Publicly Disclosed
PoC Exploits

An input validation flaw in Amazon Bedrock AgentCore may permit an authenticated remote user to execute predefined tools, circumventing standard model invocation and security protocols through specially crafted content blocks embedded in conversation messages. AWS has resolved the issue, and no f...

A vulnerability exists in the Linux kernel's rtmutex component where the remove_waiter() function incorrectly utilizes current instead of waiter::task during a dequeue operation within various mutex handling paths. This mismanagement leads to multiple issues, including potential use-after-free vu...

A use-after-free vulnerability has been identified in the JIT component of the JavaScript engine within Mozilla's Firefox browser. This flaw can lead to memory corruption issues, potentially allowing attackers to execute arbitrary code or cause unexpected behavior in affected Firefox versions, sp...

This vulnerability is identified as an issue in the JavaScript Engine of Mozilla Firefox, specifically within the JIT (Just-In-Time) compilation process. It allows attackers to exploit a use-after-free condition, potentially enabling arbitrary code execution. The flaw impacts various versions of ...

A buffer overflow vulnerability was identified in Samsung mobile devices utilizing Exynos chipsets, particularly impacting software versions O(8.x), P(9.0), and Q(10.0). This exploit arises from an abnormal SETUP message sent to the baseband component, which could allow for the execution of arbit...

A vulnerability exists in the Linux kernel's rtmutex component where the remove_waiter() function incorrectly utilizes current instead of waiter::task during a dequeue operation within various mutex handling paths. This mismanagement leads to multiple issues, including potential use-after-free vu...

The ThrottleStop driver, a legitimate component from TechPowerUp, presents a vulnerability due to insecure IOCTL interfaces that permit arbitrary read and write access to the physical memory through the MmMapIoSpace function. This flaw can be exploited by malicious applications running in user mo...

The Ray Enterprise Translation WordPress plugin, up to version 1.7.3, is susceptible to an improper authorization vulnerability due to the lack of capability and nonce checks on specific AJAX actions. This oversight permits any authenticated user, even those with minimal permissions like Subscrib...

The Ray Enterprise Translation plugin for WordPress versions up to 1.7.3 allows authenticated users, including those with minimal privileges such as Subscribers, to exploit an insufficient access control mechanism. This vulnerability arises from the plugin's failure to enforce capability or nonce...

The dataSIMS Avionics ARINC 664-1 version 4.5.3 includes a vulnerability that could be exploited through a local buffer overflow. By manipulating the milstd1553result.txt file, attackers may craft a malicious file with specific payload and alignment sections, enabling them to overwrite memory and...

The image-size library through version 2.0.2 contains a vulnerability that allows a remote attacker to induce a denial of service by sending a specially crafted image buffer with a zero-valued size field. This input can manipulate the Node.js event loop, resulting in an infinite loop during the i...

A vulnerability exists in the Windows Event Logging Service due to a failure in its protection mechanisms, allowing an authorized attacker to potentially disclose sensitive information across a network. This could lead to unauthorized access to sensitive data or system information, emphasizing th...

The Joomla Content Editor (JCE) prior to version 2.20.2 is affected by an improper input validation vulnerability. This flaw permits authenticated users with file management permissions to rename files, even to invalid names, which can lead to the creation of hidden files. Additionally, this flaw...

The Sucuri Security WordPress plugin, up to version 2.7.3, suffers from a path traversal vulnerability within the pageIntegritySubmission() method in src/integrity.lib.php. This flaw enables authenticated administrators to delete arbitrary files by inserting directory traversal sequences into the...

A path traversal flaw exists in Unearth version 0.18.2, specifically within the is_within_directory function. This vulnerability arises because the application does not properly normalize file paths before validating them, allowing attackers to exploit this oversight. They can create malicious ta...

The SQLBot dashboard component is vulnerable to stored cross-site scripting (XSS) due to improper sanitization of user-provided content rendered through TinyMCE. This flaw allows attackers with access to modify the dashboard text widgets to inject malicious HTML and JavaScript. Consequently, any ...

Cachet versions up to 2.4.1 are vulnerable to server-side template injection, allowing authenticated users to exploit incident templates. By crafting malicious incident templates using Blade directives or Twig filters, attackers can execute arbitrary PHP code and potentially gain control of the w...

