CVE-2026-38361

CVE-2026-38361: dash-uploader의 다중 인증되지 않은 DoS 취약점 fohrloop/dash-uploader Python, PyPI에서 발견된 다중 인증되지 않은 서비스 거부DoS 문제로, 이에 국한되지 않음 메모리 부족OOM 프로세스 충돌, 파일을 0바이트로 자르기, 영구적인 디스크 고갈, 문서화된 maxfilesize 제한의 완전한 우회 등을 포함합니다. 동일한 무결한 매개변수 집합을 통해 추가 리소스 남용 경로가 존재합니다. ⚠️ 패치가 없으며, 절대 출시되지 않을 것입니다 저장소는 2025-07-19...

Flowise-CVE-2026-58057-exploit

Flowise CVE-2026-58057 - Windows 远程代码执行漏洞利用 -orange?style=for-the-badge !Affected Versi...

Fragnesia-CVE-2026-46300

🔴 Fragnesia — CVE-2026-46300 Linux カーネルにおける特権昇格 · CVSS 7.8 · 2026年5月14日公開 注意喚起専用リポジトリです。 このリポジトリにはエクスプロイトコードは含まれていません。目的は、システム管理者、エンジニア、セキュリティチームに対して、脆弱性の性質と利用可能な対策について情報を提供することです。 📋 概要 フィールド| 値 ---|--- CVE| CVE-2026-46300 名称| Fragnesia 深刻度| 高 CVSS 7.8 種類| ローカル特権昇格 LPE コンポーネント| Linux カーネル — XFRM...

CVE-2025-60656

CVE-2025-60656 - 저장된 크로스사이트 스크립팅 XSS 취약점 홈페이지 | ---|--- 연구자| DotAdrien 심각도| 8.5 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N 소프트웨어| Script Pag 설명 홈페이지의 "최근 광고" 모듈을 통해 저장형 XSS 취약점이 존재합니다. 이미지 URL 필드에서 큰따옴표"를 제대로 처리하지 않습니다. 공격자는 https://google.com/image.png"와 같은 페이로드를 주입할 수 있으며, 이는 사용자가 홈페이지를...

CVE-2018-14667

CVE-2018-14667 在花费大量时间理解并正确利用此CVE后，我决定针对RichFaces 3.X的RCE漏洞构建一个仓库，并逐步向社区分享操作指南。 0x00 : RichFaces 3.X漏洞简介 2018年11月19日（周一）， Joao F M Figueiredo 发表了一篇详细文章（https://seclists.org/fulldisclosure/2018/Nov/47），涉及一个严重高风险的RichFaces漏洞。 CVSS3基础得分 9.8 该漏洞将允许任何未经身份验证的用户在使用RichFaces...

Vehicle-Service-Management-System-Multiple-File-upload-Leads-to-Code-Execution

CVE-2021-46076 익스플로잇 제목: Vehicle Service Management System - 'Multiple' 파일 업로드로 인한 코드 실행 익스플로잇 작성자: SANU P.L CVE: CVE-2021-46076 CVSS: 8.8 HIGH 참조: https://www.plsanu.com/vehicle-service-management-system-multiple-file-upload-leads-to-code-execution https://nvd.nist.gov/vuln/detail/CVE-2021-46076...

OneDev.io < 11.0.9 - Arbitrary File Read

Files on the host computer can be accessed by directory traversal. id: CVE-2024-45309 info: name: OneDev.io 11.0.9 - Arbitrary File Read author: isacaya severity: high description: | Files on the host computer can be accessed by directory traversal. impact: | An attacker would be able to view the...

LiteSpeed Cache <= 5.7 - Unauthenticated Stored XSS

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in LiteSpeed Technologies LiteSpeed Cache allows Stored XSS.This issue affects LiteSpeed Cache- from n/a through 5.7. id: CVE-2023-40000 info: name: LiteSpeed Cache = 5.7 - Unauthenticated Stored XSS...

GL.iNet <= 4.3.7 - Arbitrary File Write

GL.iNet = 4.3.7 is vulnerable to an arbitrary file write exploit, allowing an attacker to overwrite arbitrary system files. id: CVE-2023-46455 info: name: GL.iNet = 4.3.7 - Arbitrary File Write author: Zierax severity: high description: | GL.iNet = 4.3.7 is vulnerable to an arbitrary file write...

