CVE-2024-28000

LiteSpeed Cache Privilege Escalation Exp CVE-2024-28000Scan.py This script first identifies the version to determine if it is a vulnerable version, then attempts to confirm whether the log file exists. If it exists, it will try to send a request and then request the log file again to search for...

CVE-2024-23897

CVE-2024-23897 CVE-2024-23897 jenkins-cli We have seen Jenkins File Leak / RCE CVE-2024-23897 exploited in the wild and managed to reproduce it. If your Jenkins allows anonymous users or user registration, immediately update it to the latest version. java -jar jenkins-cli.jar -s...

W&B Weave Server - Remote Arbitrary File Leak

The Weave server API allows remote users to fetch files from a specific directory, but due to a lack of input validation, it is possible to traverse and leak arbitrary files remotely. In various common scenarios, this allows a low-privileged user to assume the role of the server admin. id:...

wholeaked

Introduction , ,' ', Utku Sen's |,-' wholeaked /c '\ ' |' -. "When you have eliminated the impossible, /-' \ whatever remains, however improbable, /'-'\ must be the truth" - Sherlock Holmes ' \ wholeaked est un outil de partage de fichiers qui vous permet de trouver la personne responsable en cas...

CVE-2024-23897-Jenkins-4.441

CVE-2024-23897 - Jenkins Arbitrary File Leak Compile g++ CVE-2024-23897.cpp -o exploit Usage /exploit -u http://10.10.10.10 -f /etc/passwd...

same_type_object_reuse_exploits

PoC Same-Type/Same-Address Object Reuse Exploits PoC exploits developed by Mathias Krause associated with the blog at https://grsecurity.net/exploitinganddefendingagainstsametypeobjectreuse...

CVE-2024-23897

CVE-2024-23897 Jenkins Arbitrary File Leak Vulnerability CVE-2024-23897 !CAUTION ⚠️ Disclaimer: IMPORTANT: This script is provided for educational, ethical testing, and lawful use ONLY. Do not use it on any system or network without explicit permission. Unauthorized access to computer systems and...

Security Bulletin: Multiple Vulnerabilities affect IBM Decision Optimization for Cloud Pak for Data.

Summary Multiple Vulnerabilities were addressed in IBM Decision Optimization for Cloud Pak for Data version 5.3.1 before Patch 13 and 5.4.0 before Patch 6. Vulnerability Details CVEID:CVE-2026-45623 DESCRIPTION: PostCSS takes a CSS file and provides an API to analyze and modify its rules by...

CVE-2026-100536

Versions of OpenClaw prior to 2026.8.1 are vulnerable to a path traversal flaw within structured message attachments . The root cause is a failure to validate all source fields, which allows attackers to provide multiple source fields to bypass sandbox path validation . This enables the delivery ...

CVE-2026-73465 On affected platforms running Arista EOS, under certain circumstances plaintext private keys

On affected platforms running Arista EOS, under certain circumstances plaintext private keys may be written in clear text to log files during operations when specialized non-standard debugging trace levels are explicitly enabled. To exploit these vulnerabilities, a malicious actor must already...

PT-2026-90396

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.2.6-1.1 Description A resource leak occurs in the nfsd component during an inter-server COPY setup failure. When the function nfsd4 setup inter ssc fails, the nfsd4 copy function returns an error directly,...

PT-2026-96439

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix nfsd file leak on inter-server COPY setup failure When nfsd4 setup inter ssc fails, nfsd4 copy returns nfserr offload denied directly, bypassing the out: label where release copy files would drop the nf dst reference...

EUVD-2026-60972

CodeWhale: imageanalyze follows workspace symlinks, leaking external file bytes...

GHSA-W7WX-5Q49-R59W CodeWhale: image_analyze follows workspace symlinks, leaking external file bytes

Maintainer resolution The CodeWhale maintainers validated this report. The affected package ranges are recorded in the advisory metadata. Version 0.8.64 contains the fix in commit 26de44a8bd5051f8f944ea60b2c37ae1d2b7d25e. Users should upgrade to 0.8.64 or later. The original reporter analysis is...

EUVD-2026-62902

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user could read JavaScript files outside the Splunk Web static directory. The vulnerability is possible because Splunk Web does not restrict static file requests to the configured static directory...

CVE-2026-75914

CodeWhale versions before 0.8.64 contain a path traversal vulnerability in the image_analyze tool. The root cause is a failure to canonicalize symlinks before reading files, allowing an attacker to create workspace symlinks pointing to external files with image extensions. This enables arbitrary ...

CVE-2026-75914

CodeWhale versions before 0.8.64 contain a path traversal vulnerability in the imageanalyze tool that fails to canonicalize symlinks before reading files. Attackers can create workspace symlinks pointing to external files with image extensions to leak file bytes to the vision endpoint without use...

CVE-2026-75914 CodeWhale before 0.8.64 Path Traversal via image_analyze symlink

CodeWhale versions before 0.8.64 contain a path traversal vulnerability in the imageanalyze tool that fails to canonicalize symlinks before reading files. Attackers can create workspace symlinks pointing to external files with image extensions to leak file bytes to the vision endpoint without use...

CVE-2026-75914: Improper Limitation of a Pathname to a Restricted Directory

CodeWhale versions before 0.8.64 contain a path traversal vulnerability in the imageanalyze tool that fails to canonicalize symlinks before reading files. Attackers can create workspace symlinks pointing to external files with image extensions to leak file bytes to the vision endpoint without use...

Incomplete Cleanup

Overview @fastify/multipart is a Multipart plugin for Fastify Affected versions of this package are vulnerable to Incomplete Cleanup due to incomplete temporary-file handling in saveRequestFiles in index.js. An attacker can exhaust disk space by sending a multipart request that completes one file...