In FlyEnv versions before 4.18.0, the application does not adequately sanitize HTML content generated from markdown and AI chat inputs before rendering it into the DOM using Vue's v-html directive. This flaw allows attackers to inject and execute malicious scripts within the Electron renderer pro...

The Spacebar Server prior to commit 8d126f4 exhibits a vulnerability allowing authenticated users with MANAGE_MESSAGES permission to delete messages across different channels. This flaw arises from the inadequate scoping of message deletion requests, enabling malicious actors to exploit the delet...

The Spacebar Server prior to commit 8d126f4 exhibits a vulnerability allowing authenticated users with MANAGE_MESSAGES permission to delete messages across different channels. This flaw arises from the inadequate scoping of message deletion requests, enabling malicious actors to exploit the delet...

Hugging Face Accelerate versions up to 1.14.0 are susceptible to a path traversal vulnerability found in the load_checkpoint_in_model and load_checkpoint_and_dispatch functions. This issue arises from improper sanitization of weight_map entries that are sourced from sharded checkpoint indexes. An...

CyberPanel version 2.4.3 is susceptible to an authenticated command injection vulnerability associated with its remote backup transfer functionality. This flaw enables authenticated attackers to execute arbitrary OS commands by manipulating the API response from a remote server. By crafting a mal...

Flowise versions 2.2.4 through 3.1.4 are vulnerable to a missing authorization issue in the POST /api/v1/openai-assistants-file/download endpoint. This flaw permits unauthenticated attackers to access private files by taking advantage of the endpoint's improper handling of session and API key ver...

MCPJam Inspector, designed for local-first development on MCP servers, has a vulnerability allowing remote code execution (RCE) due to improper binding settings. In versions 1.4.2 and earlier, the platform listens on 0.0.0.0 by default, enabling attackers to exploit this configuration through cra...

A vulnerability exists in the Linux kernel's rtmutex component where the remove_waiter() function incorrectly utilizes current instead of waiter::task during a dequeue operation within various mutex handling paths. This mismanagement leads to multiple issues, including potential use-after-free vu...

Postiz, an open-source social media scheduling tool developed by Gitroom, has a vulnerability that allows unauthenticated remote attackers to exploit the file handling mechanism. The application's upload route improperly manages URL paths, permitting attackers to access any file the application p...

tar-rs versions 0.4.11 to 0.4.46 possess a vulnerability in the Builder::append_dir_all() function, allowing attackers to exploit symlink behavior. This flaw enables unauthorized file access by allowing symlinks to bypass the designated source root directory. When an archived process is conducted...

NVIDIA GeForce Now for Android includes a flaw within its game launcher component, where a malicious application on the same device can intercept and process implicit intents designed for the streamer component. This vulnerability can be manipulated to enable unauthorized information disclosure, ...

The vulnerability in Spring Retry allows an attacker to send numerous unique requests that overwhelm the application’s stateful retry cache. Once this cache reaches its limit, it prevents any further updates, leading to a failure in all subsequent stateful retries and circuit breaker operations. ...

A path handling issue in Apple Private Cloud Compute may allow attackers positioned within a privileged network to exploit the vulnerability and leak sensitive information. This potential security weakness has been addressed with improved validation in PCC Release 5E290.3, enhancing the overall p...

A vulnerability in the Linux kernel's SCTP (Stream Control Transmission Protocol) handling arises when processing Address Configuration (ASCONF) chunks. Specifically, the system allows for a potential memory corruption scenario by failing to protect the transport cached in the ASCONF structure. A...

A vulnerability exists in the Sina Weibo Android SDK 4.2.7 where an intent redirection issue allows unexported Activities to be launched unexpectedly by the WbShareTransActivity. This could lead to unauthorized access and potential compromise of application security, making it crucial for develop...

Bitwarden Server prior to version 2026.7.2 contains a vulnerability that allows any authenticated user to send a POST request to the /collect endpoint without verifying their membership in the respective organization. This flaw enables users to forge audit log entries, potentially leading to sign...

