Recent Advisories

Severity ID Title Vendor Product Date Type
CRITICAL 9.2 A68A628E-AB61-

Exploit for CVE-2026-42945_A68A628E-AB61-551B-9ECD-769EA5A45A85

nginx-rift-scanner Dependency-free Python 3 scanner for CVE-2026-42945 "NGINX Rift" — a CVSS v4.0 9.2 CRITICAL heap-based buffer overflow CWE-122 i...

N/A N/A GITHUBEXPLOIT
MEDIUM 6.5 CVE-2026-8653

MasterStudy LMS Pro Plus <= 4.8.20 - Authenticated (Instructor+) SQL Injection via 'columns' Parameter_CVE-2026-8653

The MasterStudy LMS Pro Plus plugin for WordPress is vulnerable to generic SQL Injection via the 'columns' parameter in all versions up to, and inc...

StylemixThemes MasterStudy LMS Pro CVE
HIGH 7.5 CVE-2026-10737

SP Project & Document Manager <= 4.71 - Missing Authorization to Unauthenticated Arbitrary File Information Disclosure via view_file() Function_CVE-2026-10737

The SP Project & Document Manager plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the view_file func...

smartypants SP Project & Document Manager CVE
HIGH 7.1 CVE-2026-41860

CVE-2026-41860_CVE-2026-41860

CWE-326 in BOSH allows a local attacker to steal Basic-auth credentials or redirect UAA token requests via MITM. HttpRequestHelper#create_async_end...

Cloud Foundry Foundation BOSH CVE
HIGH 7.1 CVE-2026-41859

CVE-2026-41859_CVE-2026-41859

A network man-in-the-middle between nats-sync and the BOSH director can steal the director credentials (Basic auth header or UAA client secret) and...

Cloud Foundry Foundation BOSH CVE
MEDIUM 6.5 CVE-2026-41858

CVE-2026-41858_CVE-2026-41858

Weak Randomness / Insecure Cryptographic Primitive (CWE-338) in Get-RandomPassword in BOSH-Ecosystem / windows-utilities-release allows a network a...

Cloud Foundry Foundation windows-utilities-release CVE
HIGH 8.7 CVE-2026-41011

CVE-2026-41011_CVE-2026-41011

PackagePersister.validate_tgz builds "tar -tf #{tgz} 2>&1" where tgz = File.join(release_dir, 'packages', "#{name}.tgz") and name = package_meta['n...

Cloud Foundry Foundation BOSH CVE
MEDIUM 6.9 CVE-2026-10597

ITPison｜OMICARD EDM – Insecure Direct Object Reference_CVE-2026-10597

OMICARD EDM developed by ITPison has a Insecure Direct Object Reference vulnerability, allowing unauthenticated remote attackers to modify a specif...

ITPison OMICARD EDM 5.8 CVE
MEDIUM 4.3 80DB2B91-72D2-

Exploit for Exposure of Sensitive Information to an Unauthorized Actor in Microsoft_80DB2B91-72D2-5072-AE04-E22E0DB8B481

CVE-2026-33829 - Security Vulnerability Quick Usage bash python3 exploit.py -t "C:\\Path\\To\\Target" -o demo.zip --data-file payload.exe Exploitat...

N/A N/A GITHUBEXPLOIT
HIGH 7.7 86F57F94-F26C-

Exploit for Exposure of Sensitive Information to an Unauthorized Actor in Tuzitio Camaleon_Cms_86F57F94-F26C-5EF7-904A-939B135AA64E

HTB Facts — Full Writeup Difficulty: Medium OS: Linux Tags: Web, MinIO, Camaleon CMS, Path Traversal, SSTI, Privilege Escalation --- Table of Conte...

N/A N/A GITHUBEXPLOIT