484743 matches found
CVE-2026-115572
pypdf is a free and open-source pure-python PDF library. Prior to 6.21.2, an attacker can craft a PDF that repeatedly references the same nonexistent indirect object, causing relevant file parts such as pages to trigger repeated full-file recovery loads and long runtimes when accessed. This issue...
EUVD-2026-109128
pypdf is a free and open-source pure-python PDF library. Prior to 6.21.2, an attacker can craft a PDF that repeatedly references the same nonexistent indirect object, causing relevant file parts such as pages to trigger repeated full-file recovery loads and long runtimes when accessed. This issue...
CVE-2025-3419
CVE-2025-3419 - WordPress Eventin = 4.0.26 - Arbitrary File Read 🔥 Vulnerability Summary The Eventin plugin = 4.0.26 for WordPress contains an unauthenticated arbitrary file read vulnerability in the proxyimage function. Attackers exploit insufficient input validation by manipulating the url...
CVE-2026-55888
A flaw was found in xdg-desktop-portal. An attacker operating a sandboxed application can bypass isolation boundaries to gain unauthorized access to host files. This issue occurs because the FileChooser interface fails to properly validate filenames before passing them to backend services...
EUVD-2026-109119
Fallow is a codebase intelligence tool for TypeScript and JavaScript. From 2.68.0 until 3.34.0, Fallow follows attacker-controlled Jest projects paths outside the project root through absolute paths, parent segments, dot-prefixed wildcard globs, or symlinks. In version 3.33.1, the same behavior...
CVE-2026-115569
The codebase intelligence tool Fallow is vulnerable to a path traversal and link following issue in versions 2.68.0 through 3.34.0 . Specifically, attacker-controlled Jest projects paths can force the tool to read files outside the project root using absolute paths, parent segments, dot-prefixed ...
CVE-2026-115569 Fallow: Jest and Vitest `projects` entries let an analyzed repository make Fallow read files outside the project root
Fallow is a codebase intelligence tool for TypeScript and JavaScript. From 2.68.0 until 3.34.0, Fallow follows attacker-controlled Jest projects paths outside the project root through absolute paths, parent segments, dot-prefixed wildcard globs, or symlinks. In version 3.33.1, the same behavior...
CVE-2026-115569 Fallow: Jest and Vitest `projects` entries let an analyzed repository make Fallow read files outside the project root
Fallow is a codebase intelligence tool for TypeScript and JavaScript. From 2.68.0 until 3.34.0, Fallow follows attacker-controlled Jest projects paths outside the project root through absolute paths, parent segments, dot-prefixed wildcard globs, or symlinks. In version 3.33.1, the same behavior...
EUVD-2026-98694
obsidian-tc : Symlink read-ACL scope bypass via lexical path checks...
CVE-2026-115378
A flaw was found in Incus. A privileged attacker within a virtual machine can write arbitrary files to the host system during a recursive file pull operation. By manipulating the guest agent to return duplicate file entries alternating between symbolic links and regular files, the attacker can...
server
Ulterius: Easy Remote Management Interested in sublicensing? Want to use our code in your stack or rebrand it for internal use? Reach out to us at [email protected] Ulterius is a tool that allows unfettered access to a Windows system via a remote web interface. This program allows you to sta...
SUSE CVE-2026-114583
tarfile.tarfilter could be bypassed using crafted link entries, including symlinks with empty or directory-like names, to redirect later archive members outside the intended extraction directory. This allowed a malicious tar archive to cause tarfile.extractall with filter="tar" to write files...
phptopwn
PHP2Shell Threat-Intelligence Honeypot A safe, high-interacti...
CVE-2016-4437
shiro-1.2.4 Vulnerability Tool Decrypt rememberMe value and export corresponding class file Usage xk-mt-rememberMe解码.py Instructions: After running, first enter the key or press Enter to use the default key 'kPH+bIxk5D2deZiIxcaaaA==', then enter the rememberMe value from the request packet. After...
CVE-2026-54668
Kitodo.Production is a workflow management tool for mass digitization and is part of the Kitodo Digital Library Suite. Prior to version 3.9.2, org.kitodo.production.helper.XMLUtils exposes several XML parsing helpers that construct a JAXP parser with the default, non-secure configuration. The...
CVE-2022-4047
CVE-2022-4047 Return Refund and Exchange For WooCommerce 4.0.9 - Unauthenticated Arbitrary File Upload Usage @@@@@@@ @@@ @@@ @@@@@@@@ @@@@@@ @@@@@@@@ @@@@@@ @@@@@@ @@@ @@@@@@@@ @@@ @@@@@@@@ @@@@@@@@ @@@ @@@ @@@@@@@@ @@@@@@@@ @@@@@@@@@@ @@@@@@@@ @@@@@@@@ @@@@ @@@@@@@@@@ @@@@ @@@@@@@@ !@@ @@! @@@ @...
CVE-2023-3836
Dahua Smart Campus Integrated Management Platform publishing File Upload POC Install Dependencies pip install argparse requests rich Note: Python3 environment is used. Usage python CVE-2023-3836.py -h URL format in the file Execution Results...
CVE-2026-54668 Kitodo.Production: XXE in XMLUtils EAD/XML upload parsers (parseXMLString / getNumberOfEADElements / checkIfXmlIsWellFormed lack secure JAXP config)
Kitodo.Production is a workflow management tool for mass digitization and is part of the Kitodo Digital Library Suite. Prior to version 3.9.2, org.kitodo.production.helper.XMLUtils exposes several XML parsing helpers that construct a JAXP parser with the default, non-secure configuration. The...
EUVD-2026-109091
Kitodo.Production is a workflow management tool for mass digitization and is part of the Kitodo Digital Library Suite. Prior to version 3.9.2, org.kitodo.production.helper.XMLUtils exposes several XML parsing helpers that construct a JAXP parser with the default, non-secure configuration. The...
CVE-2026-54668
Kitodo.Production , a workflow management tool within the Kitodo Digital Library Suite, is vulnerable to XML External Entity (XXE) injection in versions prior to 3.9.2 . The root cause is located in org.kitodo.production.helper.XMLUtils, where the methods parseXMLString(String), getNumberOfEADEle...