CVE-2026-20321

A vulnerability in the web-based management API for Cisco Application Policy Infrastructure Controller APIC could allow an authenticated, remote attacker to execute arbitrary commands as the root user. To exploit this vulnerability, the attacker must have valid administrative credentials. This...

CVE-2026-20032

A vulnerability in the Python interpreter of Cisco NX-OS Software could allow an authenticated, local attacker with low privileges to escape the Python sandbox and gain unauthorized access to the underlying operating system of an affected device. This vulnerability is due to insufficient validati...

CVE-2024-50804

CVE-2024-50804 Writeup 可以在下面的博客中找到。 谢谢！ https://g3tsyst3m.github.io/cve/msi/Arbitrary-Write-Privilege-Escalation-CVE-2024-50804/...

CVE-2019-7609

CVE-2019-7609 Kibana versions before 5.6.15 and 6.6.1 contain an arbitrary code execution flaw in the Timelion visualizer https://nvd.nist.gov/vuln/detail/CVE-2019-7609 CVE-2019-7609 该漏洞是 Kibana 中发现的 Prototype Pollution 漏洞。利用此漏洞可能导致 DoS 或 RCE 攻击。 特点 添加了 Node 提供的 debugging 选项。 可通过 Chrome://inspect...

CVE-2021-40978

CVE-2021-40978 mkdocs 内置开发服务器目录遍历漏洞利用 Mkdocs 1.2.2 允许通过内置的开发服务器（在 8000 端口上响应）进行目录遍历。 以下是一些成功利用路径的示例： 影响 利用此技术可以获取根目录之外的文件，使任何人能够读取和下载任意文件。 请求： 响应： 概念验证 Nuclei 模板：https://github.com/projectdiscovery/nuclei-templates/blob/master/cves/2021/CVE-2021-40978.yaml curl...

CVE-2021-44967

CVE-2021-44967 - 已认证（特权）远程代码执行 LimeSurvey 5.2.4 版本中存在已认证（特权）远程命令执行漏洞，远程用户可通过上传和安装插件上传任意 PHP 代码文件。 使用方法 python3 exploit.py --url --user --password --lhost --lport 超级管理员用户可以通过 LimeSurvey 管理面板加载插件模块。该脚本在本地创建文件、压缩并上传它们。随后，脚本会调用安装、激活和运行模块的操作，从而执行反向 Shell。...

GHSA-P75X-JH7P-PPCX Backstage: Bypass of MkDocs configuration sanitizer in TechDocs backend

Impact Users with the ability to commit changes to a repository that uses TechDocs can circumvent the MkDocs configuration file sanitizer introduced in response to CVE-2026-25153 and execute arbitrary code on the TechDocs backend host during documentation generation. Patches Patched...

EUVD-2026-94070

Backstage: Bypass of MkDocs configuration sanitizer in TechDocs backend...

Backstage: Improper validation of MkDocs theme configuration in TechDocs

Impact When TechDocs is configured to build documentation locally or in a container, a user with write access to a registered repository can include configuration values in mkdocs.yml that cause arbitrary code execution during the documentation build process. Patches Patched in...

EUVD-2026-94074

Backstage: Improper validation of MkDocs theme configuration in TechDocs...

GHSA-8W7Q-29MW-GF5C Backstage: Improper validation of MkDocs theme configuration in TechDocs

Impact When TechDocs is configured to build documentation locally or in a container, a user with write access to a registered repository can include configuration values in mkdocs.yml that cause arbitrary code execution during the documentation build process. Patches Patched in...

DEBIAN-CVE-2026-92415

— Use of Externally-Controlled Input to Select Classes or Code vulnerability in Apache Jackrabbit's WebDAV/Davex client. A malicious WebDAV/DavEx server, or an attacker able to intercept the connection, can cause the client to instantiate arbitrary classes from its classpath, which can lead to...

CVE-2026-92415

— Use of Externally-Controlled Input to Select Classes or Code vulnerability in Apache Jackrabbit's WebDAV/Davex client. A malicious WebDAV/DavEx server, or an attacker able to intercept the connection, can cause the client to instantiate arbitrary classes from its classpath, which can lead to...

EUVD-2026-94474

A vulnerability in the Segment Routing over IPv6 SRv6 Operation, Administration, and Maintenance OAM feature of Cisco NX-OS Software, known as NGOAM, could allow an unauthenticated, remote attacker to execute arbitrary code with root privileges or cause a denial of service DoS on an affected...

EUVD-2026-94467

A vulnerability in the VXLAN Operation, Administration, and Maintenance OAM feature of Cisco NX-OS Software, known as NGOAM, could allow an unauthenticated, remote attacker to execute arbitrary code with root privileges or cause a Denial-of-Service DoS on an affected device. This vulnerability is...

NPM: Flowise NodeVM sandbox escape via puppeteer allowlist - authenticated RCE and arbitrary file read via Chromium

authenticated RCE and arbitrary file read via Chromium vulnerability discovered by ? in WordPress Npm flowise versions = 3.1.2...

NPM: Flowise NodeVM sandbox escape via puppeteer allowlist - authenticated RCE and arbitrary file read via Chromium

authenticated RCE and arbitrary file read via Chromium vulnerability discovered by ? in WordPress Npm flowise-components versions = 3.1.2...

GHSA-9GVV-QJJ3-2P6G Flowise NodeVM sandbox escape via puppeteer allowlist - authenticated RCE and arbitrary file read via Chromium

Flowise packages flowise and flowise-components in versions = 3.1.2 contain a sandbox escape in the vm2/@flowiseai/nodevm JavaScript sandbox. An authenticated user with access to the /api/v1/node-custom-function endpoint can escape the sandbox by supplying attacker-controlled executablePath and...

Flowise NodeVM sandbox escape via puppeteer allowlist - authenticated RCE and arbitrary file read via Chromium

Flowise packages flowise and flowise-components in versions = 3.1.2 contain a sandbox escape in the vm2/@flowiseai/nodevm JavaScript sandbox. An authenticated user with access to the /api/v1/node-custom-function endpoint can escape the sandbox by supplying attacker-controlled executablePath and...

CVE-2021-43798

CVE-2021-43798 Grafana - 目录遍历与任意文件读取 https://vulners.com/cve/CVE-2021-43798 https://grafana.com/blog/2021/12/08/an-update-on-0day-cve-2021-43798-grafana-directory-traversal/ 示例 python3 exploit.py http://127.0.0.1:3000 /etc/passwd python3 exploit.py http://127.0.0.1:3000 /appdata.db --output...