CVE-2026-85172 n8n before 2.34.1 SSRF via Request Helper URI Validation Bypass

n8n versions before 2.34.1 contain a server-side request forgery vulnerability in the legacy request helper function exposed to Code and Function nodes. The validation logic checks the uri property for SSRF safety while the underlying HTTP client uses the url property when both are present,...

CVE-2026-85172

n8n versions before 2.34.1 contain a server-side request forgery (SSRF) vulnerability in the legacy request helper function exposed to Code and Function nodes. The root cause is a mismatch between validation and execution: the SSRF check inspects the uri property, while the underlying HTTP client...

CVE-2026-14678

A flaw was found in PostgreSQL. A buffer over-read vulnerability exists in the pgtrgm index picksplit function, which reads past the end of a heap buffer. This could allow a table maintainer to infer limited memory values by observing index split choices, leading to information disclosure...

cve-2025-12735-expr-eval-rce

CVE-2025-12735 expr-eval RCE Exploit Инструмент для исследования безопасности, предназначенный для обнаружения и проверки уязвимости CVE-2025-12735 в пакетах npm expr-eval и expr-eval-fork. ⚠️ Отказ от ответственности Этот инструмент предназначен только для авторизованного тестирования безопасност...

EUVD-2026-70284

A vulnerability was determined in simular-ai Agent-S up to 0.3.2. Affected by this vulnerability is the function ImageData of the file guiagents/s1/utils/ocrserver.py of the component OCR HTTP API. Executing a manipulation of the argument imgbytes can lead to resource consumption. The attack may ...

net/mail: golang: net/mail: Denial of Service via pathological email address parsing

A flaw was found in the net/mail package within the Go standard library. A remote attacker could provide specially crafted, pathological email addresses. When these malformed email addresses are parsed by the consumePhrase function, it can lead to excessive resource consumption due to quadratic...

net/mail: golang: Go net/mail: Denial of Service via crafted email inputs

A flaw was found in the net/mail package of the Go programming language. An attacker could provide specially crafted inputs to the ParseAddress, ParseAddressList, or ParseDate functions. This could lead to excessive consumption of CPU and memory resources, resulting in a Denial of Service DoS for...

CVE-2026-8838-RCE

CVE-2026-8838 — Amazon Redshift Python Driver: удалённое выполнение кода через eval ⚠️ Только в образовательных целях Исследовательский и демонстрационный проект в области наступательной кибербезопасности, созданный исключительно в образовательных и просветительских целях. Любое использование на...

fnprint

fnprint matches functions in binaries by what they do , not by what their bytes or control-flow graphs look like. it runs each function in a tiny emulator with made-up inputs, records the side effects it produces, and hashes that behavior into a fingerprint. two functions that behave the same get...

CVE-2026-85040 ZhongBangKeJi CRMEB Custom Scheduled Task Feature save eval os command injection

A weakness has been identified in ZhongBangKeJi CRMEB up to 6.0.0. Affected by this vulnerability is the function eval of the file /adminapi/system/crontab/save of the component Custom Scheduled Task Feature. This manipulation of the argument customCode causes os command injection. It is possible...

EUVD-2026-70314

A weakness has been identified in ZhongBangKeJi CRMEB up to 6.0.0. Affected by this vulnerability is the function eval of the file /adminapi/system/crontab/save of the component Custom Scheduled Task Feature. This manipulation of the argument customCode causes os command injection. It is possible...

CVE-2026-85040

ZhongBangKeJi CRMEB (up to 6.0.0 ) is vulnerable to OS command injection in the Custom Scheduled Task feature. The eval function in /adminapi/system/crontab/save unsafely processes the customCode argument, allowing remote attackers to inject operating-system commands. The vendor documents this as...

CVE-2026-32746

🚨 CVE-2026-32746 GNU Inetutils Telnetd RCE 🔥 📌 Резюме Критическая уязвимость | CVSS 9.8 | Удалённое выполнение кода! Затрагивает: GNU Inetutils Telnetd версии до 2.7 Тип: OOB Write в обработчике подопций LINEMODE SLC Вектор атаки: Сеть порт 23 | Аутентификация не требуется Воздействие: RCE с...

cve-2026-33937

CVE-2026-33937 - Handlebars RCE 익스플로잇 PoC 설명 CVE-2026-33937은 Handlebars에서 ASTAbstract Syntax Tree 입력을 안전하지 않게 처리하여 발생하는 치명적인 원격 코드 실행RCE 취약점입니다. 이 취약점은 공격자가 Handlebars.compile에 조작된 AST 객체를 제공하여 임의의 JavaScript 코드를 주입할 수 있게 합니다. 근본 원인 Handlebars.compile은 다음 두 가지를 모두 허용합니다: 템플릿 문자열 사전 파싱된 AST 객체 AST...

CVE-2025-58789

Sink: getOrderParameters 関数は、$orderBy 変数と $order 変数において SQL インジェクションの脆弱性を引き起こします。 PoC...

CVE-2021-4034

CVE-2021-4034 CVE-2021-4034 centos8 호환 버전 기반으로 수정됨 https://github.com/berdav/CVE-2021-4034/tree/main/dry-run 사용 방법 pwnkit-dry-run.c에서 system 함수를 수정하여 사용자 정의 실행 명령을 실행합니다 기본값은 r00t 사용자 추가, 비밀번호는 XHSZWCPU6Nvobe make로 컴파일 대상 머신에 업로드하여 실행...

PP_CVE-2024-38998

PPCVE-2024-38998 CVE-2024-38998 취약점이 JavaScript 모듈 requirejs 버전 2.3.6에서 확인되었습니다. 이 취약점은 config 함수의 프로토타입 오염prototype pollution을 악용하여, 공격자가 악의적인 입력으로 Object.prototype을 수정할 수 있게 합니다. 이로 인해 DoS, 원격 코드 실행RCE 또는 XSS가 발생할 수 있습니다. 심각도는 치명적CVSS 9.8입니다. 프로토타입 오염Prototype Pollution...

SneeitScanner-CVE-2025-6389

SneeitScanner-CVE-2025-6389 SneeitScanner - PoC и Сканер для неаутентифицированного RCE в Sneeit Framework CVE-2025-6389 ⚡ SneeitScanner ⚡ Доказательство концепции PoC и автоматизированный сканер для неаутентифицированного RCE в Sneeit Framework CVE-2025-6389 Этот надежный скрипт Python является...

voidmap

voidmap Очень простой ручной маппер драйверов, использующий CVE-2021-40449 для выполнения произвольной функции по заданному адресу с одним переданным аргументом. Основан на эксплойт-PoC CallbackHell. Протестировано на Windows 10 Pro For Workstations 1809 17763.379 64-bit, но, скорее всего, будет...

CVE-2024-33298

CVE-2024-33298 Уязвимость межсайтового скриптинга XSS с сохранением в Microweber = 2.0.9 Краткое описание: Уязвимость межсайтового скриптинга XSS с сохранением в Microweber v.2.0.9 позволяет удалённому злоумышленнику выполнить произвольный код через функцию создания новой резервной копии в конечн...