Automated, research-focused vulnerability analysis for bug bounty hunters, penetration testers, red teams and security engineers — with root cause, exploitability and remediation in every report.
OWASP Coraza WAF before 3.8.1 parses boundary ASCII control characters and control-only or empty cookie names differently from several backend cookie parsers, letting unauthenticated attackers craft Cookie headers that evade rules targeting REQUEST_COOKIES or…
Blind, time-based SQL injection (CWE-89) in ProcessMaker's GET /api/1.0/tasks endpoint via the order_by parameter, exploitable by any authenticated user to extract data readable by the database account. Fixed in ProcessMaker 2026.14.3; CVSS 6.5 (Medium).
Unauthenticated attackers can exhaust the process file-descriptor table in OWASP Coraza WAF 3.0.0–3.8.0 by sending multipart bodies with many minimal file parts, causing MULTIPART_STRICT_ERROR responses and process-wide file and socket failures. Fixed in 3.8.0.
CVE-2026-107833 is an uncontrolled recursion flaw (CWE-674) in OWASP Coraza WAF's JSON response-body processor affecting versions 3.0.0 until 3.8.0, letting deeply nested JSON responses drive quadratic CPU work during response inspection. Fixed in 3.8.0;…
Out-of-bounds read (CWE-125, CVSS 4.0 7.1 HIGH) in RIOT's nanoCoAP client: nanocoap_sock_get_slice() accepts a Block2 response on block number alone, letting a malicious CoAP server trigger an offset underflow in _2buf_slice() that crashes the…
CVE-2026-107838 is a high-severity (CVSS 7.5) unchecked-return-value flaw (CWE-252) in RIOT's nanocoap_fileserver (2023.07–2026.07): an ignored _resp_init() failure after coap_build_reply() cannot fit a response header lets handling continue on stale state until an assertion in…
x64dbg-MCP Server prior to 1.1 exposes all MCP debugger tools over HTTP and SSE without authentication while listening on 0.0.0.0 by default (ports 9094/9095), letting any unauthenticated network client execute arbitrary x64dbg commands, attach…
CVE-2026-111472 is a critical SQL injection (CWE-89, CVSS 9.3) in TSG Profleet, reachable via a GET request to /cgi-bin/index.php using the 'Identificación' parameter, allowing attackers to retrieve, create, update and delete database data without…
Wheels through 4.1.2 allows SQL injection on MySQL/MariaDB when backslash escaping is enabled (NO_BACKSLASH_ESCAPES absent) and request data reaches inline-literal query paths, because single-quote doubling ignores backslash escapes. Fixed in 4.2.0; CVSS 9.8 CRITICAL.
CVE-2026-107837 is a high-severity (CVSS 8.2) out-of-bounds read in RIOT's GNRC 6LoWPAN layer: _receive() in gnrc_sixlowpan.c routes undersized packets into fragment handling without length checks, letting a remote attacker crash the network stack and…
MariaDB's view FRM parser failed to safely encode newline characters in usernames, letting accounts with CREATE USER and CREATE VIEW WITH GRANT OPTION inject view security metadata and potentially escalate database privileges. Fixed in…
CVE-2026-107826 is a high-severity (CVSS 7.5) uncontrolled recursion flaw in OWASP Coraza WAF's JSON body processor, where gjson.Valid recurses without a depth bound over deeply nested JSON and terminally crashes the hosting process. Versions…
Unauthenticated stored XSS (CVSS 7.2) in the WPConsent cookie-consent WordPress plugin through version 1.1.9, exploiting noise-key restoration in the bundled Simple HTML DOM parser when the Script Blocking feature is enabled; the two-comment chain…
Improper authorization in query resolvers generated by @aws-amplify/graphql-index-transformer (AWS Amplify API Category before 3.1.2) might let an authenticated remote user read records owned by other users of the same application via crafted queries. Fixed…
Stored XSS (CWE-79) in the Tutor LMS WordPress plugin up to and including 4.1.0 via the display_name parameter. Subscriber-level attackers can inject web scripts that execute when users access the injected page; exploitation is…
CVE-2026-19541 (Medium, CVSS 6.5): Mattermost 11.7.x through 11.10.x sends the stored client secret of an outgoing OAuth connection to its token URL during validation without requiring re-entry, letting an authenticated user with connection-management permission…
Mattermost versions 11.10.x
The WSP MCP AI Agents Connector WordPress plugin up to 2.9.5 lets Subscriber-level users read titles, URLs, authors, categories, tags, and 40-word excerpts of all draft, pending, and scheduled posts via the wsp_get_posts MCP…
CVE-2026-15219 is a medium-severity (CVSS 6.5) authorization bypass through user-controlled key (CWE-639/IDOR) in SFM Software Technologies Inc. Costifier, affecting all versions through 2026-10-16 with high integrity impact. Discovered by Berat ARSLAN with the CVE…
Medium-severity input-validation flaw in OWASP Coraza WAF 3.0.0–3.8.0: after a url.ParseRequestURI failure, ProcessURI leaves QUERY_STRING and ARGS_GET empty, letting unauthenticated attackers bypass query-parameter rules via control bytes in the URI. Fixed in 3.8.0.
MariaDB Connector/C 3.4.1 until 3.4.10 failed to reject TLS hostname verification mismatches before selecting a non-hashing authentication plugin, letting an active MITM with a valid certificate for another hostname obtain the database password via…
CVE-2026-107816 is a medium-severity (CVSS 6.4) out-of-bounds read (CWE-125) in MariaDB's qc_info plugin: after a query containing embedded null bytes is cached, reading information_schema.query_cache_info can access data beyond a heap buffer, potentially disclosing adjacent…
MariaDB's ACL cache could generate identical database-privilege cache keys for a role and a localhost user with matching names, because both used an empty IP component, letting an attacker with CREATE USER exercise privileges…
MariaDB insufficiently validated counts, offsets, lengths, and field boundaries in FRM metadata when opening binary FRM files; a crafted FRM file placed in the data directory could trigger out-of-bounds reads or writes, crash the…