CVE-2025-43929

CVE-2025-43929 Доказательство концепции для CVE-2025-43929, уязвимости высокой степени серьезности в KiTTY, позволяющей при определенных обстоятельствах запускать локальные исполняемые файлы без подтверждения пользователя Тип уязвимости CWE-346: CWE-346 Ошибка проверки происхождения Описание...

CVE-2026-100381

CVE-2026-100381: Flickr のコレクションおよびセットのタイトルにおける DOM XSS 報告者: Marco Paciaroni BomboBombone。 UploadWizard は Flickr のコレクションおよびセットのタイトルを、文字列を HTML として解釈する API を通じて挿入していました。そのため、外部のタイトルメタデータがウィキページ内で実行可能なマークアップになり得ました。 影響を受けるバージョン CVE レコードは、1.46.1、1.45.5、および 1.43.10 での修正前の、影響を受ける UploadWizard...

CVE-2021-1732_exp

CVE-2021-1732-Exploit CVE-2021-1732 익스플로잇 "불법 행위에 사용하지 마십시오. 그렇지 않을 경우 책임은 본인에게 있습니다!" EXP 사용법 CVE-2021-1732exploit.exe whoami 리소스: https://bbs.pediy.com/thread-266362.htm...

openSUSE 16 Security Update : php-composer2 (openSUSE-SU-2026:21970-1)

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21970-1 advisory. - CVE-2026-59944: path traversal and link following issue can make files world readable and executable bsc1279898. Tenable has extracted the...

SUSE SLES16 Security Update : php-composer2 (SUSE-SU-2026:23943-1)

The remote SUSE Linux SLES16 / SLESSAP16 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:23943-1 advisory. - CVE-2026-59944: path traversal and link following issue can make files world readable and executable bsc1279898. Tenable has...

CVE-2026-103441

Deserialization of untrusted data vulnerability in The Wikimedia Foundation MediaWiki Wikibase extension allows Leverage Executable Code in Non-Executable Files. This issue affects MediaWiki Wikibase extension: 1.46, 1.45, and 1.43...

pki-core security update

11.7.1-2.0.1 - Replaced upstream graphical references Orabug: 33952704 11.7.0-2 - RHEL-245465 CVE-2026-76561 pki-core: ExternalProcessConstraint executable allow-list - RHEL-248586 CVE-2026-80110 pki-core: ACLFilter sort order fix...

Oracle Linux 10 : dogtag-pki (ELSA-2026-73765)

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-73765 advisory. - RHEL-245469 CVE-2026-76561 dogtag-pki: ExternalProcessConstraint executable allow-list Tenable has extracted the preceding description block direct...

OPENSUSE-SU-2026:21970-1 Security update for php-composer2

This update for php-composer2 fixes the following issues: - CVE-2026-59944: path traversal and link following issue can make files world readable and executable bsc1279898...

SUSE-SU-2026:23943-1 Security update for php-composer2

This update for php-composer2 fixes the following issues: - CVE-2026-59944: path traversal and link following issue can make files world readable and executable bsc1279898...

Malicious code in nebulaai-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dc906b81107141fbd85dcabf89fd2f5112c4e4a134045c90d6a35abb4b67d16e The package's preinstall.js contains a base64+zlib-encoded 257 KB Windows PE executable. On npm install on Windows, the script decodes the blob and...

MAL-2026-17198 Malicious code in caracas4check (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 973d711f03dafa9f390e489476d4795acdda8db926bdd688ca5e1abbe6efa025 The package installs boot.pth at the site-packages root, causing 'import c4cboot' to run on every Python interpreter startup on the host after...

Malicious code in caracas4check (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 973d711f03dafa9f390e489476d4795acdda8db926bdd688ca5e1abbe6efa025 The package installs boot.pth at the site-packages root, causing 'import c4cboot' to run on every Python interpreter startup on the host after...

CVE-2026-100560 OpenClaw before 2026.8.1 Reusable Exec Approvals Authorization Bypass

OpenClaw versions before 2026.8.1 contain an authorization bypass vulnerability where Allow Always approvals for exact commands persist as path-only grants on macOS and Linux. Attackers can reuse the same executable with different arguments to execute commands without triggering new approval...

PT-2026-99254

Name of the Vulnerable Software and Affected Versions Request a Quote for WooCommerce versions prior to 2.9.3 Description An arbitrary file upload issue exists in the afrfq submit quote via popup function. The popup upload handler fails to validate file extensions and MIME types, using the raw...

CVE-2026-48482 GLPI: RCE via Form import

GLPI is a free asset and IT management software package. From 11.0.0 until 11.0.8, a form administrator can use Form import with a crafted illustration or scene identifier that traverses outside the intended custom-asset directory. The imported file can be written to an executable server location...

Linux Distros Unpatched Vulnerability : CVE-2026-81880

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's Apple Preferred Executable Format loader was vulnerable...

CVE-2026-71465 Automation-controller: automation-controller-container: automation-controller: ad-hoc command limit field allows cli argument injection into ansible executable

RunAdHocCommand.buildargs appends limit as bare positional args.appendlimit instead of using args.extend'-l', limit like RunJob. A limit beginning with - is parsed as an ansible CLI option. Currently limited to short-circuit flags --version, --help since injected element displaces required patter...

SUSE CVE-2026-81880

radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's Apple Preferred Executable Format loader was vulnerable because the PEF loader accepted relocSecCount values that were not bounded by the number of sections or complete relocation records in t...

CVE-2026-81885

A flaw was found in radare2, a reverse engineering framework. By opening a specially crafted NE executable file, an attacker could trigger an an infinite loop within the application's relocation parser. This continuous processing would consume excessive CPU and memory, leading to a denial of...