnerability described as problematic has been identified in GitLab up to 18.11.6/19.0.3/19.1.1. Affected by this vulnerability is an unknown functionality of the component Work Item Metadata Access. Such manipulation leads to missing authorization. This vulnerability is uniquely identified as CVE-2026-8472. The attack can be launched remotely. No exploit exists.

A vulnerability marked as problematic has been reported in GitLab up to 18.11.6/19.0.3/19.1.1. Affected is an unknown function of the component Cross-project Reference Pages. This manipulation causes improper authorization. This vulnerability is handled as CVE-2026-7492. The attack can be initiated remotely. There is not any exploit available.

A vulnerability labeled as problematic has been found in GitLab up to 18.11.6/19.0.3/19.1.1. This impacts an unknown function of the component Input Sanitization. The manipulation results in permission issues. This vulnerability is known as CVE-2026-6896. It is possible to launch the attack remotely. No exploit is available.