Automated, research-focused vulnerability analysis for bug bounty hunters, penetration testers, red teams and security engineers — with root cause, exploitability and remediation in every report.
Grav from 1.7.53.3 before 1.7.53.6 lets unauthenticated visitors read /__clockwork/ profiler records — including administrator plaintext passwords and configuration credentials — via a loopback REMOTE_ADDR fallback in Debugger::isDebuggerRequestAuthorized() when the site runs behind a…
Unauthenticated path traversal (CWE-22, CVSS 8.6) in Rembg before 2.0.82: the /api/remove endpoint's extras.sam_model value is interpolated into SAM filenames and GitHub download URLs passed to pooch.retrieve() without a pinned hash, letting attackers plant…
EPICS Base 7.0.10 and prior fails to validate element or length values in network messages, causing out-of-bounds reads that can crash the application and may expose adjacent memory. CVSS 4.0: 8.7 High, network-exploitable without…
OpenPanel before 3.0.0 lets a project member bypass the js-runtime AST allowlist by aliasing the Function constructor (payload.constructor.constructor) and run arbitrary code in the worker process. CVSS 4.0: 8.7 HIGH; fixed in 3.0.0.
Transmission 4.0.0 before 4.1.3 exposes the X-Transmission-Session-Id RPC anti-CSRF token to any web origin via permissive CORS in handle_request(), letting malicious pages replay it to run script-torrent-done, change download-dir, or delete torrents and data.
High-severity (CVSS v4.0 8.8) integer overflow (CWE-190) in EPICS Base 7.0.10 and prior: improperly validated message length values during protocol parsing cause an out-of-bounds memory write, leading to process instability or denial of service.
CVE-2026-115216 disables TLS certificate verification in Eclipse ioFog Operator 3.8.0 before 3.9.2 for Controller API and external OIDC issuer connections, letting on-path attackers capture the OAuth client secret or Controller bootstrap admin password and…
Critical (CVSS 9.1) middleware-skip flaw in @fastify/express 4.0.5–4.0.8: with Fastify's non-default ignoreDuplicateSlashes option enabled, absolute-form request targets let unauthenticated attackers reach scoped route handlers while authentication, authorization, or rate-limiting middleware is skip
Critical heap-based buffer overflow (CWE-122) in the WatchGuard Fireware OS authentication service: an attacker controlling or intercepting traffic to the configured Active Directory server can trigger denial of service and potentially arbitrary code execution…
Tanium's Certificate Manager vulnerability CVE-2026-108303 (CVSS 8.8, CWE-77) permits unauthorized code execution by a low-privileged network attacker with no user interaction. Remediation is referenced in Tanium advisory TAN-2026-075; affected versions are not disclosed in…
Authlib's documented ClientConfigurationEndpoint reference implementations never verify that the request credential belongs to the target client, so any valid registration access token can read, modify, or delete another client's registration. Fixed in Authlib 1.9.1.
High-severity (CVSS 8.8) logic flaw in the BMC IPMI implementation from Supermicro's October 2026 advisory: specially crafted RAKP+ messages let a low-privileged account escalate to administrator. Discovered by runZero.
CVE-2026-93434 is a pre-authentication XPath injection (CWE-20) in WatchGuard Fireware OS's SSH authentication process. A remote, unauthenticated attacker with access to the management SSH interface can extract sensitive configuration data (CVSS v4.0: 8.7 HIGH,…
OpenPanel before 3.0.0 lets authenticated users inject SQL via the property parameter of profile.values, comment out the project_id scope, and read other projects' profiles, events, and sessions across tenants. CVSS v4.0: 8.6 HIGH.
Octopus Server (CVE-2026-116870, CVSS 8.7) validated OIDC token issuers inconsistently, so a token from a suitably configured non-legitimate issuer could be accepted as a service-account token from a trusted issuer. Exploitation requires a service…
Mistral Vibe before 3.0.3 runs attacker-defined git filter drivers from an untrusted repository's .git/config during git worktree add, before the trusted-folder check, enabling remote code execution with user privileges (CVSS 4.0: 8.7, HIGH).
CVE-2026-102814 (CVSS 8.7): the TDDP v2 service of the TP-Link RE305 V3 uses a fixed, derivable cryptographic key, letting an unauthenticated attacker on the same LAN forge protocol packets and reach privileged operations that…
Critical (CVSS 9.2) integer overflow in the WebSocket connection handling of WatchGuard Fireware OS's Access Portal lets a remote, unauthenticated attacker write beyond the bounds of a heap buffer with a specially crafted request…
OS command injection (CWE-78, CVSS 8.8) in Atlantis 0.4.0–0.47.1: a pull-request-controlled workspace value from atlantis.yaml is joined and executed via sh -c, letting an authenticated contributor run arbitrary commands as the Atlantis service account.…
Critical (CVSS 9.4) stack-based buffer overflow in Hitachi JP1/Automatic Job Management System 3 - Manager, remotely exploitable without authentication; versions from 10-00 before 13-50-31 are affected.
CVE-2026-4337 is an unauthenticated unrestricted file upload flaw (CWE-434) in PuMuKIT that lets any remote user write arbitrary file types to any path writable by the web server user and potentially delete files, rated…
Kener 3.0.0 before 4.1.10 falls back to a hardcoded DUMMY_SECRET JWT signing key when KENER_SECRET_KEY is unset, letting unauthenticated attackers forge admin kener-user cookies to access /manage/api or forge password-reset tokens (CVSS 9.2).
Critical (CVSS 9.4) heap-based buffer overflow (CWE-122) in Hitachi JP1/Automatic Job Management System 3 Manager and Agent, affecting versions from 11-00 before 13-50-31 and remotely exploitable without authentication.
OpenPanel before 3.0.0 allows unauthenticated ClickHouse SQL injection via the projectId parameter of the /live/visitors/:projectId WebSocket, exposing other tenants' events and profiles; project members can also inject through cohort.preview timeframe values.