CVE-2026-42532

A path traversal vulnerability exists in the EmailSheet extract_parts functionality of VisiData (version: dev (commit 38b21f78)). By providing a specially crafted .eml file , an attacker can trigger this vulnerability to achieve arbitrary file write . The provided documents do not include specifi...

CVE-2026-42532

A path traversal vulnerability exists in the EmailSheet extractparts functionality of VisiData versions: dev commit 38b21f78. A specially crafted .eml file can lead to arbitrary file write. An attacker can provide a malicious file to trigger this vulnerability...

CVE-2026-42532

A path traversal vulnerability exists in the EmailSheet extractparts functionality of VisiData versions: dev commit 38b21f78. A specially crafted .eml file can lead to arbitrary file write. An attacker can provide a malicious file to trigger this vulnerability...

CVE-2026-103435 Arbitrary File Write via Write-Time Symlink Following (TOCTOU) in Claude Code

Claude Code validated that a target file path resided within the project working directory at permission-check time, but re-resolved the path at write time without repeating that validation. This time-of-check to time-of-use TOCTOU gap allowed an attacker who could write to the workspace to...

CVE-2026-103435

Claude Code is vulnerable to an arbitrary file write due to a time-of-check to time-of-use (TOCTOU) race condition. The software validates that a target file path is within the project working directory during permission checks but re-resolves the path at write time without re-validation. An atta...

CVE-2026-103435 Arbitrary File Write via Write-Time Symlink Following (TOCTOU) in Claude Code

Claude Code validated that a target file path resided within the project working directory at permission-check time, but re-resolved the path at write time without repeating that validation. This time-of-check to time-of-use TOCTOU gap allowed an attacker who could write to the workspace to...

EUVD-2026-94319

Claude Code validated that a target file path resided within the project working directory at permission-check time, but re-resolved the path at write time without repeating that validation. This time-of-check to time-of-use TOCTOU gap allowed an attacker who could write to the workspace to...

CVE-2026-103435 Arbitrary File Write via Write-Time Symlink Following (TOCTOU) in Claude Code

Claude Code validated that a target file path resided within the project working directory at permission-check time, but re-resolved the path at write time without repeating that validation. This time-of-check to time-of-use TOCTOU gap allowed an attacker who could write to the workspace to...

Exploit for CVE-2026-81780

CVE-2026-81780 — Hash Form ≤ 1.4.2 Unauthenticated RCE !CVE...

CVE-2026-104848

A flaw was found in tinypool. When an attacker is able to modify base JavaScript object properties prototype pollution, tinypool inadvertently copies these inherited configuration values into newly spawned worker threads. An attacker can exploit this behavior by injecting malicious startup...

Important: Red Hat Security Advisory: vim security update

An update for vim is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the C...

CVE-2026-35204

CVE-2026-35204 このリポジトリは CVE-2026-35204 の PoC です 説明 「Helm は Kubernetes 用の Charts のパッケージマネージャーです。4.0.0 から 4.1.3 において、細工された Helm プラグインがインストールまたは更新されると、Helm はプラグインの内容を任意のファイルシステム上の場所に書き込んでしまいます。これを防ぐには、Helm プラグインの plugin.yaml に POSIX のドットドットパス区切り文字、すなわち "/../" を含む version:...

CVE-2021-23394

elFinder CVE-2021-23394 재현 환경 설정 이 저장소는 Docker를 사용하여 CVE-2021-23394 elFinder의 임의 파일 실행의 재현 환경을 제공합니다. 취약한 버전과 패치된 버전을 Apache와 Nginx에서 비교할 수 있도록 4가지 환경을 설정합니다. 개요 설정은 다음을 포함합니다: 1. Apache 취약 포트 8080: Apache에서 elFinder 2.1.57 2. Apache 패치됨 포트 8081: Apache에서 elFinder 2.1.66 3. Nginx 취약 포트 8082:...

CVE-2026-21589: Critical unauthenticated arbitrary file access in Atlassian products

Overview On October 5, 2026, Atlassian published a security advisory for CVE-2026-21589, a critical arbitrary file access vulnerability affecting eight products: Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center, Crow...

kernel: svcrdma: Reject inline replies that overflow the pull-up buffer

A flaw was found in the Linux kernel's svcrdma component, which handles network communication using Remote Direct Memory Access RDMA. A remote attacker can send a specially crafted network reply that is larger than expected. This can cause the system to write data beyond the intended memory area,...

Atlassian Data Center Flaw Draws Exploitation Attempts Within Two Hours of Public Details

Threat actors have begun to exploit a newly disclosed critical security flaw impacting Atlassian Data Center products that could allow access to sensitive files under certain conditions. The arbitrary file access flaw, tracked as CVE-2026-21589 CVSS score: 9.3 affects multiple products, including...

CVE-2026-92531

Operating system command injection vulnerability in the SVN integration component of BugTracker.NET. The application incorporates the value of the field corresponding to the repository into an svn.exe command without properly validating it. An authenticated user with administrator privileges coul...

CVE-2026-96408

A code injection vulnerability exists in the upgrade script of Movable Type, which may allow an unauthenticated attacker to execute an arbitrary Perl script or an SQL query on the affected product...

CVE-2026-105839

A flaw was found in libmikmod. An integer overflow in the Oktalyzer music module loader can result in a heap-based buffer overflow when parsing manipulated track counts. By tricking a user or application into processing a specially crafted audio file, an attacker could achieve arbitrary code...

CVE-2026-85706

CVE-2026-85706 GitLab 未認証の任意ファイル読み取り ★ CVE-2026-85706 GitLab 未認証の任意ファイル読み取り PoC ★ https://github.com/user-attachments/assets/026749ec-04e9-4dd5-9453-cb7c1f6e823d 概要 CVE-2026-85706 は GitLab CE/EE における 未認証の任意ファイル読み取り CVSS 10.0、CISA KEV であり、POST /api/v4/projects/:id/repository/commits...