CVE-2024-30088-

Weakness: CWE-367: Time-of-check Time-of-use TOCTOU Race Condition CVSS Source: Microsoft CVSS: 3.1 7.0 / 6.3...

CVE-2025-53964

CVE-2025-53964 Risk assessment CVSS v3: AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L - 9.6/10 Description GoldenDict 1.5.0 and 1.5.1 has an exposed dangerous method that allows reading and modifying files when a user adds a crafted dictionary and then searches for any term included in that dictionary...

CVE-2026-103977

Summary FileRise versions before 3.23.0 stored failed TOTP verification attempts in PHP session state. The counter limited attempts within one session but did not persist across newly created sessions. An attacker who already possesses a target account's valid primary credential could restart the...

Security Bulletin: IBM Integration Designer is vulnerable to CVE-2026-68497

Summary Vulnerability in jackson-databind.jar in IBM Integration Designer: CVE-2026-68497 Vulnerability Details CVEID:CVE-2026-68497 DESCRIPTION: jackson-databind binds a JSON string to a javax.xml.datatype.Duration or javax.xml.datatype.XMLGregorianCalendar field by passing the raw string verbat...

CVE-2026-68771_exploit

CVE-2026-68771 — ComfyUI Unauthenticated Pickle Deserialization RCE Unauthenticated remote code execution in ComfyUI via the LoadTrainingDataset node. LoadTrainingDataset.execute loads dataset shards from the server's output directory with torch.loadf and noweightsonly=True. On PyTorch /tmp/pwned...

CVE-2026-32475

CVE-2026-32475 — Elementor Pro ≤ 4.2.1 Unauthenticated Arbitrary File Upload → RCE PoC for CVE-2026-32475 CVSS 9.0 Critical, CWE-434: an unauthenticated arbitrary file upload in the Elementor Pro Forms module that leads to remote code execution. Fixed in Elementor Pro 4.2.2 2026-08-19. Reported b...

Security Bulletin: Vulnerabilities exists in IBM Netezza Appliance

Summary Vulnerabilities identified in IBM Netezza Appliance have been addressed in version 1.0.2.0 Vulnerability Details CVEID:CVE-2026-30892 DESCRIPTION: crun is an open source OCI Container Runtime fully written in C. In versions 1.19 through 1.26, the crun exec option -u --user is incorrectly...

Security Bulletin: Vulnerabilities exists in IBM Netezza Appliance

Summary Vulnerabilities identified in IBM Netezza Appliance have been addressed in version 1.0.2.0 Vulnerability Details CVEID:CVE-2024-7592 DESCRIPTION: There is a LOW severity vulnerability affecting CPython, specifically the 'http.cookies' standard library module. When parsing cookies that...

Security Bulletin: Vulnerabilities exists in IBM Netezza Appliance

Summary Vulnerabilities identified in IBM Netezza Appliance have been addressed in version 1.0.2.0 Vulnerability Details CVEID:CVE-2026-43869 DESCRIPTION: Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift. This issue affects Apache Thrift: before 0.23.0. Users a...

Security Bulletin: Vulnerabilities exists in IBM Netezza Appliance

Summary Vulnerabilities identified in IBM Netezza Appliance have been addressed in version 1.0.2.0 Vulnerability Details CVEID:CVE-2026-21933 DESCRIPTION: Java SE could allow a remote attacker to bypass security controls and perform unauthorized update, insert, delete, or read operations on...

poc-h2-CVE-2026-71554

CVE-2026-71554 - h2 Duplicate Host Header Request Smuggling Primitive This is my first CVE, and I have released this PoC to document the finding and help others understand and reproduce it. CVE: CVE-2026-71554 GHSA: GHSA-6hr6-w5qg-qmwg Affected: h2 = 4.4.0 Fixed: h2 4.4.1 Severity: Medium CWE-444...

cve-2026-19553-wrap-bio

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · cve-2026-19553-wrap-bio cve-2026-19553-wrap-bio CPython ssl - Python Software Foundation ssl.SSLContext.wrapbio non richiedeva che serverhostname fosse non-None quando checkhostname è impostato. SSLObject salta...

CVE-2026-55450

CVE-2026-55450 — Langflow Security Advisory Unauthenticated File Upload Vulnerability Overview CVE-2026-55450 concerns a reported file-upload vulnerability affecting Langflow, an open-source platform for building AI-powered workflows. An exposed upload endpoint may permit unauthenticated file...

CVE-2026-42945

CVE-2026-42945 Practical Risk Assessment Script A local risk assessment tool for CVE-2026-42945 Nginx Rift. Unlike simply telling you "version is affected so it's dangerous", this script checks the three conditions that truly determine risk layer by layer and gives a conclusion tailored to your...

cve

CVE Problem statement: Stackoverflow I'm trying to build by project in Docker, So i'm using Docker Desktop to build my project, when i build the image i get this as one of my vulnerabilities CVE-2024-26308 CWE-770 7.5 H Allocation of Resources Without Limits or Throttling vulnerability in Apache...

golismero

What's GoLismero? GoLismero is an open source framework for security testing. It's currently geared towards web security, but it can easily be expanded to other kinds of scans. The most interesting features of the framework are: Real platform independence. Tested on Windows, Linux, BSD and OS X. ...

NotCVE-2026-0014

Summary Product: InputLeap v3.0.3 Vendor: input-leap Vulnerability: Path Traversal CWE: CWE-22 Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' Description InputLeap's drag-and-drop handler tries to sanitize filenames by finding the last path separator and keeping only...

CVE-2025-5880-PoC

CVE-2025-5880 — Whistle 2.9.98 Path Traversal PoC Proof-of-concept exploit for an unauthenticated path traversal vulnerability in Whistle v2.9.98. Vulnerability Summary Field| Detail ---|--- CVE ID| CVE-2025-5880 CWE| CWE-22 Path Traversal Affected Software| Whistle ≤ 2.9.98 Affected Endpoint|...

ChatGPT-Next-Web - SSRF/XSS

Full-Read SSRF/XSS in NextChat, aka ChatGPT-Next-Web id: CVE-2023-49785 info: name: ChatGPT-Next-Web - SSRF/XSS author: high severity: critical description: | Full-Read SSRF/XSS in NextChat, aka ChatGPT-Next-Web impact: | Unauthenticated attackers can exploit SSRF vulnerabilities through the...

SolarWinds Web Help Desk < 12.8.7 - AjaxProxy Deserialization RCE

SolarWinds Web Help Desk contains an unauthenticated AjaxProxy deserialization remote code execution vulnerability, letting attackers run commands on the host machine without authentication, exploit requires no special privileges. id: CVE-2025-26399 info: name: SolarWinds Web Help Desk 12.8.7 -...