CVE-2023-25581

This Python script demonstrates the exploitation of the CVE-2023-25581 vulnerability in pac4j-core. The vulnerability allows an attacker to execute arbitrary code RCE by deserializing maliciously crafted Base64-encoded data. Prerequisites Before running the script, make sure you have the followin...

CVE-2021-31800-Impacket-SMB-Server-Arbitrary-file-read-write

CVE-2021-31800 - Impacket SMB Server Arbitrary file read/write CVSS Vector : CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H CVSS Score : 9.9 Critical Description A path traversal in smbserver.py allows an attacker to read/write arbitrary files on the server. Detailed explanation of this issue:...

USN-8894-1: poppler vulnerabilities

It was discovered that Poppler had an integer overflow in FoFiTrueType::cvtSfnts. An attacker could possibly use this issue to cause Poppler to crash, resulting in a denial of service, or execute arbitrary code. CVE-2026-102620 It was discovered that Poppler had an integer overflow in...

CVE-2026-54520

CVE-2026-54520 ai-agent-automation workflow file step path traversal allowed read/write outside the expected directory. Primary advisory: GHSA-cm8g-8jfq-887p Researcher credit: @chaitanyagarware At a Glance Field| Value ---|--- CVE| CVE-2026-54520 GHSA| GHSA-cm8g-8jfq-887p Project|...

EUVD-2026-94321

A path traversal vulnerability exists in the unziphttp RemoteZipFile extract functionality of VisiData versions: dev commit 38b21f78. A specially crafted .zip file can lead to arbitrary file write. An attacker can provide a crafted URL to trigger this vulnerability...

CVE-2026-41958

A path traversal vulnerability exists in the unzip_http RemoteZipFile extract functionality of VisiData (version: dev (commit 38b21f78)). By providing a crafted URL to trigger the functionality, an attacker can use a specially crafted .zip file to achieve arbitrary file write . No specific remedi...

CVE-2026-41958

A path traversal vulnerability exists in the unziphttp RemoteZipFile extract functionality of VisiData versions: dev commit 38b21f78. A specially crafted .zip file can lead to arbitrary file write. An attacker can provide a crafted URL to trigger this vulnerability...

CVE-2026-41958

A path traversal vulnerability exists in the unziphttp RemoteZipFile extract functionality of VisiData versions: dev commit 38b21f78. A specially crafted .zip file can lead to arbitrary file write. An attacker can provide a crafted URL to trigger this vulnerability...

CVE-2026-42532

A path traversal vulnerability exists in the EmailSheet extractparts functionality of VisiData versions: dev commit 38b21f78. A specially crafted .eml file can lead to arbitrary file write. An attacker can provide a malicious file to trigger this vulnerability...

CVE-2026-42532

A path traversal vulnerability exists in the EmailSheet extract_parts functionality of VisiData (version: dev (commit 38b21f78)). By providing a specially crafted .eml file , an attacker can trigger this vulnerability to achieve arbitrary file write . The provided documents do not include specifi...

CVE-2026-42532

A path traversal vulnerability exists in the EmailSheet extractparts functionality of VisiData versions: dev commit 38b21f78. A specially crafted .eml file can lead to arbitrary file write. An attacker can provide a malicious file to trigger this vulnerability...

EUVD-2026-94320

A path traversal vulnerability exists in the EmailSheet extractparts functionality of VisiData versions: dev commit 38b21f78. A specially crafted .eml file can lead to arbitrary file write. An attacker can provide a malicious file to trigger this vulnerability...

CVE-2026-103435 Arbitrary File Write via Write-Time Symlink Following (TOCTOU) in Claude Code

Claude Code validated that a target file path resided within the project working directory at permission-check time, but re-resolved the path at write time without repeating that validation. This time-of-check to time-of-use TOCTOU gap allowed an attacker who could write to the workspace to...

EUVD-2026-94319

Claude Code validated that a target file path resided within the project working directory at permission-check time, but re-resolved the path at write time without repeating that validation. This time-of-check to time-of-use TOCTOU gap allowed an attacker who could write to the workspace to...

CVE-2026-103435

Claude Code is vulnerable to an arbitrary file write due to a time-of-check to time-of-use (TOCTOU) race condition. The software validates that a target file path is within the project working directory during permission checks but re-resolves the path at write time without re-validation. An atta...

CVE-2026-103435 Arbitrary File Write via Write-Time Symlink Following (TOCTOU) in Claude Code

Claude Code validated that a target file path resided within the project working directory at permission-check time, but re-resolved the path at write time without repeating that validation. This time-of-check to time-of-use TOCTOU gap allowed an attacker who could write to the workspace to...

CVE-2026-103435 Arbitrary File Write via Write-Time Symlink Following (TOCTOU) in Claude Code

Claude Code validated that a target file path resided within the project working directory at permission-check time, but re-resolved the path at write time without repeating that validation. This time-of-check to time-of-use TOCTOU gap allowed an attacker who could write to the workspace to...

Exploit for CVE-2026-81780

CVE-2026-81780 — Hash Form ≤ 1.4.2 Unauthenticated RCE !CVE...

CVE-2026-104848

A flaw was found in tinypool. When an attacker is able to modify base JavaScript object properties prototype pollution, tinypool inadvertently copies these inherited configuration values into newly spawned worker threads. An attacker can exploit this behavior by injecting malicious startup...

Important: Red Hat Security Advisory: vim security update

An update for vim is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the C...