The vulnerability CVE-2024-29943 affects Firefox, allowing attackers to perform an out-of-bounds read or write on a JavaScript object, enabling remote code execution and sandbox escape. The flaw was exploited during the Pwn2Own Vancouver 2024 hacking competition and affected Firefox versions befo...

The Duplicate Post plugin for WordPress, prior to version 1.5.5, has a significant security flaw where it fails to enforce proper authorization checks during its bulk copy and delete functionalities. This oversight allows any user with access granted by an administrator to delete posts across the...

The WooCommerce WordPress plugin prior to version 2.0.2 is susceptible to a file upload vulnerability due to its failure to validate the types of files that can be uploaded when its accepted-types setting is left empty. This lack of validation opens the door for unauthenticated attackers to uploa...

The CheckView WordPress plugin contains a vulnerability that allows unauthenticated attackers to exploit the REST API due to improper handling of authentication filters. This flaw leads to the potential bypass of security mechanisms, allowing attackers to perform various actions typically reserve...

The All-in-One Video Gallery plugin for WordPress is vulnerable to an unauthenticated file download exploit. This occurs through a public file-download handler that can be triggered by accessing a specific URL pattern (`?vdl=<post_id>`). When this endpoint is accessed, it allows any user to initi...

The s2Member WordPress plugin prior to version 260805 contains a vulnerability that fails to properly escape certain shortcode attributes. This oversight allows users with contributor-level access to execute arbitrary JavaScript within an inline script context. When a post containing the affected...

The FoodBoxBooker plugin for WordPress prior to version 1.0.8 is susceptible to an improper authorization vulnerability. This flaw enables authenticated users with Subscriber-level access or higher to update profile details of any user on the system, including those with administrative privileges...

The Advanced Classifieds & Directory Pro plugin for WordPress prior to version 3.4.3 is susceptible to an unauthenticated sensitive information exposure through its AJAX action `acadp_public_custom_fields_listings`. This vulnerability allows attackers to access confidential data without proper au...

The Salon Booking System WordPress plugin, up to version 10.30.33, is vulnerable to unauthorized access due to a lack of capability checks and OAuth state value validation during its Google Calendar authorization callback. This issue allows unauthenticated attackers to overwrite existing Google C...

The Vitepos WordPress plugin, prior to version 3.6.0, suffers from a significant security flaw due to inadequate sanitization and parameterization of an identifier sourced from a REST request body. This shortcoming can be exploited by users with administrator-level access, enabling them to execut...

The Booking for Appointments and Events Calendar WordPress plugin prior to version 9.7 contains a security flaw that allows authenticated employees to access and manipulate customer records without proper verification. This oversight permits any logged-in employee with access to the Employee Pane...

The Vitepos WordPress plugin, including versions prior to 3.6.0 and 3.5.0, is vulnerable due to the lack of a per-target authorization check in its password-reset API. This oversight grants the custom Outlet Manager role excessive permissions, enabling them to reset any user's password—including ...

The Autopay WordPress plugin prior to version 5.0.1 is susceptible to a Cross-Site Scripting (XSS) vulnerability. This flaw arises from the failure to validate user capabilities and nonces during the processing of styling options submitted through public requests. As a result, unauthenticated att...

The Salon Booking System WordPress plugin, up to version 10.30.33, suffers from a vulnerability due to its inadequate validation of booking ownership tokens. This flaw allows unauthenticated attackers to access and disclose sensitive booking records of other customers by submitting a sequential b...

The ProSolution WP Client plugin for WordPress contains a significant vulnerability where the application fails to sanitize cookie values before utilizing them in SQL queries. This security flaw allows unauthorized users to access sensitive database information and delete records without any form...

The Salon Booking System plugin for WordPress versions up to 10.30.33 contains an access control vulnerability that lets unauthorized users manipulate AJAX actions related to booking modifications. This flaw does not adequately validate booking ownership, enabling attackers to alter the total of ...

The ProSolution WP Client plugin for WordPress, prior to version 2.0.6, is vulnerable due to inadequate sanitization and escaping of a parameter in SQL statements. This flaw, which is accessible to unauthenticated users, allows for blind SQL injection attacks, potentially compromising the integri...