CVE-2026-5007

A vulnerability was identified in kazuph mcp-docs-rag up to 0.5.0. Affected is the function cloneRepository of the file src/index.ts of the component addgitrepository/addtextfile. The manipulation leads to os command injection. The attack needs to be performed locally. The exploit is publicly...

EUVD-2026-9938

A vulnerability has been found in Ettercap 0.8.4-Garofalo. Affected by this vulnerability is the function adddatasegment of the file src/ettercap/utils/etterfilter/efoutput.c of the component etterfilter. The manipulation leads to out-of-bounds read. Local access is required to approach this...

UBUNTU-CVE-2026-3388

A vulnerability was found in Squirrel up to 3.2. This affects the function SQCompiler::Factor/SQCompiler::UnaryOP of the file squirrel/sqcompiler.cpp. Performing a manipulation results in uncontrolled recursion. The attack needs to be approached locally. The exploit has been made public and could...

PT-2026-8348

A flaw has been found in GeekAI up to 4.2.4. The affected element is the function Download of the file api/handler/net handler.go. This manipulation of the argument url causes server-side request forgery. Remote exploitation of the attack is possible. The exploit has been published and may be use...

CVE-2026-1173 birkir prime GraphQL Array Based Query Batch graphql denial of service

A vulnerability was found in birkir prime up to 0.4.0.beta.0. The impacted element is an unknown function of the file /graphql of the component GraphQL Array Based Query Batch Handler. The manipulation results in denial of service. The attack can be executed remotely. The exploit has been made...

CVE-2025-15175 SohuTV CacheCloud AppController.java appCommandAnalysis cross site scripting

A vulnerability was detected in SohuTV CacheCloud up to 3.2.0. Affected by this issue is the function doAppList/appCommandAnalysis of the file src/main/java/com/sohu/cache/web/controller/AppController.java. Performing manipulation results in cross site scripting. It is possible to initiate the...

CVE-2025-42980

creationtimestamp| type| source ---|---|--- 2025-07-08 01:16:35+00:00| seen| https://infosec.exchange/users/cR0w/statuses/114814969134379111 2025-07-16 17:11:07+00:00| seen| https://bsky.app/profile/fraustief.bsky.social/post/3lu3vx5gtfk2k 2025-07-16 17:11:10+00:00| seen|...

GHSA-J975-95F5-7WQH

creationtimestamp| type| source ---|---|--- 2025-07-04 23:16:53+00:00| seen| https://infosec.exchange/users/cR0w/statuses/114797511485377082...

CVE-2025-6587

creationtimestamp| type| source ---|---|--- 2025-07-03 11:35:47+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lt2n5p6moi2r...

CVE-2025-4238

creationtimestamp| type| source ---|---|--- 2025-05-03 17:17:57+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/14700 2025-05-03 18:06:12+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lobwjls6gk2j 2025-05-03 19:00:35+00:00| published-proof-of-concept|...

CVE-2025-32140

creationtimestamp| type| source ---|---|--- 2025-04-10 09:49:04+00:00| seen| https://mastodon.social/users/CyberSignaler/statuses/114313038004475519 2025-04-23 05:00:06+00:00| published-proof-of-concept| Telegram/qDzkx44siSc8n4X8sjQ5ZjiFphGSFajZZfESRCa-0oTFNSE 2025-04-23 09:00:07+00:00|...

tendermint-rs's Light Client Verifier allows malicious validators to spoof votes from other validators

Name: ISA-2025-003: Malicious validator can spoof votes from other validators Component: tendermint-rs Criticality: High Catastrophic Impact; Rare Likelihood per ACMv1.2 Affected versions: = v0.40.2 Affected users: Everyone Description tendermint-rs contains a critical vulnerability in its light...

GHSA-3HJ6-R5C9-Q8F3 Frappe has possibility of SQL injection due to improper validations

Impact An SQL Injection vulnerability has been identified in Frappe Framework which could allow a malicious actor to access sensitive information. Workarounds Upgrading is required, no other workaround is present. Credits Thanks to Thanh of Calif.io for reporting the issue...

PT-2024-17425 · Undefined · Undefined

Name of the Vulnerable Software and Affected Versions: No information is available about the vulnerable software and its affected versions. Description: The issue was initially reported but later rejected as a candidate, and its usage was prevented. No further details are available about the natu...

CVE-2024-11017

creationtimestamp| type| source ---|---|--- 2024-11-11 06:56:24+00:00| seen| https://infosec.exchange/users/cve/statuses/113463013134342227 2024-11-11 09:24:51+00:00| seen| https://t.me/cvedetector/10480 2026-07-04 19:37:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mptspd2nhu2i...

CVE-2022-44577

DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none...

Node.js third-party modules: [systeminformation] Command Injection via insecure command formatting

I would like to report a Command Injection vulnerability in the systeminformation package. It allows an attacker to inject arbitrary OS commands. Module Module name: systeminformation Version: 4.26.10 npm page: https://www.npmjs.com/package/systeminformation Module Description System and OS...

Arbitrary File Upload/Execution in Collabtive

TITLE: Arbitrary File Upload/Execution in Collabtive DATE: 06-04-2012 PRODUCT: Collabtive Web-Based Project Management Software http://collabtive.o-dyn.de/ VERSIONS: 0.7.5, 0.6.1 confirmed. All versions = 0.7.5 probable RESEARCHER: Mark Hoopes [email protected]/ ADDITIONAL INFORMATION:...

phpLDAPadmin <= 1.2.1.1 (query_engine) Remote PHP Code Injection

Exploit for php platform in category web applications ?php / ------------------------------------------------------------------------ phpLDAPadmin = 1.2.1.1 queryengine Remote PHP Code Injection Exploit ------------------------------------------------------------------------ author..................