655963 matches found
Node.js 26.12.0 Brotli Decoder Remote Code Execution
Node.js versions 22.x, 24.x, and 26.x contain an out-of-bounds write in the Brotli decoder that may permit remote code execution when an application decompresses attacker-controlled Brotli data. https://packetstorm.news/download/238907...
WordPress 7.1.3 Pingback Brotli Decoder Remote Code Execution
A proof of concept demonstrates reaching a vulnerable native Brotli decoder through the WordPress version 7.1.3 pingback path to execute a fixed id command in a local Podman lab. https://packetstorm.news/download/238897...
PT-2026-135451
Netpbm before 10.86.51, 11.x before 11.02.30, and 11.03 before 11.15.08 contains a heap buffer overflow in xpmtoppm caused by an unvalidated characters-per-pixel value in the XPM header. Attackers can supply a crafted XPM file with characters-per-pixel greater than 3 to overrun fixed 3-byte...
PT-2026-135714
Name of the Vulnerable Software and Affected Versions Google Android Framework versions 14 through 17 Description A heap buffer overflow exists in the Android Framework component, specifically within the onOutputReceived function in FrameDecoder.cpp. This flaw allows an out-of-bounds write to occ...
Security Advisory 0202
Security Advisory 0202 PDF Date: November 2, 2026 Revision | Date | Changes ---|---|--- 1.0 | November 2, 2026 | Initial release The CVE-ID tracking this issue: CVE-2026-111497 CVSSv3.1 Base Score: 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSSv4.0 Base Score: 9.2...
cve-2025-32433
Build » git clone https://github.com/0xPThree/cve-2025-32433.git && cd cve-2025-32433 » docker build -t erlang-ssh . » docker run -d --name erlang-ssh -p 2222:2222 erlang-ssh POC kdev :: /erlang/CVE-2025-32433 ‹main› » python3 cve-2025-32433.py -h usage: cve-2025-32433.py -h -d --host HOST --port...
kernel: mptcp: pm: userspace: fix use-after-free in get_local_id
A flaw was found in the Linux kernel's Multipath TCP MPTCP subsystem. A race condition in the mptcppmuserspacegetlocalid function allows a memory address entry to be freed while still being referenced. A local attacker could exploit this use-after-free vulnerability, potentially leading to a syst...
kernel: Linux kernel: PPP over L2TP Use-After-Free vulnerability
A flaw was found in the Linux kernel's Point-to-Point Protocol PPP over L2TP Layer 2 Tunneling Protocol implementation. An unprivileged user can exploit a Use-After-Free UAF vulnerability, where the system attempts to use memory after it has been freed. This can lead to memory corruption,...
kernel: mptcp: pm: userspace: fix use-after-free in get_local_id
A flaw was found in the Linux kernel's Multipath TCP MPTCP subsystem. A race condition in the mptcppmuserspacegetlocalid function allows a memory address entry to be freed while still being referenced. A local attacker could exploit this use-after-free vulnerability, potentially leading to a syst...
Fortinet FortiNAC keyUpload Cron RCE (CVE-2022-39952)
Horizon3 PoC: unauthenticated POST to /configWizard/keyUpload.jsp with a ZIP placing a cron job under /etc/cron.d/. Use a CMD reverse payload. !/usr/bin/env python3 -- coding: utf-8 -- """ CVE-2022-39952 — Fortinet FortiNAC arbitrary file write via keyUpload.jsp Horizon3. Uploads a ZIP whose entr...
Ivanti Sentry MICSLog RCE (CVE-2023-38035)
Horizon3: unauthenticated Hessian uploadFileUsingFileInput on /mics/services/MICSLogService with root command execution. Uses framework HTTP/Hessian client proxy-aware. CMD payload. !/usr/bin/env python3 -- coding: utf-8 -- """ CVE-2023-38035 — Ivanti Sentry MICSLogService Hessian command injecti...
CVE-2025-55182
CVE-2025-55182 Next.js Prototype Pollution CVE-2025-55182 is a critical prototype pollution vulnerability in nextjs that allows rce via improper input sanitization in the framework's request handling mechanism, this whole thing happens because nextjs is out here trusting JSON objects like a...
CVE-2018-2628
Test for Vulnerabilities Upload Shell Method one: Method two: Execute Shell Obtain Meterpreter msf use exploit/multi/script/webdelivery msf exploitmulti/script/webdelivery set target 3 target = 3 msf exploitmulti/script/webdelivery set payload windows/meterpreter/reversetcp payload =...
[SECURITY] [DLA 4874-1] eog security update
------------------------------------------------------------------------- Debian LTS Advisory DLA-4874-1 [email protected] https://www.debian.org/lts/security/ Chris Lamb October 31, 2026 https://wiki.debian.org/LTS -...
CVE-2026-111813
A flaw was found in Apache Traffic Server. When the experimental magick plugin is enabled without argument signing, an unauthenticated remote attacker can control command-line parameters passed to the underlying ImageMagick conversion utility. An attacker could exploit this argument injection fla...
LogMePwn
LogMePwn LogMePwn is a fully automated, multi-protocol, reliable, super-fast scanning and validation toolkit for the Log4J RCE CVE-2021-44228 vulnerability. Tool Highlights Inherent support for automatic Canary Tokens generation using emails or webhooks. Multi-protocol support: HTTP, IMAP, SSH,...
Exploit for Code Injection in Gitea
B63-POC-CVE-2026-60004 — Gitea diffpatch RCE Verification l...
[SECURITY] [DSA 6601-1] eog security update
------------------------------------------------------------------------- Debian Security Advisory DSA-6601-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff November 01, 2026 https://www.debian.org/security/faq -...
SUSE CVE-2026-115946
XS::libbrotli versions before 1.2.1.0 for Perl bundle a brotli library with an out-of-bounds write in the decoder. Affected versions compile a bundled brotli into static archives that dependent XS modules link against at build time, rather than using the system library. The bundled copy, 1.0.7 or...
[SECURITY] [DSA 6600-1] vim security update
------------------------------------------------------------------------- Debian Security Advisory DSA-6600-1 [email protected] https://www.debian.org/security/ Yves-Alexis Perez November 01, 2026 https://www.debian.org/security/faq -...