CVE-2026-12171 auto-changelog: code execution via untrusted in-repository configuration (handlebarsSetup/plugins), plus argument injection, path traversal, and SSRF

auto-changelog before 2.6.1 merges configuration from inside the target repository the .auto-changelog file and the auto-changelog key in package.json into its options, and honors security-sensitive options from that untrusted source. The handlebarsSetup option is passed to require, so running...

EUVD-2026-92475

auto-changelog before 2.6.1 merges configuration from inside the target repository the .auto-changelog file and the auto-changelog key in package.json into its options, and honors security-sensitive options from that untrusted source. The handlebarsSetup option is passed to require, so running...

CVE-2024-10924

POC pour CVE-2024-10924 Une faille de gestion d'erreur dans l'API REST du plugin WordPress Really Simple Plugins versions entre 9.0.0 et 9.1.1.1 incluses permet à un attaquant, lorsque l'authentification à deux facteurs est activée, de contourner l'authentification et de prendre le contrôle d'un...

Denial-of-service (DoS)

org.apache.qpid, qpid-broker-plugins-amqp-1-0-protocol is vulnerable to a Denial-of-service DoS. The vulnerability is due to type nesting that can trigger a StackOverflowError, which allows a pre-authentication attacker to send specially crafted nested data and potentially crash the broker...

Astra Linux – Vulnerability in gst-plugins-good1.0

GStreamer is a library for constructing graphs of media-handling components. A null pointer dereference vulnerability has been discovered in the gstmatroskademuxaddwvpkheader function within matroska-demux.c. This function does not properly check the validity of the stream-codecpriv pointer. If...

Astra Linux – Vulnerability in gst-plugins-base1.0

GStreamer is a library for constructing graphs of media-handling components. A null pointer dereference has been discovered in the id3v2readsynchuint function, located in id3v2.c. If id3v2readsynchuint is called with a null work-hdr.framedata, the pointer guint8 data is accessed without validatio...

Astra Linux – Vulnerability in node-babel

Babel is a compiler for writing JavaScript. In @babel/traverse prior to versions 7.23.2 and 8.0.0-alpha.4, as well as all versions of babel-traverse, using Babel to compile code that was specifically crafted by an attacker can lead to arbitrary code execution during compilation, especially when...

volatility-plugins

https://www.countercept.com/blog/hunting-for-gargoyle-memory-scanning-evasion/...

[SECURITY] Fedora 45 Update: nagios-plugins-2.5-2.fc45

Nagios is a program that will monitor hosts and services on your network, and to email or page you when a problem arises or is resolved. Nagios runs on a Unix server as a background or daemon process, intermittently running checks on various services that you specify. The actual service checks ar...

PT-2026-106248

Name of the Vulnerable Software and Affected Versions Docling versions 2.27.0 through 2.130.0 Description Plugin factories in docling/models/factories/base factory.py call the load setuptools entrypoints function before the allow external plugins setting is applied. This sequence allows every...

PT-2026-106050

Name of the Vulnerable Software and Affected Versions HyperShift operator affected versions not specified Description A flaw in the HyperShift operator allows a tenant isolation bypass. The operator copies user-provided Kubernetes configuration kubeconfig secrets into the privileged control plane...

CVE-2026-12171: Inclusion of Functionality from Untrusted Control Sphere

auto-changelog before 2.6.1 merges configuration from inside the target repository the .auto-changelog file and the auto-changelog key in package.json into its options, and honors security-sensitive options from that untrusted source. The handlebarsSetup option is passed to require, so running...

Fedora 45 : nagios-plugins (2026-c213ad9471)

The remote Fedora 45 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-c213ad9471 advisory. Update to upstream bz2453492 checkicmp: host-count overflow leads to heap buffer overflow bz2513957 Update 0012-fix-perl-ntp-ipv6.patch to allow uppercase...

-INE_Shivam_Gupta_23104003

CVE-2021-43798 — Лаборатория неаутентифицированного обхода пути в Grafana Только для образовательных целей. Запускайте эту лабораторию только на изолированной локальной машине. Никогда не выставляйте её в интернет. Сводка по CVE Поле| Детали ---|--- CVE ID| CVE-2021-43798 Продукт| Grafana Уязвимы...

Grafana-CVE-2021-43798

Grafana-CVE-2021-43798 Grafana File-Read Затрагиваемые версии: 8.0.0-lastest Poc-http-get /public/plugins/plugins-lst/../../../../../../../../filename Список плагинов по умолчанию alertlist annolist grafana-azure-monitor-datasource barchart bargauge cloudwatch dashlist elasticsearch gauge geomap...

wordpress-hacking

Взлом WordPress Некоторые полезные ресурсы для взлома WordPress, а также его плагинов и тем. Bug Bounty Если вы увлечены поиском и сообщением об уязвимостях WordPress, рассмотрите возможность участия в этих программах bug bounty: Wordfence и Patchstack. Регистрация по моей ссылке Wordfence даёт м...

Grafxploit

Outil d'exploitation automatisé pour Grafana CVE-2021-43798 Présentation Ce projet est un outil d'exploitation automatisé conçu pour scanner et extraire des informations sensibles à partir d'instances Grafana compromises vulnérables à CVE-2021-43798. L'outil identifie les plugins vulnérables et...

CVE-2021-43798

CVE-2021-43798 Версии Grafana с 8.0.0-beta1 по 8.3.0 кроме исправленных версий уязвимы для обхода каталогов, что позволяет получить доступ к локальным файлам. Grafana — это платформа с открытым исходным кодом для мониторинга и наблюдаемости. Версии Grafana с 8.0.0-beta1 по 8.3.0 кроме исправленны...

Atlassian Crowd and Crowd Data Center - Unauthenticated Remote Code Execution

Atlassian Crowd and Crowd Data Center is susceptible to a remote code execution vulnerability because the pdkinstall development plugin is incorrectly enabled in release builds. Attackers who can send unauthenticated or authenticated requests to a Crowd or Crowd Data Center instance can exploit...

[SECURITY] Fedora 45 Update: nagios-plugins-openmanage-3.7.12-29.fc45

checkopenmanage is a plugin for Nagios which checks the hardware health of Dell servers running OpenManage Server Administrator OMSA. The plugin can be used remotely with SNMP or locally with NRPE, checkbyssh or similar, whichever suits your needs and particular taste. The plugin checks the healt...