1667 matches found
CVE-2026-41900-POC
OpenLearnX-RCE OpenLearnX Unauthenticated RCE via Container Volume Mount Diff-based discovery → Silent patch → Sandbox escape → Full /tmp disclosure Property| Value ---|--- Name| OpenLearnX-RCE CVE| CVE-2026-41900 GHSA| GHSA-8h25-q488-4hxw Type| Unauthenticated Info Disclosure / RCE Affected|...
google-osconfig-privesc
Summary The googleosconfigagent process is a component GoogleCloudPlatform https://github.com/GoogleCloudPlatform/osconfig tooling, running on each VM by default. The agent is running as root and responsible for some user-controllable services, including OS config...
CVE-2026-126417
OpenEMR before 8.5.0 contains an access control flaw in getclaimfile.php: with location=tmp, it serves any file in the shared temporary directory without verifying the file is a claim for the caller. Users with acct/eob or acct/bill write access can request key=ccda.xml to download the most...
CVE-2026-48907
JCE — unauthenticated file upload via profiles.import Overview Joomla Content Editor JCE exposes a profile import task at /index.php?option=comjce&task=profiles.import that accepts an uploaded file and writes it to disk without validating the filename extension against the profile format allowlis...
Langflow < 1.9.0 - Remote Code Execution
Langflow versions prior to 1.9.0 are vulnerable to unauthenticated remote code execution RCE via the buildpublictmp endpoint. Attackers can submit a manipulated flow JSON containing Python code that is executed during the build process without proper sandboxing. id: CVE-2026-33017 info: name:...
CVE-2026-123039 Local privilege escalation to root in the DynamicCLI daemon via local world-writable control socket
The Gaia OS DynamicCLI daemon runs as root and listens on a world-writable local socket /tmp/dynamicsocket without authenticating connecting processes. An authenticated local user can send a command to the socket and have it executed as root...
CVE-2026-21002-Serverless-Cold-Start-Credential-Leakage-via-Reused-tmp
CVE-2026-21002 – Serverless Cold Start Credential Leakage via Reused /tmp Program Code Python AWS Lambda sim lambdafuncsim.py - Simulated serverless function import os, tempfile, time SECRETFILE = '/tmp/credentials' reused across warm starts def handlerevent: On first invocation, write a secret i...
ChromeSHELFLoader
Chrome SHELF Loader An exploit for CVE-2020-6418 implementing a SHELF Loader. Published as part of Tmp.0ut volume 2...
cve-2022-21658
CVE-2022-21658 poc Make sure the use the Rust 1.58.0 version. First run: while :; do mkdir /tmp/legit; rm -r /tmp/legit; ln -s /tmp/sensitive /tmp/legit; done Then: cargo run...
CVE-2026-48907
CVE-2026-48907 Educational PoC ⚠️ This repository is for educational and defensive security purposes only. Test only on systems you own or are explicitly authorized to assess. Do not use this project against third-party systems. This PoC demonstrates CVE-2026-48907, an unauthenticated RCE...
Linux Distros Unpatched Vulnerability : CVE-2026-123974
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In all versions of PyTorch's TorchServe, a predictable extraction directory in /tmp lets a local user swap the model handler and run code as the TorchServe...
DEBIAN-CVE-2026-123974
In all versions of PyTorch's TorchServe, a predictable extraction directory in /tmp lets a local user swap the model handler and run code as the TorchServe service account leading to local privilege escalation...
CVE-2026-123974
In all versions of PyTorch's TorchServe, a predictable extraction directory in /tmp lets a local user swap the model handler and run code as the TorchServe service account leading to local privilege escalation...
EUVD-2026-118480
In all versions of PyTorch's TorchServe, a predictable extraction directory in /tmp lets a local user swap the model handler and run code as the TorchServe service account leading to local privilege escalation...
CVE-2026-123974
All versions of PyTorch's TorchServe are affected by a local privilege escalation vulnerability (CWE-379). The root cause is a predictable extraction directory in /tmp, which allows a local user to swap the model handler . This enables the attacker to execute arbitrary code as the TorchServe serv...
CVE-2026-123974 pytorch/serve: Local privilege escalation through insecure temporary path
In all versions of PyTorch's TorchServe, a predictable extraction directory in /tmp lets a local user swap the model handler and run code as the TorchServe service account leading to local privilege escalation...
CVE-2026-85068 NUT blazer_usb ippon_command stack info-leak via unzeroed char tmp[64] in OUT-direction usb_control_msg
Network UPS Tools is a collection of programs which provide a common interface for monitoring and administering UPS, PDU and SCD hardware. From 2.4.2 through 2.8.5, ipponcommand in drivers/blazerusb.c partially initializes char tmp64 with a short Megatec status query and then passes a fixed...
CVE-2026-121549
nnn through 5.3 contains an insecure temporary file vulnerability in the pdfread and nuke plugins that allows local attackers to overwrite files by exploiting predictable paths in /tmp. Attackers can pre-create a symlink at the name-derived or PID-derived path so the victim's plugin truncates and...
CVE-2026-121550 nnn through 5.3 Symlink-Following Write via NNN_FIFO Handling
nnn through 5.3 contains an insecure file handling vulnerability that allows local attackers to redirect writes because main accepts an existing NNNFIFO path without verifying it is a FIFO. Attackers can pre-create the documented predictable /tmp/nnn.fifo path as a symlink or readable regular fil...
CVE-2026-121549 nnn through 5.3 Insecure Temporary File Symlink Overwrite via pdfread and nuke Plugins
nnn through 5.3 contains an insecure temporary file vulnerability in the pdfread and nuke plugins that allows local attackers to overwrite files by exploiting predictable paths in /tmp. Attackers can pre-create a symlink at the name-derived or PID-derived path so the victim's plugin truncates and...