EUVD-2026-64849

The official Flair wheels for 0.15.0 and 0.15.1 still contain flair/models/clustering.py, whose ClusteringModel.load static method returns pickle.loadsjoblib.loadstrmodelfile and so executes arbitrary Python while loading a model file. Loading a model supplied by an attacker therefore runs that...

EUVD-2026-64847

Xinference loads models with Hugging Face remote code execution unconditionally enabled, and before version 2.12.0 exposes no setting to disable it. Six loader call sites pass trustremotecode=True as a literal or as an unconditional default: RerankModel.gettokenizer in...

CVE-2026-76841 Xinference through 2.11.0 Remote Code Execution via Hardcoded trust_remote_code in Model Loaders

Xinference loads models with Hugging Face remote code execution unconditionally enabled, and before version 2.12.0 exposes no setting to disable it. Six loader call sites pass trustremotecode=True as a literal or as an unconditional default: RerankModel.gettokenizer in...

CVE-2026-76841

Xinference (by XorbitsAI) through version 2.11.0 unconditionally sets trust_remote_code=True at six model loader call sites spanning the rerank, embedding, and LLM modules. An attacker with model launch access can register a model with an unknown type and an arbitrary path, causing AutoTokenizer....

CVE-2026-76841 Xinference through 2.11.0 Remote Code Execution via Hardcoded trust_remote_code in Model Loaders

Xinference loads models with Hugging Face remote code execution unconditionally enabled, and before version 2.12.0 exposes no setting to disable it. Six loader call sites pass trustremotecode=True as a literal or as an unconditional default: RerankModel.gettokenizer in...

CVE-2024-42327_Zabbix_SQLi

🛡️ Script de Exploração de Injeção SQL no Zabbix 7.0.0 Um script em Python para explorar uma vulnerabilidade de injeção SQL autenticada no Zabbix 7.0.0 , suportando múltiplos modos de ação, incluindo extração de dados de usuários, vazamento de tokens de sessão, execução remota de comandos RCE e...

cve-2024-6387-poc

cve-2024-6387-poc eine Signal-Handler-Race-Condition im OpenSSH-Server sshd 7etsuo Beschreibung Ein Exploit für CVE-2024-6387, der eine Signal-Handler-Race-Condition im OpenSSH-Server sshd auf glibc-basierten Linux-Systemen ausnutzt. Die Schwachstelle ermöglicht eine Remote-Code-Ausführung als...

Apache-APISIX-CVE-2022-24112

Exploit dell'esecuzione di codice remota di Apache APISIX CVE-2022-24112 Riepilogo Un attaccante può abusare del plugin batch-requests per inviare richieste al fine di aggirare la restrizione IP dell'Admin API. Una configurazione predefinita di Apache APISIX con chiave API predefinita è vulnerabi...

react2shell-interactive

React2Shell - CVE-2025-55182 PoC Interattivo Shell interattivo per sfruttare CVE-2025-55182, una vulnerabilità di Remote Code Execution nei React Server Components. Disclaimer Questo strumento è fornito esclusivamente per scopi EDUCATIVI e di TEST DI SICUREZZA AUTORIZZATI. Usalo solo su sistemi d...

ROOT-APP-MAVEN-CVE-2019-16335 CVE-2019-16335 in com.fasterxml.jackson.core:jackson-databind - Patched by Root

Root has patched CVE-2019-16335 in the com.fasterxml.jackson.core:jackson-databind package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2018-19362 CVE-2018-19362 in com.fasterxml.jackson.core:jackson-databind - Patched by Root

Root has patched CVE-2018-19362 in the com.fasterxml.jackson.core:jackson-databind package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2020-24750 CVE-2020-24750 in com.fasterxml.jackson.core:jackson-databind - Patched by Root

Root has patched CVE-2020-24750 in the com.fasterxml.jackson.core:jackson-databind package for Root:Maven. Multiple fixed versions available...

CVE-2023-4220

Prova de conceito do exploit para CVE-2023-4220 Produto afetado : Chamilo = 1.11.24 Este CVE explora uma vulnerabilidade de upload de arquivo não autenticado no Chamilo 1.11.24 e versões inferiores. Um atacante tem a capacidade de enviar arquivos PHP sem restrições, levando a RCE. Como usar...

CVE-2026-48908-Joomla-SP-Page-Builder-RCE

🛡️ Analisi di CVE-2026-48908 Caricamento Arbitrario di File non Autenticato verso RCE in JoomShaper SP Page Builder -critical?style=for-the-badge&logo=alert -black?style=for-the-badge&logo=github Una completa analisi tecnica di una vulnerabilità di esecuzione remota di codice non autenticata. 📌...

CVE-2025-49132

Impatto Utilizzando il file /locales/locale.json con i parametri di query locale e namespace, un attore malintenzionato è in grado di eseguire codice arbitrario, senza essere autenticato. Con la possibilità di eseguire codice arbitrario, questa vulnerabilità può essere sfruttata in un numero...

CVE-2025-47812-poc

CVE-2025-47812 Exploit di Remote Code Execution RCE per Wing FTP Server CVE-2025-47812 📌 Crediti : Vulnerabilità scoperta da Julien @MrTuxracer. Questa implementazione del PoC si basa sulla loro ricerca originale. Questo repository contiene un exploit Python per la vulnerabilità di Remote Code...

Remote-Code-Execution-CVE-2024-28397-pyload-ng-js2py-

रिमोट कोड एक्ज़ीक्यूशन – CVE-2024-28397 pyload-ng / js2py इस रिपॉज़िटरी में CVE-2024-28397 के लिए एक प्रूफ-ऑफ-कॉन्सेप्ट PoC एक्सप्लॉइट है, जो pyload-ng को प्रभावित करने वाली एक रिमोट कोड एक्ज़ीक्यूशन भेद्यता है, जो js2py के असुरक्षित उपयोग के कारण होती है। अस्वीकरण: यह PoC केवल शैक्षिक और शोध...

wp2shell-Wordpress-TOWN

wp2shell di : lucifer0xf Esecuzione remota di codice non autenticata per il POC del core di WordPress CVE-2026-63030 + CVE-2026-60137 wp2shell exploit per la catena di vulnerabilità critiche nel core di WordPress. Combina un bug di confusione delle route batch dell'API REST con un'iniezione SQL i...

RLSA-2026:58561 Important: python-urwid security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fixes:...

python-urwid security update

An update is available for python-urwid. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Python is an interpreted, interactive, object-oriented programming...