CVE-2026-48907

CVE-2026-48907 Educational PoC ⚠️ This repository is for educational and defensive security purposes only. Test only on systems you own or are explicitly authorized to assess. Do not use this project against third-party systems. This PoC demonstrates CVE-2026-48907, an unauthenticated RCE...

google-osconfig-privesc

Summary The googleosconfigagent process is a component GoogleCloudPlatform https://github.com/GoogleCloudPlatform/osconfig tooling, running on each VM by default. The agent is running as root and responsible for some user-controllable services, including OS config...

CVE-2026-48907

JCE — unauthenticated file upload via profiles.import Overview Joomla Content Editor JCE exposes a profile import task at /index.php?option=comjce&task=profiles.import that accepts an uploaded file and writes it to disk without validating the filename extension against the profile format allowlis...

cve-2022-21658

CVE-2022-21658 poc Make sure the use the Rust 1.58.0 version. First run: while :; do mkdir /tmp/legit; rm -r /tmp/legit; ln -s /tmp/sensitive /tmp/legit; done Then: cargo run...

CVE-2026-105606

Joomla Extension - joomlaboat.com - Unauthenticated arbitrary file upload in Custom Tables 3.7.8 - An unauthenticated attacker can upload a polyglot file with an attacker-controlled extension to the web-accessible tmp directory of any Joomla site that exposes a public Custom Tables submission for...

CVE-2026-105606 Joomla Extension - joomlaboat.com - Unauthenticated arbitrary file upload in Custom Tables < 3.7.8

Joomla Extension - joomlaboat.com - Unauthenticated arbitrary file upload in Custom Tables 3.7.8 - An unauthenticated attacker can upload a polyglot file with an attacker-controlled extension to the web-accessible tmp directory of any Joomla site that exposes a public Custom Tables submission for...

CVE-2026-105606

The Joomla Extension - joomlaboat.com (versions prior to 3.7.8 ) is vulnerable to an unauthenticated arbitrary file upload in the Custom Tables component. An attacker can upload a polyglot file with a controlled extension to a web-accessible tmp directory via a public submission form, as the stor...

CVE-2026-105606 Joomla Extension - joomlaboat.com - Unauthenticated arbitrary file upload in Custom Tables < 3.7.8

Joomla Extension - joomlaboat.com - Unauthenticated arbitrary file upload in Custom Tables 3.7.8 - An unauthenticated attacker can upload a polyglot file with an attacker-controlled extension to the web-accessible tmp directory of any Joomla site that exposes a public Custom Tables submission for...

PT-2026-135637

Name of the Vulnerable Software and Affected Versions Custom Tables versions prior to 3.7.8 Description An unauthenticated attacker can upload a polyglot file with a controlled extension to the web-accessible tmp directory of a Joomla site that exposes a public Custom Tables submission form. A...

CVE-2026-105606: joomlaboat.com Custom Tables extension for Joomla: Joomla Extension - joomlaboat.com - Unauthenticated arbitrary file upload in Custom Tables < 3.7.8 - An unauthenticated…

Joomla Extension - joomlaboat.com - Unauthenticated arbitrary file upload in Custom Tables 3.7.8 - An unauthenticated attacker can upload a polyglot file with an attacker-controlled extension to the web-accessible tmp directory of any Joomla site that exposes a public Custom Tables submission for...

CVE-2026-103404: Juniper Networks Session Smart Conductor: An Incorrect Permission Assignment for Critical Resource vulnerability in RoutingManager in Juniper Networks Session…

An Incorrect Permission Assignment for Critical Resource vulnerability in RoutingManager in Juniper Networks Session Smart Conductor allows a local user to access sensitive routing credentials via triggering processes that write to the /tmp directory...

Vulnerability related to permission and access control issues in Juniper Networks Session Smart Conductor

Versions prior to Juniper Networks Session Smart Conductor 7.0.5, versions 7.1.0 through 7.1.7, and versions 7.2.0 through 7.2.3 contain a privilege escalation and access control vulnerability. This vulnerability stems from improper permission allocation for critical resources within...

EUVD-2026-97970

Code for IBM i is a Visual Studio Code extension for maintaining and compiling ILE languages on the IBMi platform. Prior to 3.0.1, src/ui/views/objectBrowser.ts stores Object Browser downloads and the edit-save flow content in the shared /tmp directory without reliable cleanup. On systems where...

CVE-2026-49484 Code for IBM i: Temporary files are visible to all users

Code for IBM i is a Visual Studio Code extension for maintaining and compiling ILE languages on the IBMi platform. Prior to 3.0.1, src/ui/views/objectBrowser.ts stores Object Browser downloads and the edit-save flow content in the shared /tmp directory without reliable cleanup. On systems where...

CVE-2026-49484

The Code for IBM i Visual Studio Code extension (prior to version 3.0.1 ) contains a vulnerability in src/ui/views/objectBrowser.ts. The component stores Object Browser downloads and edit-save flow content in the shared /tmp directory without reliable cleanup, which may allow other local accounts...

Rocky Linux 8 [CIQ] Security Update: socat / socat-debuginfo / socat-debugsource (crlsa-2025_11042)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202511042 advisory. socat: arbitrary file overwrite via predictable /tmp directory CVE-2024-54661 Tenable has extracted the preceding description block directly from the CIQ security...

Rocky Linux 9 [CIQ] Security Update: socat / socat-debuginfo / socat-debugsource (crlsa-2025_10353)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202510353 advisory. socat: arbitrary file overwrite via predictable /tmp directory CVE-2024-54661 Tenable has extracted the preceding description block directly from the CIQ security...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: git (UTSA-2026-054036)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-054036 advisory. Git is a distributed revision control system. Git prior to versions 2.37.1, 2.36.2, 2.35.4, 2.34.4, 2.33.4, 2.32.3, 2.31.4, and 2.30.5, is vulnerable to privilege...

CVE-2026-88623

NUUO Network Video Recorder 2.0.0 is vulnerable to arbitrary file read. In up.php, the url parameter submitted by the user via POST is received, and fopen is used to open the URL in binary read-only mode. The content is then written to the /tmp/ directory, with the filename derived from basename ...

Astra Linux – Vulnerability in Thunderbird

By creating a malformed file name for an attachment in a multipart message, an attacker can trick Thunderbird into including a directory listing of /tmp when the message is forwarded or edited as a new message. This vulnerability could allow attackers to disclose sensitive information from the...