Fallow: Jest and Vitest `projects` entries let an analyzed repository make Fallow read files outside the project root

Impact Fallow reads the Jest and Vitest configs of the repository that it analyzes. A Jest projects entry or a Vitest test.projects entry can name a path. Fallow followed such an entry to a config file and read that file, also when the file was outside the project root. These forms reached outsid...

bing-ip2hosts

Bing-ip2hosts Bing-ip2hosts is a Bing.com web scraper to discover hostnames by IP address. Description Bing-ip2hosts is a Bing.com web scraper that discovers hostnames by IP address. Bing is the flagship Microsoft search engine formerly known as MSN Search and Live Search. It provides a feature...

CVE-2026-115801 Kakao khaiii JSON Config File Linear.cpp open out-of-bounds

A security flaw has been discovered in Kakao khaiii up to 0.4. The impacted element is the function khaiii::nn::Linear::open of the file src/main/cpp/khaiii/nn/Linear.cpp of the component JSON Config File Handler. The manipulation of the argument hiddendim/classnum results in out-of-bounds read...

CVE-2026-115801 Kakao khaiii JSON Config File Linear.cpp open out-of-bounds

A security flaw has been discovered in Kakao khaiii up to 0.4. The impacted element is the function khaiii::nn::Linear::open of the file src/main/cpp/khaiii/nn/Linear.cpp of the component JSON Config File Handler. The manipulation of the argument hiddendim/classnum results in out-of-bounds read...

CVE-2026-115801

A security flaw exists in Kakao khaiii up to version 0.4 within the JSON Config File Handler component. Specifically, the khaiii::nn::Linear::open function in src/main/cpp/khaiii/nn/Linear.cpp is vulnerable to an out-of-bounds read when the hidden_dim/class_num argument is manipulated. This vulne...

HTB_Nibbles

HTBNibbles In this repository you will find the technical report of Nibbles, the exploit pwned.py to abuse the CVE-2015-6967 and an autopwn tool autopwn.py in case you want to resolve the machine in HackTheBox. Pwned.py tool: This file will help you to exploit CVE-2015-6967. If you want to run th...

phpinfo-files-leaks

Badges License MIT Installation 1. Install Python3 and pip Instructions Here If you can't figure this out, you shouldn't really be using this Install via pip pip install phpinfo-file-leaks Run bellow command to check phpinfo-file-leaks -h Configurations 2. We integrated with the Telegram API to...

oracleShell

oracleShell Oracle Database Command Execution Test Environment - DBA Privileges: SELECT FROM v$version Oracle Database 11g Enterprise Edition Release 11.2.0.1.0 - Production PL/SQL Release 11.2.0.1.0 - Production "CORE 11.2.0.1.0 Production" TNS for 32-bit Windows: Version 11.2.0.1.0 - Production...

odf-kit has HTML injection leading to XSS in odsToHtml() via unescaped style attribute values

Summary ODF style values are interpolated into style="..." attributes without HTML-escaping in odf-kit's ODS to-HTML renderer odsToHtml. A double-quote character inside an attacker-controlled style value breaks out of the attribute, allowing arbitrary HTML/attribute injection — and therefore scri...

CVE-2025-30208

CVE-2025-30208 Detection Tool Vulnerability Analysis Vite Arbitrary File Read Vulnerability Analysis and Reproduction CVE-2025-30208 Introduction This tool is used to detect whether a target system is vulnerable to CVE-2025-30208. This vulnerability allows an attacker to read sensitive files such...

CVE-2019-20085

📂 CVE-2019-20085 – TVT NVMS-1000 Directory Traversal Exploit By Z3R0 Author: Z3R0 CVE: CVE-2019-20085 Target: TVT NVMS-1000 all known versions prior to patch Vuln Type: Unauthenticated Directory Traversal Date: Insert Your Release Date 🔍 Vulnerability Summary TVT's NVMS-1000 software contains a...

DEBIAN-CVE-2026-115572

pypdf is a free and open-source pure-python PDF library. Prior to 6.21.2, an attacker can craft a PDF that repeatedly references the same nonexistent indirect object, causing relevant file parts such as pages to trigger repeated full-file recovery loads and long runtimes when accessed. This issue...

CVE-2026-115572

pypdf is a free and open-source pure-python PDF library. Prior to 6.21.2, an attacker can craft a PDF that repeatedly references the same nonexistent indirect object, causing relevant file parts such as pages to trigger repeated full-file recovery loads and long runtimes when accessed. This issue...

EUVD-2026-109128

pypdf is a free and open-source pure-python PDF library. Prior to 6.21.2, an attacker can craft a PDF that repeatedly references the same nonexistent indirect object, causing relevant file parts such as pages to trigger repeated full-file recovery loads and long runtimes when accessed. This issue...

CVE-2025-3419

CVE-2025-3419 - WordPress Eventin = 4.0.26 - Arbitrary File Read 🔥 Vulnerability Summary The Eventin plugin = 4.0.26 for WordPress contains an unauthenticated arbitrary file read vulnerability in the proxyimage function. Attackers exploit insufficient input validation by manipulating the url...

CVE-2026-55888

A flaw was found in xdg-desktop-portal. An attacker operating a sandboxed application can bypass isolation boundaries to gain unauthorized access to host files. This issue occurs because the FileChooser interface fails to properly validate filenames before passing them to backend services...

CVE-2026-115569 Fallow: Jest and Vitest `projects` entries let an analyzed repository make Fallow read files outside the project root

Fallow is a codebase intelligence tool for TypeScript and JavaScript. From 2.68.0 until 3.34.0, Fallow follows attacker-controlled Jest projects paths outside the project root through absolute paths, parent segments, dot-prefixed wildcard globs, or symlinks. In version 3.33.1, the same behavior...

CVE-2026-115569

The codebase intelligence tool Fallow is vulnerable to a path traversal and link following issue in versions 2.68.0 through 3.34.0 . Specifically, attacker-controlled Jest projects paths can force the tool to read files outside the project root using absolute paths, parent segments, dot-prefixed ...

CVE-2026-115569 Fallow: Jest and Vitest `projects` entries let an analyzed repository make Fallow read files outside the project root

Fallow is a codebase intelligence tool for TypeScript and JavaScript. From 2.68.0 until 3.34.0, Fallow follows attacker-controlled Jest projects paths outside the project root through absolute paths, parent segments, dot-prefixed wildcard globs, or symlinks. In version 3.33.1, the same behavior...

EUVD-2026-109119

Fallow is a codebase intelligence tool for TypeScript and JavaScript. From 2.68.0 until 3.34.0, Fallow follows attacker-controlled Jest projects paths outside the project root through absolute paths, parent segments, dot-prefixed wildcard globs, or symlinks. In version 3.33.1, the same behavior...