Set-AuditRule

Set-AuditRule A repository of useful access control entries ACE that could be added to the system access control list SACL of a securable object's security descriptor to monitor potential adversarial activity. These entries are categorized by specific securable objects such as files, registry key...

ACEshark

ACEshark What is it? ACEshark is a utility designed for rapid extraction and analysis of Windows service configurations and Access Control Entries, eliminating the need for tools like accesschk.exe or other non-native binaries. Why? Efficiently identify and analyze service permissions to uncover...

crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries

A flaw was found in the crypto/x509 package of golang. This vulnerability allows a remote attacker to cause a Denial of Service DoS by presenting a specially crafted X.509 certificate with a large number of DNS Subject Alternative Name SAN entries. The certificate verification process, specifical...

MAL-007

MAL-007: XML External Entity via Local Registry Entries in WSO2 ESB An inline XML External Entity XXE attack was identified in the WSO2 ESB “Local Entities” tool. Why no CVE? The vendor replied that this vulnerability was "Fixed in WUM" and no public disclosure was made. Requirements: This...

fuzztruction

Fuzztruction Fuzztruction is an academic prototype of a fuzzer that does not directly mutate inputs as most fuzzers do but instead uses a so-called generator application to produce an input for our fuzzing target. As programs generating data usually produce the correct representation, our fuzzer...

Parsero

What's Parsero? Parsero is a free script written in Python which reads the Robots.txt file of a web server and looks at the Disallow entries. The Disallow entries tell the search engines what directories or files hosted on a web server mustn't be indexed. For example, "Disallow: /portal/login"...

EUVD-2026-107072

The Redirection for Contact Form 7 WordPress plugin before 3.2.12 does not sanitise or escape submitted form data stored as lead entries before outputting it in the lead debug metabox, allowing unauthenticated attackers to store a malicious script that executes when a logged-in user views the ent...

CVE-2026-114110

Astral uv before 0.11.6 contains a path traversal vulnerability that allows attackers to delete arbitrary files by supplying wheels with relative traversal paths in RECORD entries. Attackers can craft a malicious wheel whose RECORD references files outside the installation prefix, causing uv to...

CVE-2026-114110

Astral uv before 0.11.6 contains a path traversal vulnerability that allows attackers to delete arbitrary files by supplying wheels with relative traversal paths in RECORD entries. Attackers can craft a malicious wheel whose RECORD references files outside the installation prefix, causing uv to...

CVE-2026-114110 Astral uv before 0.11.6 Arbitrary File Deletion via Wheel RECORD Entries

Astral uv before 0.11.6 contains a path traversal vulnerability that allows attackers to delete arbitrary files by supplying wheels with relative traversal paths in RECORD entries. Attackers can craft a malicious wheel whose RECORD references files outside the installation prefix, causing uv to...

CVE-2026-114110 Astral uv before 0.11.6 Arbitrary File Deletion via Wheel RECORD Entries

Astral uv before 0.11.6 contains a path traversal vulnerability that allows attackers to delete arbitrary files by supplying wheels with relative traversal paths in RECORD entries. Attackers can craft a malicious wheel whose RECORD references files outside the installation prefix, causing uv to...

CVE-2026-114110

Astral uv versions before 0.11.6 are vulnerable to a path traversal vulnerability (CWE-23). An attacker can craft a malicious wheel package containing RECORD entries with relative traversal paths. When a user uninstalls the affected package, uv may delete arbitrary files located outside the insta...

EUVD-2026-106913

Astral uv before 0.11.6 contains a path traversal vulnerability that allows attackers to delete arbitrary files by supplying wheels with relative traversal paths in RECORD entries. Attackers can craft a malicious wheel whose RECORD references files outside the installation prefix, causing uv to...

EUVD-2026-105963

Vulnerability in the Oracle Payroll product of Oracle E-Business Suite component: Element Types, Links, Entries. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Payroll...

PT-2026-120467

The Redirection for Contact Form 7 WordPress plugin before 3.2.12 does not sanitise or escape submitted form data stored as lead entries before outputting it in the lead debug metabox, allowing unauthenticated attackers to store a malicious script that executes when a logged-in user views the ent...

PT-2026-120236

Astral uv before 0.11.6 contains a path traversal vulnerability that allows attackers to delete arbitrary files by supplying wheels with relative traversal paths in RECORD entries. Attackers can craft a malicious wheel whose RECORD references files outside the installation prefix, causing uv to...

CVE-2026-101553

Vulnerability in the Oracle Payroll product of Oracle E-Business Suite component: Element Types, Links, Entries. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Payroll...

CVE-2026-101553

A vulnerability exists in the Oracle Payroll product of Oracle E-Business Suite , specifically affecting the Element Types, Links, and Entries components. The affected versions range from 12.2.3 to 12.2.15 . A low-privileged attacker with network access via HTTP can easily exploit this flaw to co...

CVE-2026-98595

A flaw was found in the Linux kernel's UDP networking subsystem. When a connected User Datagram Protocol UDP socket bound to a specific address is disconnected, the kernel fails to remove the socket entry from its internal connection lookup table. A local user can cause stale entries to persist,...

Contact Form Entries < 1.2.4 - Cross-Site Scripting

The plugin does not sanitise and escape various parameters, such as formid, status, enddate, order, orderby and search before outputting them back in the admin page id: CVE-2021-25079 info: name: Contact Form Entries 1.2.4 - Cross-Site Scripting author: r3Y3r53 severity: medium description: | The...