NCBI ToolBox - Directory Traversal

NCBI ToolBox 2.0.7 through 2.2.26 legacy versions contain a path traversal vulnerability via viewcgi.cgi which may result in reading of arbitrary files i.e., significant information disclosure or file deletion via the nph-viewgif.cgi query string. id: CVE-2018-16716 info: name: NCBI ToolBox -...

Hitachi Pentaho Business Analytics Server - Bypass Authorization

Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.2, including 8.3.x contain security restrictions using non-canonical URLs which can be circumvented. id: CVE-2022-43939 info: name: Hitachi Pentaho Business Analytics Server - Bypass Authorization author: daffainf...

CVE-2024-4040-CrushFTP-File-Read-vulnerability

CVE-2024-4040: CrushFTP ファイル読み取りの脆弱性 概要 2024年4月19日、管理ファイル転送ベンダーであるCrushFTPは、10.7.1および11.1.0より前のバージョン、ならびにレガシーな9.x系バージョンに影響を及ぼす新しいゼロデイ脆弱性を、プライベートメーリングリストで開示しました。当初、ベンダーによるCVEの割り当てはありませんでしたが、2024年4月22日に第三者機関であるCVE Numbering Authority（CNA）がCVE-2024-4040を発行しました。...

CVE-2024-21626

CVE-2024-21626의 PoC 자세한 설명은 여기에서 전체 글을 읽어보세요. 관련 글 CVE-2024–21626 을 조사하던 중, 오래된 Docker 및 runC 버전에서 간과된 취약점을 발견했습니다. 제가 찾은 내용에 대해 더 자세히 알아보려면 다음 글을 읽어보세요: “레거시 Docker 버전에서 숨겨진 취약점 탐색: CVE-2024–21626에서 얻은 교훈”. 환경 설정 🔨 A. 22.04.1-Ubuntu LTS 버전 다운로드 및 설치 설치 중 업데이트 시스템 다운로드 상자를 체크하지 마세요. B. 가상 머신에서 쉽게...

bettercap

이 저장소는 더 이상 사용되지 않습니다deprecated, bettercap 개발은 여기로 이동되었으며 2.0.0 미만의 모든 버전은 레거시legacy로 간주되며 지원되지 않습니다NOT SUPPORTED...

CVE-2026-9277

CVE-2026-9277 - Shell-Quote コマンドインジェクションエクスプロイト shell-quote ライブラリのレガシーバージョン（= 1.8.3）に存在する構造的コマンドインジェクションの脆弱性である CVE-2026-9277 を検証および実証するために設計された、専用の Proof of Concept（PoC）エクスプロイトスクリプトです。 本スキャナは、入力された JSON...

Astra Linux – Vulnerability in Firefox, Thunderbird

Memory safety bugs exist in Firefox 132, Firefox ESR 128.4, and Thunderbird 128.4. Some of these bugs exhibited signs of memory corruption, and we assume that with sufficient effort, some of these bugs could have been exploited to execute arbitrary code. This vulnerability affects Firefox version...

CVE-2026-66058 Frappe: Unrestricted access to a Document Follow API

Frappe is a full-stack web application framework. Prior to 16.20.0 and 15.112.0, unrestricted access to a Document Follow API updatefollow is possible for an authenticated user. This issue is fixed in versions 16.20.0 and 15.112.0...

Inadequate Encryption Strength

Overview Affected versions of this package are vulnerable to Inadequate Encryption Strength in the BcKeyStoreSpi.engineLoad method, which for legacy BKS keystore versions 0 and 1 passes hMac.getMacSize 20 bytes for SHA-1 to generateDerivedMacParameters, where PKCS12ParametersGenerator divides it ...

CVE-2026-12860 RSA PKCS#1 verification skips last two hash bytes in NULL-omitted path

In Bouncy Castle for Java before 1.85, RSA PKCS1 verification skips last two hash bytes in NULL-omitted path. This issue also affects Bouncy Castle for Java LTS before 2.73.12...

CVE-2026-58059

In Bouncy Castle for Java before 1.85, Quadratic-time escaping when stringifying X.500 distinguished names. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS BC-FJA before bc-fips 1.0.2.7 1.0.X series, 2.0.2 2.0.X series and 2.1.3 2.1.X series...

DEBIAN-CVE-2026-59650

In Bouncy Castle for Java before 1.85, MTI/A0 DH agreement exponentiates unvalidated peer value. This issue also affects Bouncy Castle for Java LTS before 2.73.12...

CVE-2026-9571

Mattermost CVE-2026-9571 affects versions 11.7.x <= 11.7.2, 11.6.x <= 11.6.4, and 10.11.x

PYSEC-2026-490 Apache Pyfory python is vulnerable to deserialization of untrusted data

Deserialization of untrusted data in python in pyfory versions 0.12.0 through 0.12.2, or the legacy pyfury versions from 0.1.0 through 0.10.3: allows arbitrary code execution. An application is vulnerable if it reads pyfory serialized data from untrusted sources. An attacker can craft a data stre...

DEBIAN-CVE-2026-39938

Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior have unauthenticated LFI through graphtheme and rrdtool IPC serialization hardening. This issue has been resolved in version 1.2.31...

Linux Distros Unpatched Vulnerability : CVE-2026-48990

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption JOSE standards. In versions 1.3.4 through 1.6.5, joser...

CVE-2026-40766 WordPress MasterStudy LMS plugin <= 3.7.25 - SQL Injection vulnerability

Subscriber SQL Injection in MasterStudy LMS = 3.7.25 versions...

Exploit for CVE-2026-9277

CVE-2026-9277 - Shell-Quote Command Injection Expl...

CVE-2026-6736

An authentication bypass vulnerability was identified in GitHub Enterprise Server that allowed an unauthenticated attacker to create a local user account, bypassing the configured external identity provider. When external authentication was enabled, the signup endpoint did not properly enforce th...

CVE-2026-42539 IRIS has an Excessive Data Exposure issue

IRIS is a web collaborative platform that helps incident responders share technical details during investigations. Versions prior to 2.4.28 return sensitive data to the user which are not required for the client’s operation. Version 2.4.28 contains a patch...