F-logic DataCube3 - SQL Injection

SQL injection vulnerability in f-logic datacube3 v.1.0 allows a remote attacker to obtain sensitive information via the reqid parameter. id: CVE-2024-31750 info: name: F-logic DataCube3 - SQL Injection author: DhiyaneshDK severity: high description: | SQL injection vulnerability in f-logic...

Infoblox NetMRI < 7.6.1 - Unauthenticated Command Injection in get_saml_request

An issue was discovered in Infoblox NETMRI before 7.6.1. Remote Unauthenticated Command Injection can occur. id: CVE-2025-32813 info: name: Infoblox NetMRI 7.6.1 - Unauthenticated Command Injection in getsamlrequest author: iamnoooob,pdresearch severity: high description: | An issue was discovere...

MeteoBridge <= 6.1 - Remote Code Execution

The Meteobridge web interface let meteobridge administrator manage their weather station data collection and administer their meteobridge system through a web application written in CGI shell scripts and C.This web interface exposes an endpoint that is vulnerable to command injection.Remote...

Cockpit < 2.4.1 - Arbitrary File Upload

Versions of the package cockpit-hq/cockpit before 2.4.1 are vulnerable to Arbitrary File Upload where an attacker can use different extensions to bypass the upload filter. id: CVE-2025-1025 info: name: Cockpit 2.4.1 - Arbitrary File Upload author: iamnoooob,rootxharsh,pdresearch severity: high...

DELMIA Apriso - Broken Access Control

DELMIA Apriso Release 2020 through Release 2025 contains a broken access control vulnerability caused by missing authorization, letting attackers gain privileged access to the application, exploit requires no special conditions. id: CVE-2025-6205 info: name: DELMIA Apriso - Broken Access Control...

PT-2026-107867

🔐 Security news curl founder Daniel Stenberg says curl 8.23.0 will fix 22 security vulnerabilities on 14 October 2026, including one rated HIGH. That flaw brought the release forward by a few weeks. → CVE-2026-92392 is the new HIGH-severity flaw → The other 21 vulnerabilities are less serious →...

How-to-Patch-CVE-2025-32709

CVE-2025-32709 취약점 패치 방법 CVE-2025-32709에 대한 실제 패치 워크플로우입니다. 핫픽스 설치부터 SIEM 알림 검증까지 — 이 저장소는 스크린샷, 명령어 및 탐지 로직과 함께 모든 단계를 문서화합니다. Windows 10 Pro 엔드포인트에서 CVE-2025-32709가 높은 심각도 취약점으로 플래그된 Wazuh 취약점 탐지 대시보드의 스크린샷. 에이전트 window10 004는 하나의 높은 심각도 문제를 보고하고 있으며, 시스템이 현재 노출 상태임을 확인합니다. 이 이미지는 패치 전 기준선 역할을 ...

PaperCut NG - Authentication Bypass

This vulnerability allows remote attackers to bypass authentication on affected installations of PaperCut NG 22.0.5 Build 63914. Authentication is not required to exploit this vulnerability. The specific flaw exists within the SecurityRequestFilter class. The issue results from improper...

SureTriggers – All-in-One Automation Platform ≤ 1.0.78 - Authentication Bypass

The SureTriggers- All-in-One Automation Platform plugin for WordPress is vulnerable to an authentication bypass leading to administrative account creation due to a missing empty value check on the 'secretkey' value in the 'autheticateuser' function in all versions up to, and including, 1.0.78. Th...

VMware Aria Operations for Networks - Remote Code Execution

Aria Operations for Networks contains an authenticated deserialization vulnerability. A malicious actor with network access to VMware Aria Operations for Networks and valid 'member' role credentials may be able to perform a deserialization attack resulting in remote code execution. id:...

SonicWall GMS and Analytics - SQL Injection

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in SonicWall GMS and Analytics allows an unauthenticated attacker to extract sensitive information from the application database. This issue affects GMS: 9.3.2-SP1 and earlier versions; Analytics:...