58 matches found
CVE-2022-22948
CVE-2022-22948 Information Disclosure in VMWare vCenter Pentera’s research group discovered a vulnerability in VMWare’s vCenter Server program affecting VMWare’s software installed in 500,000 organizations worldwide responsible to manage their most critical systems Our findings were proactively...
CVE-2026-74487 binfmt_misc: restore write access when removing an entry
In the Linux kernel, the following vulnerability has been resolved: binfmtmisc: restore write access when removing an entry Registering an entry with the MISCFMTOPENFILE flag opens the interpreter via openexec which denies write access to it for as long as the entry exists. Removing the entry...
CVE-2026-74486 binfmt_misc: use exe_file_deny_write_access() for the interpreter clone
In the Linux kernel, the following vulnerability has been resolved: binfmtmisc: use exefiledenywriteaccess for the interpreter clone For MISCFMTOPENFILE entries loadmiscbinary clones the registered interpreter file and denies write access to the clone via plain denywriteaccess. The clone is...
PT-2026-65514
Name of the Vulnerable Software and Affected Versions Pterodactyl Panel versions prior to 1.12.3 Pterodactyl Wings versions prior to 1.12.2 Description A privilege escalation issue exists in the Wings '/upload/file' endpoint. The system accepts any valid panel-signed JSON Web Token JWT containing...
CVE-2026-52944
A flaw was found in the Linux kernel's ksmbd component. This vulnerability allows a client to bypass intended permission restrictions by using the FSCTLSETSPARSE operation. Specifically, a client on a read-only share can modify a file's sparse attribute, and clients on writable shares can modify...
CVE-2026-11420
Two path traversal vulnerabilities in the Network Installation Service NIS of Altium Enterprise Server allow an unauthenticated network attacker to write arbitrary files to any writable location on the server filesystem and to read package archive files from the server. No authentication, session...
Evolver path traversal vulnerability
Evolver is an intelligent agent-based self-evolution tool developed by EvoMap. Versions of Evolver prior to 1.69.3 contained a path traversal vulnerability. This vulnerability stemmed from issues with path traversal in skill download commands, which could allow attackers to write files to any...
EUVD-2026-21152
PraisonAIAgents has an OS Command Injection via shell=True in Memory Hooks Executor memory/hooks.py...
CVE-2026-40111
PraisonAIAgents memory/hooks.py allows OS command injection via a user-controlled string passed to subprocess.run() with shell=True before 1.5.128. No sanitization occurs, shell metacharacters are interpreted by /bin/sh, enabling execution of arbitrary commands. Two attack surfaces exist: pre_run...
CVE-2026-40111
PraisonAIAgents is a multi-agent teams system. Prior to 1.5.128, he memory hooks executor in praisonaiagents passes a user-controlled command string directly to subprocess.run with shell=True at src/praisonai-agents/praisonaiagents/memory/hooks.py. No sanitization is performed and shell...
nodejs: Nodejs file permissions bypass
A flaw in Node.js’s Permissions model allows attackers to bypass --allow-fs-read and --allow-fs-write restrictions using crafted relative symlink paths. By chaining directories and symlinks, a script granted access only to the current directory can escape the allowed path and read sensitive files...
PT-2026-29498
Name of the Vulnerable Software and Affected Versions Tina versions prior to 2.2.2 Description A path-traversal issue exists in Tina, a headless content management system, due to insufficient validation of file paths in the dev media routes. The implementation validates only the path string and...
PT-2026-20972
Name of the Vulnerable Software and Affected Versions Music Assistant versions 2.6.3 and below Description Music Assistant is an open-source media library manager that integrates streaming services with connected speakers. Versions 2.6.3 and below allow unauthenticated network-adjacent attackers ...
CVE-2017-18446
cPanel before 64.0.21 allows file-read and file-write operations for demo accounts via the SourceIPCheck API SEC-250...
Self-hosted n8n has Legacy Code node that enables arbitrary file read/write
Impact In self-hosted n8n instances where the Code node runs in legacy non-task-runner JavaScript execution mode, authenticated users with workflow editing access can invoke internal helper functions from within the Code node. This allows a workflow editor to perform actions on the n8n host with...
EUVD-2012-6161
Malware in sbrugna...
EUVD-2015-8210
Malware in sbrugna...
EUVD-2015-7604
Malware in sbrugna...