CVE-2021-44228_scanner

CVE-2021-44228scanner Applications that are vulnerable to the log4j CVE-2021-44228 issue may be detectable by scanning jar, war, and ear files to search for the presence of JndiLookup.class. Depending on the platform that you are investigating, the PowerShell or the Python3 script may make more...

WinboxPoC

WinboxExploit This is a proof of concept of the critical WinBox vulnerability CVE-2018-14847 which allows for arbitrary file read of plain text passwords. The vulnerability has long since been fixed, so this project has ended and will not be supported or updated anymore. You can fork it and updat...

CVE-2026-26832

CVE-2026-26832: OS command injection in node-tesseract-ocr Summary node-tesseract-ocr through version 2.2.1 allows OS command injection in recognize in src/index.js. The package builds a shell command string and executes it with childprocess.exec. Because the input path is only wrapped in double...

Linux Distros Unpatched Vulnerability : CVE-2026-110877

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - AdPlug through 2.4 contains a heap out-of-bounds read vulnerability in CdmoLoader::load in src/dmo.cpp that allows attackers to read past a heap allocation by...

Linux Distros Unpatched Vulnerability : CVE-2026-111134

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - libfwsi through 20260522 contains a heap out-of-bounds read vulnerability in libfwsimtpfileentryvaluesreaddata that allows attackers to read past buffer bounds...

Linux Distros Unpatched Vulnerability : CVE-2026-111144

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - libansilove 1.3.0 through 1.4.2 contains a NULL pointer dereference vulnerability in ansilovexbin that allows attackers to crash applications by supplying a...

CVE-2026-110877

AdPlug through 2.4 contains a heap out-of-bounds read vulnerability in CdmoLoader::load in src/dmo.cpp that allows attackers to read past a heap allocation by supplying a truncated TwinTeam DMO file. Attackers can supply a 12- or 13-byte file passing dmounpacker::decrypt, opened via...

CVE-2026-111144

libansilove 1.3.0 through 1.4.2 contains a NULL pointer dereference vulnerability in ansilovexbin that allows attackers to crash applications by supplying a crafted XBIN file. Attackers can set the 512-character flag without the custom-font flag, causing drawchar to index a NULL highfontdataxbin...

CVE-2026-111148

libsidplayfp through 3.1.1 contains a heap out-of-bounds read vulnerability that allows attackers to crash applications by supplying a PSID/RSID file with an unchecked data offset. Attackers can set the header data offset beyond the file size, wrapping the length calculation so resolveAddrs reads...

CVE-2026-102740

The AsyncHttpClient library allows Java applications to execute HTTP requests and asynchronously process HTTP responses. From 2.0.0 until 2.16.1 and 3.0.12, PropertiesBasedResumableProcessor stores resumable download state at the predictable shared path...

UBUNTU-CVE-2026-110877

AdPlug through 2.4 contains a heap out-of-bounds read vulnerability in CdmoLoader::load in src/dmo.cpp that allows attackers to read past a heap allocation by supplying a truncated TwinTeam DMO file. Attackers can supply a 12- or 13-byte file passing dmounpacker::decrypt, opened via...

PT-2026-115895

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB RPM packages created the dedicated mysql service account with the database data directory as its home directory. A database user with the FILE privilege...

PT-2026-115907

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB RPM packages created the dedicated mysql service account with the database data directory as its home directory. A database user with the FILE privilege...

PT-2026-115919

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB RPM packages created the dedicated mysql service account with the database data directory as its home directory. A database user with the FILE privilege...

UBUNTU-CVE-2026-111159

libewf through 20260924 contains a heap out-of-bounds read vulnerability in libewflefextendedattributereaddata because UTF-16 name and value sizes are validated before being doubled. Attackers can supply a crafted .L01/.Lx01 file with oversized 'ea' metadata counts to crash the application or lea...

UBUNTU-CVE-2026-111144

libansilove 1.3.0 through 1.4.2 contains a NULL pointer dereference vulnerability in ansilovexbin that allows attackers to crash applications by supplying a crafted XBIN file. Attackers can set the 512-character flag without the custom-font flag, causing drawchar to index a NULL highfontdataxbin...

UBUNTU-CVE-2026-111148

libsidplayfp through 3.1.1 contains a heap out-of-bounds read vulnerability that allows attackers to crash applications by supplying a PSID/RSID file with an unchecked data offset. Attackers can set the header data offset beyond the file size, wrapping the length calculation so resolveAddrs reads...

Fortinet Multiple Products Path Traversal Vulnerability

FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager contain a path traversal vulnerability that may allow an authenticated attacker with admin profile and at least read-write permissions to write or delete arbitrary files via specific CLI commands...

BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability

BeyondTrust Remote Support contains an authentication bypass by spoofing vulnerability that could allow a remote attacker to perform file operations on the appliance...

PT-2026-115856

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 11.7 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3 that when importing CSV files could have allowed an authenticated user to cause denial of service to Sidekiq workers due to improper validation of CSV file...