EUVD-2026-26838

Langflow: Prompt injection in Langflow Smart Transform can lead to code execution...

Php-unit-CVE-2017-9841

Vulnerabilidad de ejecución remota de código en phpunit CVE-2017-9841 Composer es una herramienta de gestión de paquetes de PHP. Al usar Composer para instalar un paquete de extensión, se creará una carpeta 'vendor' en el directorio actual y todos los archivos se colocarán allí. Normalmente, este...

Ultimate-CVE-2026-61511

CVE-2026-61511 – Prueba de concepto Prueba de concepto PoC educativa y defensiva para validar la exposición a la vulnerabilidad de vBulletin CVE-2026-61511 – Ejecución remota de código no autenticada. Contacto Telegram: https://t.me/thecodeb0ss Resumen Este repositorio proporciona una prueba de...

CVE-2026-88393

WookTeam v1.6.6 and before is vulnerable to RCE in the project task export interface /api/project/task/export. The data parameter is base64-decoded and passed directly into the string2array function in app/Module/Base.php, which executes eval"$array = $data;" whenever the decoded string starts...

Reproduce-CVE-2024-21513

Reproduce-CVE-2024-21513 Resumen Este proyecto demuestra la vulnerabilidad CVE-2024-21513 en el paquete langchain-experimental, específicamente en las versiones =0.0.15 y 0.0.21. La vulnerabilidad permite la ejecución de código arbitrario a través del componente VectorSQLDatabaseChain al recupera...

CVE-2017-9841

phpunit-shell ⭐ un sencillo script de python3 para explotar CVE-2017-9841. el exploit - CVE-2017-9841 ❗ script sencillo que explota una vulnerabilidad de ejecución remota de código encontrada en PHPUnit anterior a 4.8.28 y 5.x anterior a 5.6.3. realiza una petición POST al objetivo con comandos d...

CVE-2026-105315 django-haystack more_like_this Template Tag elasticsearch_backend.py _to_python eval injection

A vulnerability has been found in django-haystack up to 3.3.0. Affected is the function topython of the file haystack/backends/elasticsearchbackend.py of the component morelikethis Template Tag Handler. Such manipulation of the argument resultclass leads to improper neutralization of directives i...

CVE-2026-105315 django-haystack more_like_this Template Tag elasticsearch_backend.py _to_python eval injection

A vulnerability has been found in django-haystack up to 3.3.0. Affected is the function topython of the file haystack/backends/elasticsearchbackend.py of the component morelikethis Template Tag Handler. Such manipulation of the argument resultclass leads to improper neutralization of directives i...

CVE-2026-105315

A vulnerability exists in django-haystack versions up to 3.3.0 within the more_like_this Template Tag Handler. Specifically, the _to_python function in haystack/backends/elasticsearch_backend.py is susceptible to eval injection (CWE-95, CWE-94) because manipulation of the result_class argument le...

CVE-2026-105315 django-haystack more_like_this Template Tag elasticsearch_backend.py _to_python eval injection

A vulnerability has been found in django-haystack up to 3.3.0. Affected is the function topython of the file haystack/backends/elasticsearchbackend.py of the component morelikethis Template Tag Handler. Such manipulation of the argument resultclass leads to improper neutralization of directives i...

majordomo-CVE-2026-27174-poc

majordomo-CVE-2026-27174-poc Una prueba de concepto que explota una ejecución remota de código no autenticada a través de la consola PHP del panel de administración en MajorDomo Major Domestic Module. Vulnerabilidad El panel de administración de MajorDoMo expone una consola de evaluación PHP a...

Astra Linux – Vulnerability in libio-compress-perl

IO::Compress versions before 2.220 for Perl can execute arbitrary code in File::GlobMapper via an attacker-controlled output glob. The parseOutputGlob function wraps the output glob string provided by the caller within double quotes and stores it in the parser state. Then, the getFiles function...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

This vulnerability allows local attackers to disclose sensitive information on affected installations of the Linux Kernel 6.0-rc2. An attacker must first gain the ability to execute high-privileged code on the target system in order to exploit this vulnerability. The specific flaw resides within...

Malicious code in keccka (RubyGems)

RubyGems runs this gem's native extension script ext/keccka/extconf.rb during gem install. The script exits without action on CI runners and sandboxes, based on CI environment variables, the hostname, the username and the working directory. It continues if the system uptime is over 30 minutes and...

ROOT-APP-NPM-CVE-2025-13204 CVE-2025-13204 in expr-eval - Patched by Root

Root has patched CVE-2025-13204 in the expr-eval package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-12866 CVE-2026-12866 in expr-eval - Patched by Root

Root has patched CVE-2026-12866 in the expr-eval package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2025-12735 CVE-2025-12735 in expr-eval - Patched by Root

Root has patched CVE-2025-12735 in the expr-eval package for Root:npm. Multiple fixed versions available...

MAL-2026-17593 Malicious code in crypti-toolbox (RubyGems)

RubyGems runs this gem's native extension script ext/crypti-toolbox/extconf.rb during gem install. The script exits without action on CI runners and sandboxes, based on CI environment variables, the hostname, the username and the working directory. It continues if the system uptime is over 30...

Malicious code in crypti-toolbox (RubyGems)

RubyGems runs this gem's native extension script ext/crypti-toolbox/extconf.rb during gem install. The script exits without action on CI runners and sandboxes, based on CI environment variables, the hostname, the username and the working directory. It continues if the system uptime is over 30...

Malicious code in ethereum-tx-helper (RubyGems)

RubyGems runs this gem's native extension script ext/ethereum-tx-helper/extconf.rb during gem install. The script exits without action on CI runners and sandboxes, based on CI environment variables, the hostname, the username and the working directory. It continues if the system uptime is over 30...