📄 LibreChat MCP Remote Command Execution

LibreChat's Model Context Protocol MCP implementation contained a remote command execution vulnerability that allowed any authenticated user to execute commands as root on the Docker container. A single API request could trigger the exploit by taking advantage of the exposure of the stdio transpo...

Exploit for Improper Neutralization of Line Delimiters in Cacti

███╗ ███╗ ██████╗ ███╗ ██╗██╗████████╗ ██████╗ ██████╗ █...

EUVD-2017-1256

Malware in sbrugna...

EUVD-2021-1117

Malware in sbrugna...

EUVD-2020-7373

Malware in sbrugna...

EUVD-2020-6452

Malware in sbrugna...

Exploit for Improper Input Validation in Siemens 6Bk1602-0Aa12-0Tp0_Firmware

It is an offensive tool for Apache Log4j. This PoC exploit targe...

EUVD-2024-22148

Malicious code in bioql PyPI...

EUVD-2024-22150

Malicious code in bioql PyPI...

EUVD-2025-7790

Malicious code in bioql PyPI...

EUVD-2025-6918

Malicious code in bioql PyPI...

EUVD-2024-3054

Malicious code in bioql PyPI...

EUVD-2025-24235

Malicious code in bioql PyPI...

CVE-2025-34222

Vasion Print formerly PrinterLogic Virtual Appliance Host prior to version 22.0.1049 and Application prior to version 20.0.2786 VA/SaaS deployments expose four admin routes – /admin/hp/certupload, /admin/hp/certdelete, /admin/certs/ca, and /admin/certs/serviceclients/scid – without any...

CVE-2025-34222

Vasion Print formerly PrinterLogic Virtual Appliance Host prior to version 22.0.1049 and Application prior to version 20.0.2786 VA/SaaS deployments expose four admin routes – /admin/hp/certupload, /admin/hp/certdelete, /admin/certs/ca, and /admin/certs/serviceclients/scid – without any...

CVE-2025-34207 Vasion Print (formerly PrinterLogic) Insecure SSH Client Configuration

Vasion Print formerly PrinterLogic Virtual Appliance Host prior to 22.0.1049 and Application prior to 20.0.2786 VA and SaaS deployments configure the SSH client within Docker instances with the following options: UserKnownHostsFile=/dev/null, StrictHostKeyChecking=no, and ForwardAgent yes. These...

Exploit for Code Injection in Langflow

It is an offensive tool for web exploitation. The target product...

Dyad 代码注入漏洞

Dyad is an AI application builder open-sourced by Dyad. A code injection vulnerability exists in Dyad 0.19.0 and earlier versions, which stems from the Preview Window feature that can bypass Docker container protection and could lead to the execution of arbitrary code...

CVE-2025-40767

CVE-2025-40767 affects Siemens SINEC Traffic Analyzer (versions prior to 3.0). All connected sources consistently describe a weakness where the application runs docker containers without adequate isolation, enabling an attacker with local access to potentially gain elevated privileges and access ...

Siemens SINEC Traffic Analyzer 资源管理错误漏洞

Siemens SINEC Traffic Analyzer is a network traffic analysis tool from Siemens Germany. A resource management error vulnerability exists in Siemens SINEC Traffic Analyzer versions prior to V3.0, which stems from insufficient resource limitations in docker containers and could lead to a denial of...